solidus_auth_devise 1.0.0
Sign up to get free protection for your applications and to get access to all the features.
Potentially problematic release.
This version of solidus_auth_devise might be problematic. Click here for more details.
- checksums.yaml +7 -0
- data/.gitignore +9 -0
- data/.rspec +2 -0
- data/.travis.yml +11 -0
- data/Gemfile +9 -0
- data/LICENSE.md +26 -0
- data/README.md +88 -0
- data/Rakefile +21 -0
- data/app/controllers/metal_decorator.rb +6 -0
- data/app/mailers/spree/user_mailer.rb +15 -0
- data/app/models/spree/auth_configuration.rb +7 -0
- data/app/models/spree/user.rb +50 -0
- data/app/overrides/auth_shared_login_bar.rb +7 -0
- data/app/overrides/spree/admin/shared/_header/auth_admin_login_navigation_bar.html.erb.deface +4 -0
- data/bin/rails +7 -0
- data/config/initializers/devise.rb +137 -0
- data/config/initializers/warden.rb +14 -0
- data/config/locales/de.yml +49 -0
- data/config/locales/en.yml +55 -0
- data/config/locales/es.yml +49 -0
- data/config/locales/fr.yml +49 -0
- data/config/locales/it.yml +76 -0
- data/config/locales/nl.yml +49 -0
- data/config/locales/pt-BR.yml +51 -0
- data/config/locales/tr.yml +49 -0
- data/config/routes.rb +48 -0
- data/db/default/users.rb +83 -0
- data/db/migrate/20101026184949_create_users.rb +29 -0
- data/db/migrate/20101026184950_rename_columns_for_devise.rb +37 -0
- data/db/migrate/20101214150824_convert_user_remember_field.rb +11 -0
- data/db/migrate/20120203010234_add_reset_password_sent_at_to_spree_users.rb +8 -0
- data/db/migrate/20120605211305_make_users_email_index_unique.rb +9 -0
- data/db/migrate/20140904000425_add_deleted_at_to_users.rb +6 -0
- data/db/migrate/20141002154641_add_confirmable_to_users.rb +7 -0
- data/db/seeds.rb +5 -0
- data/lib/assets/javascripts/spree/backend/solidus_auth.js +1 -0
- data/lib/assets/javascripts/spree/frontend/solidus_auth.js +1 -0
- data/lib/assets/stylesheets/spree/backend/solidus_auth.css +3 -0
- data/lib/assets/stylesheets/spree/frontend/solidus_auth.css +3 -0
- data/lib/controllers/backend/spree/admin/admin_controller_decorator.rb +26 -0
- data/lib/controllers/backend/spree/admin/admin_orders_controller_decorator.rb +20 -0
- data/lib/controllers/backend/spree/admin/admin_resource_controller_decorator.rb +3 -0
- data/lib/controllers/backend/spree/admin/orders/customer_details_controller_decorator.rb +15 -0
- data/lib/controllers/backend/spree/admin/user_passwords_controller.rb +45 -0
- data/lib/controllers/backend/spree/admin/user_sessions_controller.rb +47 -0
- data/lib/controllers/frontend/spree/checkout_controller_decorator.rb +47 -0
- data/lib/controllers/frontend/spree/user_confirmations_controller.rb +21 -0
- data/lib/controllers/frontend/spree/user_passwords_controller.rb +53 -0
- data/lib/controllers/frontend/spree/user_registrations_controller.rb +72 -0
- data/lib/controllers/frontend/spree/user_sessions_controller.rb +53 -0
- data/lib/controllers/frontend/spree/users_controller.rb +57 -0
- data/lib/generators/spree/auth/install/install_generator.rb +26 -0
- data/lib/generators/spree/auth/install/templates/config/initializers/devise.rb +1 -0
- data/lib/solidus/auth.rb +2 -0
- data/lib/solidus_auth_devise.rb +5 -0
- data/lib/spree/auth/devise.rb +20 -0
- data/lib/spree/auth/engine.rb +77 -0
- data/lib/spree/authentication_helpers.rb +26 -0
- data/lib/tasks/auth.rake +9 -0
- data/lib/views/backend/spree/admin/user_passwords/edit.html.erb +15 -0
- data/lib/views/backend/spree/admin/user_passwords/new.html.erb +17 -0
- data/lib/views/backend/spree/admin/user_sessions/authorization_failure.html.erb +4 -0
- data/lib/views/backend/spree/admin/user_sessions/new.html.erb +31 -0
- data/lib/views/backend/spree/layouts/admin/_login_nav.html.erb +13 -0
- data/lib/views/frontend/spree/checkout/registration.html.erb +22 -0
- data/lib/views/frontend/spree/shared/_flashes.html.erb +9 -0
- data/lib/views/frontend/spree/shared/_login.html.erb +18 -0
- data/lib/views/frontend/spree/shared/_login_bar.html.erb +6 -0
- data/lib/views/frontend/spree/shared/_user_form.html.erb +17 -0
- data/lib/views/frontend/spree/user_mailer/confirmation_instructions.text.erb +5 -0
- data/lib/views/frontend/spree/user_mailer/reset_password_instructions.text.erb +10 -0
- data/lib/views/frontend/spree/user_passwords/edit.html.erb +17 -0
- data/lib/views/frontend/spree/user_passwords/new.html.erb +17 -0
- data/lib/views/frontend/spree/user_registrations/new.html.erb +21 -0
- data/lib/views/frontend/spree/user_sessions/authorization_failure.html.erb +4 -0
- data/lib/views/frontend/spree/user_sessions/new.html.erb +13 -0
- data/lib/views/frontend/spree/users/edit.html.erb +14 -0
- data/lib/views/frontend/spree/users/show.html.erb +43 -0
- data/solidus_auth_devise.gemspec +42 -0
- data/spec/controllers/spree/admin/orders_controller_spec.rb +14 -0
- data/spec/controllers/spree/checkout_controller_spec.rb +141 -0
- data/spec/controllers/spree/products_controller_spec.rb +21 -0
- data/spec/controllers/spree/user_passwords_controller_spec.rb +44 -0
- data/spec/controllers/spree/user_registrations_controller_spec.rb +13 -0
- data/spec/controllers/spree/user_sessions_controller_spec.rb +56 -0
- data/spec/controllers/spree/users_controller_spec.rb +38 -0
- data/spec/factories/confirmed_user.rb +7 -0
- data/spec/features/account_spec.rb +58 -0
- data/spec/features/admin/orders_spec.rb +29 -0
- data/spec/features/admin/password_reset_spec.rb +24 -0
- data/spec/features/admin/payment_methods_spec.rb +16 -0
- data/spec/features/admin/products_spec.rb +9 -0
- data/spec/features/admin/sign_in_spec.rb +44 -0
- data/spec/features/admin/sign_out_spec.rb +22 -0
- data/spec/features/admin_permissions_spec.rb +46 -0
- data/spec/features/change_email_spec.rb +24 -0
- data/spec/features/checkout_spec.rb +165 -0
- data/spec/features/confirmation_spec.rb +28 -0
- data/spec/features/order_spec.rb +62 -0
- data/spec/features/password_reset_spec.rb +24 -0
- data/spec/features/sign_in_spec.rb +52 -0
- data/spec/features/sign_out_spec.rb +25 -0
- data/spec/features/sign_up_spec.rb +30 -0
- data/spec/mailers/user_mailer_spec.rb +46 -0
- data/spec/models/order_spec.rb +26 -0
- data/spec/models/user_spec.rb +58 -0
- data/spec/spec_helper.rb +25 -0
- data/spec/support/ability.rb +15 -0
- data/spec/support/authentication_helpers.rb +14 -0
- data/spec/support/capybara.rb +7 -0
- data/spec/support/confirm_helpers.rb +11 -0
- data/spec/support/database_cleaner.rb +18 -0
- data/spec/support/email.rb +5 -0
- data/spec/support/factory_girl.rb +5 -0
- data/spec/support/spree.rb +26 -0
- metadata +452 -0
@@ -0,0 +1,21 @@
|
|
1
|
+
RSpec.describe Spree::ProductsController, type: :controller do
|
2
|
+
|
3
|
+
let!(:product) { create(:product, available_on: 1.year.from_now) }
|
4
|
+
let!(:user) { build(:user, spree_api_key: 'fake') }
|
5
|
+
|
6
|
+
it 'allows admins to view non-active products' do
|
7
|
+
allow(controller).to receive(:before_save_new_order)
|
8
|
+
allow(controller).to receive(:spree_current_user) { user }
|
9
|
+
allow(user).to receive(:has_spree_role?) { true }
|
10
|
+
spree_get :show, id: product.to_param
|
11
|
+
expect(response.status).to eq(200)
|
12
|
+
end
|
13
|
+
|
14
|
+
it 'cannot view non-active products' do
|
15
|
+
allow(controller).to receive(:before_save_new_order)
|
16
|
+
allow(controller).to receive(:spree_current_user) { user }
|
17
|
+
allow(user).to receive(:has_spree_role?) { false }
|
18
|
+
spree_get :show, id: product.to_param
|
19
|
+
expect(response.status).to eq(404)
|
20
|
+
end
|
21
|
+
end
|
@@ -0,0 +1,44 @@
|
|
1
|
+
RSpec.describe Spree::UserPasswordsController, type: :controller do
|
2
|
+
|
3
|
+
let(:token) { 'some_token' }
|
4
|
+
|
5
|
+
before { @request.env['devise.mapping'] = Devise.mappings[:spree_user] }
|
6
|
+
|
7
|
+
describe 'GET edit' do
|
8
|
+
context 'when the user token has not been specified' do
|
9
|
+
it 'redirects to the new session path' do
|
10
|
+
spree_get :edit
|
11
|
+
expect(response).to redirect_to(
|
12
|
+
'http://test.host/user/spree_user/sign_in'
|
13
|
+
)
|
14
|
+
end
|
15
|
+
|
16
|
+
it 'flashes an error' do
|
17
|
+
spree_get :edit
|
18
|
+
expect(flash[:alert]).to include(
|
19
|
+
"You can't access this page without coming from a password reset " +
|
20
|
+
'email'
|
21
|
+
)
|
22
|
+
end
|
23
|
+
end
|
24
|
+
|
25
|
+
context 'when the user token has been specified' do
|
26
|
+
it 'does something' do
|
27
|
+
spree_get :edit, reset_password_token: token
|
28
|
+
expect(response.code).to eq('200')
|
29
|
+
end
|
30
|
+
end
|
31
|
+
end
|
32
|
+
|
33
|
+
context '#update' do
|
34
|
+
context 'when updating password with blank password' do
|
35
|
+
it 'shows error flash message, sets spree_user with token and re-displays password edit form' do
|
36
|
+
spree_put :update, { spree_user: { password: '', password_confirmation: '', reset_password_token: token } }
|
37
|
+
expect(assigns(:spree_user).kind_of?(Spree::User)).to eq true
|
38
|
+
expect(assigns(:spree_user).reset_password_token).to eq token
|
39
|
+
expect(flash[:error]).to eq I18n.t(:cannot_be_blank, scope: [:devise, :user_passwords, :spree_user])
|
40
|
+
expect(response).to render_template :edit
|
41
|
+
end
|
42
|
+
end
|
43
|
+
end
|
44
|
+
end
|
@@ -0,0 +1,13 @@
|
|
1
|
+
RSpec.describe Spree::UserRegistrationsController, type: :controller do
|
2
|
+
|
3
|
+
before { @request.env['devise.mapping'] = Devise.mappings[:spree_user] }
|
4
|
+
|
5
|
+
context '#create' do
|
6
|
+
before { allow(controller).to receive(:after_sign_up_path_for).and_return(spree.root_path(thing: 7)) }
|
7
|
+
|
8
|
+
it 'redirects to after_sign_up_path_for' do
|
9
|
+
spree_post :create, { spree_user: { email: 'foobar@example.com', password: 'foobar123', password_confirmation: 'foobar123' } }
|
10
|
+
expect(response).to redirect_to spree.root_path(thing: 7)
|
11
|
+
end
|
12
|
+
end
|
13
|
+
end
|
@@ -0,0 +1,56 @@
|
|
1
|
+
RSpec.describe Spree::UserSessionsController, type: :controller do
|
2
|
+
|
3
|
+
let(:user) { create(:user) }
|
4
|
+
|
5
|
+
before { @request.env['devise.mapping'] = Devise.mappings[:spree_user] }
|
6
|
+
|
7
|
+
context "#create" do
|
8
|
+
context "using correct login information" do
|
9
|
+
it 'properly assigns orders user from guest_token' do
|
10
|
+
order1 = create(:order, guest_token: 'ABC', user_id: nil, created_by_id: nil)
|
11
|
+
order2 = create(:order, guest_token: 'ABC', user_id: 200)
|
12
|
+
request.cookie_jar.signed[:guest_token] = 'ABC'
|
13
|
+
spree_post :create, spree_user: { email: user.email, password: 'secret' }
|
14
|
+
|
15
|
+
expect(order1.reload.user_id).to eq user.id
|
16
|
+
expect(order1.reload.created_by_id).to eq user.id
|
17
|
+
expect(order2.reload.user_id).to eq 200
|
18
|
+
end
|
19
|
+
|
20
|
+
context "and html format is used" do
|
21
|
+
it "redirects to default after signing in" do
|
22
|
+
spree_post :create, spree_user: { email: user.email, password: 'secret' }
|
23
|
+
expect(response).to redirect_to spree.root_path
|
24
|
+
end
|
25
|
+
end
|
26
|
+
|
27
|
+
context "and js format is used" do
|
28
|
+
it "returns a json with ship and bill address" do
|
29
|
+
spree_post :create, spree_user: { email: user.email, password: 'secret' }, format: 'js'
|
30
|
+
parsed = ActiveSupport::JSON.decode(response.body)
|
31
|
+
expect(parsed).to have_key("user")
|
32
|
+
expect(parsed).to have_key("ship_address")
|
33
|
+
expect(parsed).to have_key("bill_address")
|
34
|
+
end
|
35
|
+
end
|
36
|
+
end
|
37
|
+
|
38
|
+
context "using incorrect login information" do
|
39
|
+
context "and html format is used" do
|
40
|
+
it "renders new template again with errors" do
|
41
|
+
spree_post :create, spree_user: { email: user.email, password: 'wrong' }
|
42
|
+
expect(response).to render_template('new')
|
43
|
+
expect(flash[:error]).to eq I18n.t(:'devise.failure.invalid')
|
44
|
+
end
|
45
|
+
end
|
46
|
+
|
47
|
+
context "and js format is used" do
|
48
|
+
it "returns a json with the error" do
|
49
|
+
spree_post :create, spree_user: { email: user.email, password: 'wrong' }, format: 'js'
|
50
|
+
parsed = ActiveSupport::JSON.decode(response.body)
|
51
|
+
expect(parsed).to have_key("error")
|
52
|
+
end
|
53
|
+
end
|
54
|
+
end
|
55
|
+
end
|
56
|
+
end
|
@@ -0,0 +1,38 @@
|
|
1
|
+
RSpec.describe Spree::UsersController, type: :controller do
|
2
|
+
|
3
|
+
let(:admin_user) { create(:user) }
|
4
|
+
let(:user) { create(:user) }
|
5
|
+
let(:role) { create(:role) }
|
6
|
+
|
7
|
+
before { allow(controller).to receive(:spree_current_user) { user } }
|
8
|
+
|
9
|
+
context '#load_object' do
|
10
|
+
it 'redirects to signup path if user is not found' do
|
11
|
+
allow(controller).to receive(:spree_current_user) { nil }
|
12
|
+
spree_put :update, { user: { email: 'foobar@example.com' } }
|
13
|
+
expect(response).to redirect_to spree.login_path
|
14
|
+
end
|
15
|
+
end
|
16
|
+
|
17
|
+
context '#create' do
|
18
|
+
it 'creates a new user' do
|
19
|
+
spree_post :create, { user: { email: 'foobar@example.com', password: 'foobar123', password_confirmation: 'foobar123' } }
|
20
|
+
expect(assigns[:user].new_record?).to be false
|
21
|
+
end
|
22
|
+
end
|
23
|
+
|
24
|
+
context '#update' do
|
25
|
+
context 'when updating own account' do
|
26
|
+
it 'performs update' do
|
27
|
+
spree_put :update, { user: { email: 'mynew@email-address.com' } }
|
28
|
+
expect(assigns[:user].email).to eq 'mynew@email-address.com'
|
29
|
+
expect(response).to redirect_to spree.account_url(only_path: true)
|
30
|
+
end
|
31
|
+
end
|
32
|
+
|
33
|
+
it 'does not update roles' do
|
34
|
+
spree_put :update, user: { spree_role_ids: [role.id] }
|
35
|
+
expect(assigns[:user].spree_roles).to_not include role
|
36
|
+
end
|
37
|
+
end
|
38
|
+
end
|
@@ -0,0 +1,58 @@
|
|
1
|
+
RSpec.feature 'Accounts', type: :feature do
|
2
|
+
|
3
|
+
context 'editing' do
|
4
|
+
scenario 'can edit an admin user' do
|
5
|
+
user = create(:admin_user, email: 'admin@person.com', password: 'password', password_confirmation: 'password')
|
6
|
+
visit spree.login_path
|
7
|
+
|
8
|
+
fill_in 'Email', with: user.email
|
9
|
+
fill_in 'Password', with: user.password
|
10
|
+
click_button 'Login'
|
11
|
+
|
12
|
+
click_link 'My Account'
|
13
|
+
expect(page).to have_text 'admin@person.com'
|
14
|
+
end
|
15
|
+
|
16
|
+
scenario 'can edit a new user' do
|
17
|
+
Spree::Auth::Config.set(signout_after_password_change: false)
|
18
|
+
visit spree.signup_path
|
19
|
+
|
20
|
+
fill_in 'Email', with: 'email@person.com'
|
21
|
+
fill_in 'Password', with: 'password'
|
22
|
+
fill_in 'Password Confirmation', with: 'password'
|
23
|
+
click_button 'Create'
|
24
|
+
|
25
|
+
click_link 'My Account'
|
26
|
+
expect(page).to have_text 'email@person.com'
|
27
|
+
click_link 'Edit'
|
28
|
+
|
29
|
+
fill_in 'Password', with: 'foobar'
|
30
|
+
fill_in 'Password Confirmation', with: 'foobar'
|
31
|
+
click_button 'Update'
|
32
|
+
|
33
|
+
expect(page).to have_text 'email@person.com'
|
34
|
+
expect(page).to have_text 'Account updated'
|
35
|
+
end
|
36
|
+
|
37
|
+
scenario 'can edit an existing user account' do
|
38
|
+
Spree::Auth::Config.set(signout_after_password_change: false)
|
39
|
+
user = create(:user, email: 'email@person.com', password: 'secret', password_confirmation: 'secret')
|
40
|
+
visit spree.login_path
|
41
|
+
|
42
|
+
fill_in 'Email', with: user.email
|
43
|
+
fill_in 'Password', with: user.password
|
44
|
+
click_button 'Login'
|
45
|
+
|
46
|
+
click_link 'My Account'
|
47
|
+
expect(page).to have_text 'email@person.com'
|
48
|
+
click_link 'Edit'
|
49
|
+
|
50
|
+
fill_in 'Password', with: 'foobar'
|
51
|
+
fill_in 'Password Confirmation', with: 'foobar'
|
52
|
+
click_button 'Update'
|
53
|
+
|
54
|
+
expect(page).to have_text 'email@person.com'
|
55
|
+
expect(page).to have_text 'Account updated'
|
56
|
+
end
|
57
|
+
end
|
58
|
+
end
|
@@ -0,0 +1,29 @@
|
|
1
|
+
RSpec.feature 'Admin orders', type: :feature do
|
2
|
+
|
3
|
+
background do
|
4
|
+
sign_in_as! create(:admin_user)
|
5
|
+
end
|
6
|
+
|
7
|
+
# Regression #203
|
8
|
+
scenario 'can list orders' do
|
9
|
+
expect { visit spree.admin_orders_path }.not_to raise_error
|
10
|
+
end
|
11
|
+
|
12
|
+
# Regression #203
|
13
|
+
scenario 'can new orders' do
|
14
|
+
FactoryGirl.create(:country)
|
15
|
+
expect { visit spree.new_admin_order_path }.not_to raise_error
|
16
|
+
end
|
17
|
+
|
18
|
+
# Regression #203
|
19
|
+
scenario 'can not edit orders' do
|
20
|
+
expect { visit spree.edit_admin_order_path('nodata') }.to raise_error(ActiveRecord::RecordNotFound)
|
21
|
+
end
|
22
|
+
|
23
|
+
# Regression #203
|
24
|
+
scenario 'can edit orders' do
|
25
|
+
create(:order, number: 'R123')
|
26
|
+
visit spree.edit_admin_order_path('R123')
|
27
|
+
expect(page).not_to have_text 'Authorization Failure'
|
28
|
+
end
|
29
|
+
end
|
@@ -0,0 +1,24 @@
|
|
1
|
+
RSpec.feature 'Admin - Reset Password', type: :feature do
|
2
|
+
|
3
|
+
let!(:store) { create(:store) }
|
4
|
+
|
5
|
+
background do
|
6
|
+
ActionMailer::Base.default_url_options[:host] = 'http://example.com'
|
7
|
+
end
|
8
|
+
|
9
|
+
scenario 'allows a user to supply an email for the password reset' do
|
10
|
+
user = create(:user, email: 'foobar@example.com', password: 'secret', password_confirmation: 'secret')
|
11
|
+
visit spree.admin_login_path
|
12
|
+
click_link 'Forgot Password?'
|
13
|
+
fill_in 'Email', with: 'foobar@example.com'
|
14
|
+
click_button 'Reset my password'
|
15
|
+
expect(page).to have_text 'You will receive an email with instructions'
|
16
|
+
end
|
17
|
+
|
18
|
+
scenario 'shows errors if no email is supplied' do
|
19
|
+
visit spree.admin_login_path
|
20
|
+
click_link 'Forgot Password?'
|
21
|
+
click_button 'Reset my password'
|
22
|
+
expect(page).to have_text "Email can't be blank"
|
23
|
+
end
|
24
|
+
end
|
@@ -0,0 +1,16 @@
|
|
1
|
+
RSpec.feature 'Payment methods', type: :feature do
|
2
|
+
|
3
|
+
background do
|
4
|
+
sign_in_as! create(:admin_user)
|
5
|
+
visit spree.admin_path
|
6
|
+
click_link 'Settings'
|
7
|
+
end
|
8
|
+
|
9
|
+
# Regression test for #5
|
10
|
+
scenario 'can dismiss the banner' do
|
11
|
+
allow_any_instance_of(Spree::User).to receive(:dismissed_banner?) { false }
|
12
|
+
allow(Spree::PaymentMethod).to receive(:production).and_return(payment_methods = [double])
|
13
|
+
allow(payment_methods).to receive(:where).and_return([])
|
14
|
+
click_link 'Payment Methods'
|
15
|
+
end
|
16
|
+
end
|
@@ -0,0 +1,9 @@
|
|
1
|
+
RSpec.feature 'Admin products', type: :feature do
|
2
|
+
|
3
|
+
context 'as anonymous user' do
|
4
|
+
# Regression test for #1250
|
5
|
+
scenario 'redirects to login page when attempting to access product listing' do
|
6
|
+
expect { visit spree.admin_products_path }.not_to raise_error
|
7
|
+
end
|
8
|
+
end
|
9
|
+
end
|
@@ -0,0 +1,44 @@
|
|
1
|
+
RSpec.feature 'Admin - Sign In', type: :feature do
|
2
|
+
|
3
|
+
background do
|
4
|
+
@user = create(:user, email: 'email@person.com')
|
5
|
+
visit spree.admin_login_path
|
6
|
+
end
|
7
|
+
|
8
|
+
scenario 'asks user to sign in' do
|
9
|
+
visit spree.admin_path
|
10
|
+
expect(page).not_to have_text 'Authorization Failure'
|
11
|
+
end
|
12
|
+
|
13
|
+
scenario 'lets a user sign in successfully' do
|
14
|
+
fill_in 'Email', with: @user.email
|
15
|
+
fill_in 'Password', with: 'secret'
|
16
|
+
click_button 'Login'
|
17
|
+
|
18
|
+
expect(page).to have_text 'Logged in successfully'
|
19
|
+
expect(page).not_to have_text 'Login'
|
20
|
+
expect(page).to have_text 'Logout'
|
21
|
+
expect(current_path).to eq '/'
|
22
|
+
end
|
23
|
+
|
24
|
+
scenario 'shows validation erros' do
|
25
|
+
fill_in 'Email', with: @user.email
|
26
|
+
fill_in 'Password', with: 'wrong_password'
|
27
|
+
click_button 'Login'
|
28
|
+
|
29
|
+
expect(page).to have_text 'Invalid email or password'
|
30
|
+
expect(page).to have_text 'Login'
|
31
|
+
end
|
32
|
+
|
33
|
+
scenario 'allows a user to access a restricted page after logging in' do
|
34
|
+
user = create(:admin_user, email: 'admin@person.com')
|
35
|
+
visit spree.admin_path
|
36
|
+
|
37
|
+
fill_in 'Email', with: user.email
|
38
|
+
fill_in 'Password', with: 'secret'
|
39
|
+
click_button 'Login'
|
40
|
+
|
41
|
+
expect(page).to have_text 'Logged in as: admin@person.com'
|
42
|
+
expect(current_path).to eq '/admin/orders'
|
43
|
+
end
|
44
|
+
end
|
@@ -0,0 +1,22 @@
|
|
1
|
+
RSpec.feature 'Admin - Sign Out', type: :feature do
|
2
|
+
|
3
|
+
given!(:user) do
|
4
|
+
create :user, email: 'email@person.com'
|
5
|
+
end
|
6
|
+
|
7
|
+
background do
|
8
|
+
visit spree.admin_login_path
|
9
|
+
fill_in 'Email', with: user.email
|
10
|
+
fill_in 'Password', with: 'secret'
|
11
|
+
# Regression test for #1257
|
12
|
+
check 'Remember me'
|
13
|
+
click_button 'Login'
|
14
|
+
end
|
15
|
+
|
16
|
+
scenario 'allows a signed in user to logout' do
|
17
|
+
click_link 'Logout'
|
18
|
+
visit spree.admin_login_path
|
19
|
+
expect(page).to have_text 'Login'
|
20
|
+
expect(page).not_to have_text 'Logout'
|
21
|
+
end
|
22
|
+
end
|
@@ -0,0 +1,46 @@
|
|
1
|
+
RSpec.feature 'Admin Permissions', type: :feature do
|
2
|
+
|
3
|
+
context 'orders' do
|
4
|
+
background do
|
5
|
+
user = create(:admin_user, email: 'admin@person.com', password: 'password', password_confirmation: 'password')
|
6
|
+
Spree::Ability.register_ability(AbilityDecorator)
|
7
|
+
visit spree.login_path
|
8
|
+
|
9
|
+
fill_in 'Email', with: user.email
|
10
|
+
fill_in 'Password', with: user.password
|
11
|
+
click_button 'Login'
|
12
|
+
end
|
13
|
+
|
14
|
+
context 'admin is restricted from accessing orders' do
|
15
|
+
scenario 'can not list orders' do
|
16
|
+
visit spree.admin_orders_path
|
17
|
+
expect(page).to have_text 'Authorization Failure'
|
18
|
+
end
|
19
|
+
|
20
|
+
scenario 'can not edit orders' do
|
21
|
+
create(:order, number: 'R123')
|
22
|
+
visit spree.edit_admin_order_path('R123')
|
23
|
+
expect(page).to have_text 'Authorization Failure'
|
24
|
+
end
|
25
|
+
|
26
|
+
scenario 'can not new orders' do
|
27
|
+
visit spree.new_admin_order_path
|
28
|
+
expect(page).to have_text 'Authorization Failure'
|
29
|
+
end
|
30
|
+
end
|
31
|
+
|
32
|
+
context "admin is restricted from accessing an order's customer details" do
|
33
|
+
given(:order) { create(:order_with_totals) }
|
34
|
+
|
35
|
+
scenario 'can not list customer details for an order' do
|
36
|
+
visit spree.admin_order_customer_path(order)
|
37
|
+
expect(page).to have_text 'Authorization Failure'
|
38
|
+
end
|
39
|
+
|
40
|
+
scenario "can not edit an order's customer details" do
|
41
|
+
visit spree.edit_admin_order_customer_path(order)
|
42
|
+
expect(page).to have_text 'Authorization Failure'
|
43
|
+
end
|
44
|
+
end
|
45
|
+
end
|
46
|
+
end
|