trek 2.5.0 → 2.6.0

data/lib/generators/trek/templates/public_accounts/mailers/account_mailer.rb.tt

@@ -0,0 +1,85 @@
+class <%= class_name %>Mailer < ApplicationMailer
+  include ActionView::Helpers::DateHelper
+<% if code? -%>
+
+  # The code to sign in with: to an email that may have no account yet.
+  def sign_in_code(email, code)
+    @code = code
+    @validity = distance_of_time_in_words(0, <%= class_name %>::SignInCode.validity)
+
+    mail to: email
+  end
+
+  # The code confirming a new email address for an account, sent to that address.
+  def email_change_code(email, code)
+    @code = code
+    @validity = distance_of_time_in_words(0, <%= class_name %>::SignInCode.validity)
+
+    mail to: email
+  end
+<% else -%>
+
+  # The link confirming the email given on signing up. Its token is made here, in the job sending
+  # the email, rather than in the request.
+  def email_confirmation(<%= file_name %>)
+    @<%= file_name %> = <%= file_name %>
+    @url = link_to_confirm(<%= file_name %>.generate_token_for(:email_confirmation))
+    @validity = distance_of_time_in_words(0, <%= class_name %>.token_definitions[:email_confirmation].expires_in)
+
+    mail to: <%= file_name %>.email
+  end
+
+  # The link to choose a new password; nothing is sent to an email without an account.
+  def password_reset(<%= file_name %>)
+    @<%= file_name %> = <%= file_name %>
+    @url = link_to_reset(<%= file_name %>.password_reset_token)
+    @validity = distance_of_time_in_words(0, <%= class_name %>.token_definitions[:password_reset].expires_in)
+
+    mail to: <%= file_name %>.email
+  end
+
+  # The link confirming a new email (unconfirmed_email), sent to that address.
+  def email_change(<%= file_name %>)
+    @<%= file_name %> = <%= file_name %>
+    @url = link_to_change_email(<%= file_name %>.generate_token_for(:email_change))
+    @validity = distance_of_time_in_words(0, <%= class_name %>.token_definitions[:email_change].expires_in)
+
+    mail to: <%= file_name %>.unconfirmed_email
+  end
+
+  # Signing in is locked after failed tries in a row (Trek::Users::SignInLockout): the
+  # <%= human_name.downcase %> waits, resets the password, or learns someone may be guessing it.
+  def sign_in_locked(<%= file_name %>)
+    @<%= file_name %> = <%= file_name %>
+<% if web? -%>
+    @reset_url = new_<%= route_prefix %>_password_reset_url
+<% end -%>
+
+    mail to: <%= file_name %>.email
+  end
+
+  private
+
+<% if model_only? -%>
+  # The app's own sign-in handles these links: a page of the site, or the mobile app opening them (iOS
+  # universal links, Android app links). They point at the app's domain, or at <%= accounts_path.upcase %>_APP_LINKS_URL.
+<% elsif api? -%>
+  # The mobile app opens these links (iOS universal links, Android app links) and sends their token
+  # to the API. They point at the app's domain, or at <%= accounts_path.upcase %>_APP_LINKS_URL.
+<% end -%>
+<% unless web? -%>
+  def link_to_confirm(token) = app_link("account/confirm", token)
+  def link_to_reset(token) = app_link("password-reset", token)
+  def link_to_change_email(token) = app_link("account/email", token)
+
+  def app_link(path, token)
+    base = ENV.fetch("<%= accounts_path.upcase %>_APP_LINKS_URL") { "https://#{default_url_options.fetch(:host)}<%= "/#{options[:path]}" if options[:path].present? %>" }
+    "#{base}/#{path}?#{{ token: }.to_query}"
+  end
+<% else -%>
+  def link_to_confirm(token) = <%= route_prefix %>_email_confirmation_url(token:)
+  def link_to_reset(token) = edit_<%= route_prefix %>_password_reset_url(token:)
+  def link_to_change_email(token) = <%= route_prefix %>_email_change_url(token:)
+<% end -%>
+<% end -%>
+end

data/lib/generators/trek/templates/public_accounts/migrations/create_accounts.rb.tt

@@ -0,0 +1,46 @@
+class TrekCreate<%= class_name.pluralize %> < <%= migration_class_name %>
+  def change
+    create_table :<%= table_name %> do |t|
+      t.string :email, null: false, index: { unique: true }
+      t.string :name
+<% if password? -%>
+      t.string :password_digest, null: false
+      t.integer :failed_sign_in_count, null: false, default: 0
+      t.datetime :sign_in_locked_until
+      # When the email was confirmed by its link; nil until then
+      t.datetime :confirmed_at
+      # A new email, until its link confirms it
+      t.string :unconfirmed_email
+<% end -%>
+      # The last request, at most every 5 minutes, e.g. to delete the accounts nobody uses
+      t.datetime :last_activity_at, index: true
+
+      t.timestamps
+    end
+
+    create_table :<%= file_name %>_sessions do |t|
+      t.belongs_to :<%= file_name %>, null: false, foreign_key: true
+      t.string :user_agent
+      t.string :ip_address
+      # The host name of the IP address (Trek::ReverseDns)
+      t.string :ip_hostname
+      t.datetime :last_activity_at, null: false
+
+      t.timestamps
+    end
+<% if code? -%>
+
+    create_table :<%= file_name %>_sign_in_codes do |t|
+      t.string :email, null: false
+      t.string :purpose, null: false
+      t.belongs_to :<%= file_name %>, foreign_key: true
+      t.string :code_digest, null: false
+      t.integer :attempts, null: false, default: 0
+      t.datetime :expires_at, null: false, index: true
+
+      t.datetime :created_at, null: false
+    end
+    add_index :<%= file_name %>_sign_in_codes, %i[email purpose]
+<% end -%>
+  end
+end

data/lib/generators/trek/templates/public_accounts/models/account/session.rb.tt

@@ -0,0 +1,47 @@
+<% if api? -%>
+# A device of the mobile app signed in as the <%= human_name.downcase %>, found through the JWT it sends
+# (Authorization: Bearer). The token only names the session: signing out deletes the session, and the
+# token stops working with it.
+<% elsif model_only? -%>
+# A signed-in <%= human_name.downcase %>: the app's own sign-in creates the session, finds it on each request
+# (Current.<%= file_name %>_session) and deletes it on signing out.
+<% else -%>
+# A browser signed in as the <%= human_name.downcase %>, found through a signed <%= file_name %>_session_id cookie.
+<% end -%>
+class <%= class_name %>::Session < ApplicationRecord
+  # Expires after idle_timeout without a request, and lifetime after signing in; longer than the admin's.
+  include Trek::Users::SessionLifetime
+  self.idle_timeout = 30.days
+  self.lifetime = 1.year
+
+  # Changing the password or deleting the account needs a sign-in this recent.
+  RECENT = 15.minutes
+
+  belongs_to :<%= file_name %>
+
+  def recent?
+    created_at > RECENT.ago
+  end
+<% if api? -%>
+
+  # Signed with a key of its own, derived from the app's secret_key_base.
+  TOKEN_ALGORITHM = "HS256".freeze
+
+  def self.token_key
+    Rails.application.key_generator.generate_key("<%= accounts_path %>/session_tokens")
+  end
+
+  # The session the token names, unless the token is forged or past the session's lifetime.
+  def self.from_token(token)
+    payload, = JWT.decode(token, token_key, true, algorithm: TOKEN_ALGORITHM)
+    find_by(id: payload["sub"])
+  rescue JWT::DecodeError
+    nil
+  end
+
+  # The JWT the app keeps and sends with each request; it expires with the session's lifetime.
+  def token
+    JWT.encode({ sub: id, iat: created_at.to_i, exp: (created_at + lifetime).to_i }, self.class.token_key, TOKEN_ALGORITHM)
+  end
+<% end -%>
+end

data/lib/generators/trek/templates/public_accounts/models/account/sign_in_code.rb.tt

@@ -0,0 +1,8 @@
+# A code emailed to sign in, or to confirm a new email address (Trek::Users::SignInCode): kept by
+# email, as one is sent whether or not the email has an account.
+class <%= class_name %>::SignInCode < ApplicationRecord
+  include Trek::Users::SignInCode
+
+  # The account changing its email to this one; nil when signing in.
+  belongs_to :<%= file_name %>, optional: true
+end

data/lib/generators/trek/templates/public_accounts/models/account.rb.tt

@@ -0,0 +1,73 @@
+<% if code? -%>
+# A <%= human_name.downcase %>'s account, apart from the admin's User: it signs in with a code emailed to it
+# (<%= class_name %>::SignInCode), which creates the account the first time.
+<% else -%>
+# A <%= human_name.downcase %>'s account, apart from the admin's User: it signs up and in with a password, its
+# email confirmed by a link (confirmed_at), and a forgotten password reset by one.
+<% end -%>
+class <%= class_name %> < ApplicationRecord
+<% if password? -%>
+  # Required, at most 72 bytes; password_reset_token (15 minutes, used up by a new password).
+  has_secure_password
+  # The password rules (length, complexity, common passwords…); set password_min_length to change them.
+  include Trek::Users::PasswordPolicy
+  # Locks signing in for a while after 5 failures in a row, longer on each further failure.
+  include Trek::Users::SignInLockout
+  self.sign_in_lockout_mailer = "<%= class_name %>Mailer"
+
+  # The link confirming the email, used up once it is confirmed or changed.
+  generates_token_for :email_confirmation, expires_in: 1.day do
+    [email, confirmed_at]
+  end
+
+  # The link confirming a new email (unconfirmed_email), used up once it is changed.
+  generates_token_for :email_change, expires_in: 1.hour do
+    [email, unconfirmed_email]
+  end
+
+<% end -%>
+  has_many :sessions, dependent: :delete_all
+<% if code? -%>
+  has_many :sign_in_codes, dependent: :delete_all
+<% end -%>
+
+  # Also applies to lookups (find_by(email:)), so signing in works whatever the case typed.
+  normalizes :email<% if password? %>, :unconfirmed_email<% end %>, with: ->(email) { email.strip.downcase }
+
+  validates :email, presence: true, uniqueness: { case_sensitive: false }, email: { mode: :strict }
+<% if password? -%>
+  validates :unconfirmed_email, email: { mode: :strict }, allow_nil: true
+<% end -%>
+
+  # The accounts nobody used since `time`, e.g. to delete them: they can only be <%= human_name.pluralize.downcase %>.
+  scope :inactive_since, ->(time) { where(last_activity_at: ...time).or(where(last_activity_at: nil, created_at: ...time)) }
+<% if code? -%>
+
+  # The account of `email`, created if it has none: the code it was sent proved the email is theirs.
+  def self.for_verified_email!(email)
+    find_by(email:) || create!(email:)
+  rescue ActiveRecord::RecordNotUnique
+    # Created in parallel, e.g. a double submit
+    find_by!(email:)
+  end
+<% else -%>
+
+  def confirmed?
+    confirmed_at.present?
+  end
+
+  def confirm_email!
+    update!(confirmed_at: Time.current)
+  end
+
+  # The new email once its link is followed, confirmed by it. False when another account took it
+  # in the meantime.
+  def change_email!
+    update(email: unconfirmed_email, unconfirmed_email: nil, confirmed_at: Time.current)
+  end
+<% end -%>
+
+  def to_s
+    name.presence || email
+  end
+end

data/lib/generators/trek/templates/public_accounts/spec/api/accounts_spec.rb.tt

@@ -0,0 +1,90 @@
+require "rails_helper"
+
+RSpec.describe "<%= human_name.pluralize %>' accounts through the API", type: :request do
+  include ActiveSupport::Testing::TimeHelpers
+
+<% if code? -%>
+  let(:<%= file_name %>) { <%= class_name %>.create!(email: "ada@example.com") }
+<% else -%>
+  let(:<%= file_name %>) { <%= class_name %>.create!(email: "ada@example.com", password: "correct horse battery staple") }
+<% end -%>
+  let(:token) { sign_in(<%= file_name %>) }
+  let(:headers) { { "Authorization" => "Bearer #{token}" } }
+
+<% if code? -%>
+  def emailed_code
+    ActionMailer::Base.deliveries.last.text_part.body.to_s[/\b\d{6}\b/]
+  end
+
+  def sign_in(<%= file_name %>)
+    perform_enqueued_jobs { post <%= route_prefix %>_sign_in_path, params: { email: <%= file_name %>.email }, as: :json }
+    post <%= route_prefix %>_sign_in_code_path, params: { email: <%= file_name %>.email, otp: emailed_code }, as: :json
+    response.parsed_body["token"]
+  end
+
+  def change_email_to(email)
+    perform_enqueued_jobs { post <%= route_prefix %>_email_change_path, params: { email: }, headers:, as: :json }
+    patch <%= route_prefix %>_email_change_path, params: { email:, otp: emailed_code }, headers:, as: :json
+  end
+<% else -%>
+  def emailed_token
+    CGI.unescape(ActionMailer::Base.deliveries.last.text_part.body.to_s[/token=([^\s&]+)/, 1].to_s)
+  end
+
+  def sign_in(<%= file_name %>)
+    post <%= route_prefix %>_sign_in_path, params: { email: <%= file_name %>.email, password: "correct horse battery staple" }, as: :json
+    response.parsed_body["token"]
+  end
+
+  def change_email_to(email)
+    perform_enqueued_jobs { post <%= route_prefix %>_email_change_path, params: { email: }, headers:, as: :json }
+    patch <%= route_prefix %>_email_change_path, params: { token: emailed_token }, as: :json
+  end
+<% end -%>
+
+  it "changes the name" do
+    patch <%= route_prefix %>_account_path, params: { name: "Ada Lovelace" }, headers:, as: :json
+
+    expect(response.parsed_body["name"]).to eq("Ada Lovelace")
+  end
+
+  it "changes the email once the new one is confirmed", :aggregate_failures do
+    change_email_to("ada@lovelace.org")
+
+    expect(ActionMailer::Base.deliveries.last.to).to eq(["ada@lovelace.org"])
+    expect(<%= file_name %>.reload.email).to eq("ada@lovelace.org")
+  end
+
+  it "lists the signed-in devices, and signs the others out", :aggregate_failures do
+    other = <%= file_name %>.sessions.create!
+    get <%= route_prefix %>_active_sessions_path, headers: headers
+
+    expect(response.parsed_body.pluck("current")).to contain_exactly(true, false)
+    delete others_<%= route_prefix %>_active_sessions_path, headers: headers
+    expect(<%= class_name %>::Session.exists?(other.id)).to be(false)
+  end
+
+  it "deletes the account after a recent sign-in", :aggregate_failures do
+    headers
+
+    expect { delete <%= route_prefix %>_account_path, headers: }.to change(<%= class_name %>, :count).by(-1)
+    expect(response).to have_http_status(:no_content)
+  end
+
+  it "asks to sign in again before deleting the account", :aggregate_failures do
+    headers
+    travel <%= class_name %>::Session::RECENT + 1.minute
+
+    expect { delete <%= route_prefix %>_account_path, headers: }.not_to change(<%= class_name %>, :count)
+    expect(response.parsed_body["error"]).to eq("recent_sign_in_needed")
+  end
+<% if password? -%>
+
+  it "changes the password after a recent sign-in", :aggregate_failures do
+    patch <%= route_prefix %>_password_path, params: { password: "a brand new password 1!" }, headers:, as: :json
+
+    expect(response).to have_http_status(:no_content)
+    expect(<%= file_name %>.reload.authenticate("a brand new password 1!")).to be_truthy
+  end
+<% end -%>
+end

data/lib/generators/trek/templates/public_accounts/spec/api/sign_ins_spec.rb.tt

@@ -0,0 +1,158 @@
+require "rails_helper"
+
+RSpec.describe "<%= human_name.pluralize %>' sign-ins through the API", type: :request do
+  include ActiveSupport::Testing::TimeHelpers
+
+<% if code? -%>
+  def emailed_code
+    ActionMailer::Base.deliveries.last.text_part.body.to_s[/\b\d{6}\b/]
+  end
+
+  # The response's status
+  def ask_for_code(email)
+    perform_enqueued_jobs { post <%= route_prefix %>_sign_in_path, params: { email: }, as: :json }
+    response.status
+  end
+
+  def sign_in(email)
+    ask_for_code(email)
+    post <%= route_prefix %>_sign_in_code_path, params: { email:, otp: emailed_code }, as: :json
+    response.parsed_body["token"]
+  end
+
+  it "emails a code to an email without an account, with the same answer as for an account", :aggregate_failures do
+    <%= class_name %>.create!(email: "ada@example.com")
+
+    expect(ask_for_code("grace@example.com")).to eq(ask_for_code("ada@example.com")).and eq(202)
+    expect(ActionMailer::Base.deliveries.flat_map(&:to)).to eq(%w[grace@example.com ada@example.com])
+  end
+
+  it "refuses an invalid email", :aggregate_failures do
+    post <%= route_prefix %>_sign_in_path, params: { email: "not an email" }, as: :json
+
+    expect(response).to have_http_status(:unprocessable_content)
+    expect(response.parsed_body["error"]).to eq("invalid_email")
+  end
+
+  it "creates the account and answers with a token", :aggregate_failures do
+    token = nil
+
+    expect { token = sign_in("grace@example.com") }.to change(<%= class_name %>, :count).by(1)
+    expect(response).to have_http_status(:created)
+    expect(token).to be_present
+  end
+
+  it "refuses a wrong code", :aggregate_failures do
+    ask_for_code("ada@example.com")
+    post <%= route_prefix %>_sign_in_code_path, params: { email: "ada@example.com", otp: "000000" }, as: :json
+
+    expect(response).to have_http_status(:unauthorized)
+    expect(response.parsed_body["error"]).to eq("invalid_code")
+  end
+<% else -%>
+  let(:password) { "correct horse battery staple" }
+  let!(:<%= file_name %>) { <%= class_name %>.create!(email: "ada@example.com", password:) }
+
+  def emailed_token
+    CGI.unescape(ActionMailer::Base.deliveries.last.text_part.body.to_s[/token=([^\s&]+)/, 1].to_s)
+  end
+
+  def sign_in(email, password: self.password)
+    post <%= route_prefix %>_sign_in_path, params: { email:, password: }, as: :json
+    response.parsed_body["token"]
+  end
+
+  it "signs up and in, answering with a token, and emails a link to confirm the email", :aggregate_failures do
+    perform_enqueued_jobs { post <%= route_prefix %>_sign_up_path, params: { email: "grace@example.com", password: }, as: :json }
+
+    expect(response).to have_http_status(:created)
+    expect(response.parsed_body["token"]).to be_present
+    expect(ActionMailer::Base.deliveries.last.to).to eq(["grace@example.com"])
+  end
+
+  it "confirms the email with the token of the emailed link" do
+    perform_enqueued_jobs { post <%= route_prefix %>_sign_up_path, params: { email: "grace@example.com", password: }, as: :json }
+
+    patch <%= route_prefix %>_email_confirmation_path, params: { token: emailed_token }, as: :json
+
+    expect(<%= class_name %>.find_by(email: "grace@example.com")).to be_confirmed
+  end
+
+  it "answers with a token" do
+    expect(sign_in(<%= file_name %>.email)).to be_present
+  end
+
+  it "refuses a wrong password", :aggregate_failures do
+    sign_in(<%= file_name %>.email, password: "wrong horse battery staple")
+
+    expect(response).to have_http_status(:unauthorized)
+    expect(response.parsed_body["error"]).to eq("invalid_password")
+  end
+
+  it "resets the password with the token of the emailed link", :aggregate_failures do
+    perform_enqueued_jobs { post <%= route_prefix %>_password_reset_path, params: { email: <%= file_name %>.email }, as: :json }
+    expect(response).to have_http_status(:accepted)
+
+    patch <%= route_prefix %>_password_reset_path, params: { token: emailed_token, password: "a brand new password 1!" }, as: :json
+    expect(<%= file_name %>.reload.authenticate("a brand new password 1!")).to be_truthy
+  end
+
+  it "answers a password reset the same for an unknown email, and sends nothing", :aggregate_failures do
+    perform_enqueued_jobs { post <%= route_prefix %>_password_reset_path, params: { email: "nobody@example.com" }, as: :json }
+
+    expect(response).to have_http_status(:accepted)
+    expect(ActionMailer::Base.deliveries).to be_empty
+  end
+<% end -%>
+
+<% if audit_log? -%>
+  it "records the sign-in in the audit log" do
+    sign_in("ada@example.com")
+
+    expect(AuditLog.where(action: "<%= controllers_path %>/sessions#create", actor: <%= class_name %>.last)).to exist
+  end
+
+<% end -%>
+  it "uses the token for the next requests" do
+    token = sign_in("ada@example.com")
+
+    get <%= route_prefix %>_account_path, headers: { "Authorization" => "Bearer #{token}" }
+
+    expect(response.parsed_body["email"]).to eq("ada@example.com")
+  end
+
+  it "refuses a request without a token, or with a forged one", :aggregate_failures do
+    get <%= route_prefix %>_account_path
+    expect(response).to have_http_status(:unauthorized)
+
+    token = sign_in("ada@example.com")
+    get <%= route_prefix %>_account_path, headers: { "Authorization" => "Bearer #{token.chop}x" }
+    expect(response).to have_http_status(:unauthorized)
+  end
+
+  it "ends the token's session when signing out" do
+    token = sign_in("ada@example.com")
+
+    delete <%= route_prefix %>_session_path, headers: { "Authorization" => "Bearer #{token}" }
+    get <%= route_prefix %>_account_path, headers: { "Authorization" => "Bearer #{token}" }
+
+    expect(response).to have_http_status(:unauthorized)
+  end
+
+  it "refuses the token after the session's idle timeout" do
+    token = sign_in("ada@example.com")
+
+    travel <%= class_name %>::Session.idle_timeout + 1.minute
+    get <%= route_prefix %>_account_path, headers: { "Authorization" => "Bearer #{token}" }
+
+    expect(response).to have_http_status(:unauthorized)
+  end
+
+  it "refuses a token signed with another key" do
+    forged = JWT.encode({ sub: <%= class_name %>::Session.maximum(:id).to_i + 1 }, "wrong key", "HS256")
+
+    get <%= route_prefix %>_account_path, headers: { "Authorization" => "Bearer #{forged}" }
+
+    expect(response).to have_http_status(:unauthorized)
+  end
+end

data/lib/generators/trek/templates/public_accounts/spec/models/account/sign_in_code_spec.rb.tt

@@ -0,0 +1,56 @@
+require "rails_helper"
+
+RSpec.describe <%= class_name %>::SignInCode, type: :model do
+  include ActiveSupport::Testing::TimeHelpers
+
+  it "keeps a digest of the code, not the code", :aggregate_failures do
+    sign_in_code = described_class.issue("ada@example.com")
+
+    expect(sign_in_code.code).to match(/\A\d{6}\z/)
+    expect(described_class.find(sign_in_code.id).code_digest).not_to include(sign_in_code.code)
+  end
+
+  it "signs in once with the right code", :aggregate_failures do
+    code = described_class.issue("ada@example.com").code
+
+    expect(described_class.redeem("Ada@example.com", code)).to be_present
+    expect(described_class.redeem("ada@example.com", code)).to be_nil
+  end
+
+  it "accepts the code with spaces" do
+    code = described_class.issue("ada@example.com").code
+
+    expect(described_class.redeem("ada@example.com", "#{code[0, 3]} #{code[3..]}")).to be_present
+  end
+
+  it "replaces the email's earlier code" do
+    first = described_class.issue("ada@example.com").code
+    described_class.issue("ada@example.com")
+
+    expect(described_class.redeem("ada@example.com", first)).to be_nil
+  end
+
+  it "stops working after its validity" do
+    code = described_class.issue("ada@example.com").code
+
+    travel described_class.validity + 1.second do
+      expect(described_class.redeem("ada@example.com", code)).to be_nil
+    end
+  end
+
+  it "stops working after too many wrong tries, even with the right code" do
+    code = described_class.issue("ada@example.com").code
+    wrong = code.succ.rjust(6, "0")[-6..]
+    described_class.max_attempts.times { described_class.redeem("ada@example.com", wrong) }
+
+    expect(described_class.redeem("ada@example.com", code)).to be_nil
+  end
+
+  it "doesn't sign in with a code confirming a new email", :aggregate_failures do
+    <%= file_name %> = <%= class_name %>.create!(email: "ada@example.com")
+    code = described_class.issue("new@example.com", purpose: "email_change", <%= file_name %>:).code
+
+    expect(described_class.redeem("new@example.com", code)).to be_nil
+    expect(described_class.redeem("new@example.com", code, purpose: "email_change", <%= file_name %>:)).to be_present
+  end
+end

data/lib/generators/trek/templates/public_accounts/spec/models/account_spec.rb.tt

@@ -0,0 +1,109 @@
+require "rails_helper"
+
+RSpec.describe <%= class_name %>, type: :model do
+  include ActiveSupport::Testing::TimeHelpers
+
+<% if password? -%>
+  let(:password) { "correct horse battery staple" }
+
+<% end -%>
+  def create_<%= file_name %>(email, **attributes)
+    described_class.create!(email:<% if password? %>, password:<% end %>, **attributes)
+  end
+
+  it "keeps emails in lower case, without spaces" do
+    expect(create_<%= file_name %>(" Ada@Example.com ").email).to eq("ada@example.com")
+  end
+
+  it "refuses an email another account has, whatever its case" do
+    create_<%= file_name %>("ada@example.com")
+
+    expect(described_class.new(email: "ADA@example.com")).not_to be_valid
+  end
+<% if code? -%>
+
+  it "creates the account of a verified email once" do
+    first = described_class.for_verified_email!("ada@example.com")
+
+    expect(described_class.for_verified_email!("Ada@example.com")).to eq(first)
+  end
+<% end -%>
+
+  it "finds the accounts nobody used since a date", :aggregate_failures do
+    used = create_<%= file_name %>("used@example.com", last_activity_at: 1.day.ago)
+    idle = create_<%= file_name %>("idle@example.com", last_activity_at: 2.years.ago)
+    never = travel_to(2.years.ago) { create_<%= file_name %>("never@example.com") }
+
+    expect(described_class.inactive_since(1.year.ago)).to contain_exactly(idle, never)
+    expect(described_class.inactive_since(1.year.ago)).not_to include(used)
+  end
+
+  it "deletes its sessions with it" do
+    <%= file_name %> = create_<%= file_name %>("ada@example.com")
+    <%= file_name %>.sessions.create!
+
+    expect { <%= file_name %>.destroy }.to change(<%= class_name %>::Session, :count).by(-1)
+  end
+
+  it "loses its expired sessions to the daily purge" do
+    <%= file_name %> = create_<%= file_name %>("ada@example.com")
+    <%= file_name %>.sessions.create!(created_at: 2.years.ago, last_activity_at: 2.years.ago)
+    current = <%= file_name %>.sessions.create!
+
+    Trek::PurgeExpiredSessionsJob.perform_now("<%= class_name %>::Session")
+
+    expect(<%= file_name %>.sessions.reload).to contain_exactly(current)
+  end
+<% if password? -%>
+
+  describe "password" do
+    it "is required" do
+      expect(described_class.new(email: "ada@example.com")).not_to be_valid
+    end
+
+    it "follows the password rules" do
+      expect(described_class.new(email: "ada@example.com", password: "short")).not_to be_valid
+    end
+  end
+
+  describe "email confirmation" do
+    let(:<%= file_name %>) { create_<%= file_name %>("ada@example.com") }
+
+    it "is pending after signing up" do
+      expect(<%= file_name %>).not_to be_confirmed
+    end
+
+    it "finds the account by its link, once", :aggregate_failures do
+      token = <%= file_name %>.generate_token_for(:email_confirmation)
+
+      expect(described_class.find_by_token_for(:email_confirmation, token)).to eq(<%= file_name %>)
+      <%= file_name %>.confirm_email!
+      expect(described_class.find_by_token_for(:email_confirmation, token)).to be_nil
+    end
+  end
+
+  describe "email change" do
+    let(:<%= file_name %>) { create_<%= file_name %>("ada@example.com", unconfirmed_email: "ada@lovelace.org") }
+
+    it "takes the new email, confirmed", :aggregate_failures do
+      <%= file_name %>.change_email!
+
+      expect(<%= file_name %>.reload.email).to eq("ada@lovelace.org")
+      expect(<%= file_name %>).to be_confirmed
+    end
+
+    it "keeps the email when another account has the new one" do
+      create_<%= file_name %>("ada@lovelace.org")
+
+      expect(<%= file_name %>.change_email!).to be(false)
+    end
+
+    it "uses its link up once the email changed" do
+      token = <%= file_name %>.generate_token_for(:email_change)
+      <%= file_name %>.change_email!
+
+      expect(described_class.find_by_token_for(:email_change, token)).to be_nil
+    end
+  end
+<% end -%>
+end