trusty-cms 7.1.3 → 8.0

data/spec/controllers/admin/changes_controller_spec.rb

@@ -0,0 +1,72 @@
+require 'spec_helper'
+
+# Exercises Admin::ChangesController, which builds a PaperTrail-backed diff view
+# of recent page changes. Controller specs (views not rendered) let us drive the
+# action and its private diff-building helpers without the admin HTML layout.
+# PaperTrail behaviour is a plausible upgrade casualty, so this pins it down.
+RSpec.describe Admin::ChangesController, type: :controller do
+  routes { TrustyCms::Application.routes }
+
+  let(:user) { create(:admin) }
+  let!(:site) { create(:site) }
+
+  before do
+    allow(controller).to receive(:authenticate_user!).and_return(true)
+    allow(controller).to receive(:current_user).and_return(user)
+    # The multi-site extension (which provides #current_site) isn't loaded in the
+    # dummy app, so stub it to the site our fixtures are scoped to.
+    allow(controller).to receive(:current_site).and_return(site)
+  end
+
+  # Create a page scoped to the current site and give it a versioned change so
+  # the controller has something to diff.
+  def page_with_change
+    page = create(:home, title: 'Original', site_id: site.id)
+    PaperTrail.request(whodunnit: user.id.to_s) do
+      page.update!(title: 'Updated Title')
+    end
+    page
+  end
+
+  # rails-controller-testing (which provides `assigns`) isn't in the bundle, so
+  # read the controller's assigned ivars directly.
+  def changes
+    controller.instance_variable_get(:@changes)
+  end
+
+  describe 'GET #show' do
+    it 'succeeds and assigns recent changes' do
+      page_with_change
+
+      get :show
+
+      expect(response).to have_http_status(:ok)
+      expect(changes).to be_present
+    end
+
+    it 'loads a single change when a version_id is given' do
+      page = page_with_change
+      version = PaperTrail::Version.where(item_type: 'Page', item_id: page.id).last
+
+      get :show, params: { version_id: version.id }
+
+      expect(response).to have_http_status(:ok)
+      expect(changes.size).to eq(1)
+      expect(changes.first[:id]).to eq(version.id)
+    end
+
+    it 'reports an error when the version_id is unknown' do
+      get :show, params: { version_id: 0 }
+
+      expect(changes).to be_empty
+      expect(controller.instance_variable_get(:@change_error)).to eq('Version ID not found.')
+    end
+
+    it 'succeeds with no changes present' do
+      get :show
+
+      expect(response).to have_http_status(:ok)
+      expect(changes).to eq([])
+    end
+  end
+end

data/spec/controllers/admin/configuration_controller_spec.rb

@@ -0,0 +1,49 @@
+require 'spec_helper'
+
+# Exercises Admin::ConfigurationController, which batch-updates TrustyCms::Config
+# entries inside a transaction and is admin-gated. Config plumbing is easy to
+# break in a framework upgrade, so pin the happy path and the auth gate.
+RSpec.describe Admin::ConfigurationController, type: :controller do
+  routes { TrustyCms::Application.routes }
+
+  let(:admin) { create(:admin) }
+
+  before do
+    allow(controller).to receive(:authenticate_user!).and_return(true)
+    allow(controller).to receive(:current_user).and_return(admin)
+  end
+
+  describe 'GET #show' do
+    it 'succeeds' do
+      get :show
+      expect(response).to have_http_status(:ok)
+    end
+  end
+
+  describe 'GET #edit' do
+    it 'succeeds for an admin' do
+      get :edit
+      expect(response).to have_http_status(:ok)
+    end
+  end
+
+  describe 'PUT #update' do
+    it 'persists the submitted config values and redirects to show' do
+      put :update, params: { trusty_config: { 'admin.title' => 'Renamed CMS' } }
+
+      expect(response).to redirect_to(action: :show)
+      expect(TrustyCms::Config['admin.title']).to eq('Renamed CMS')
+    end
+  end
+
+  describe 'authorization' do
+    it 'denies a non-admin access to edit' do
+      allow(controller).to receive(:current_user).and_return(create(:non_admin, email: 'plain@example.com'))
+
+      get :edit
+
+      expect(response).to be_redirect
+      expect(flash[:error]).to be_present
+    end
+  end
+end

data/spec/controllers/admin/page_attachments_controller_spec.rb

@@ -0,0 +1,54 @@
+require 'spec_helper'
+require 'rack/test'
+
+# Exercises Admin::PageAttachmentsController, whose custom #load_model builds a
+# PageAttachment from an asset_id (+ optional page_id) and rescues a missing
+# asset. Controller spec (views not rendered) drives the action and its
+# before-action without needing the admin HTML layout.
+RSpec.describe Admin::PageAttachmentsController, type: :controller do
+  routes { TrustyCms::Application.routes }
+
+  let(:user) { create(:admin) }
+  let(:fixtures_path) { TrustyCms::Engine.root.join('spec', 'fixtures', 'files') }
+  let(:asset) do
+    Asset.create!(asset: Rack::Test::UploadedFile.new(fixtures_path.join('sample.txt'), 'text/plain'), caption: '')
+  end
+
+  before do
+    register_standard_asset_types # shared canonical AssetTypes (see AssetTypeRegistry)
+    allow(controller).to receive(:authenticate_user!).and_return(true)
+    allow(controller).to receive(:current_user).and_return(user)
+  end
+
+  describe 'GET #new' do
+    it 'builds a PageAttachment for the asset with a new (unsaved) page' do
+      get :new, params: { asset_id: asset.id }
+
+      expect(response).to have_http_status(:ok)
+      model = controller.instance_variable_get(:@page_attachment)
+      expect(model).to be_a(PageAttachment)
+      expect(model.asset).to eq(asset)
+      expect(model.page).to be_a(Page).and be_new_record
+    end
+
+    it 'associates an existing page when a page_id is given' do
+      page = create(:home, title: 'Attach Target')
+
+      get :new, params: { asset_id: asset.id, page_id: page.id }
+
+      expect(controller.instance_variable_get(:@page)).to eq(page)
+    end
+
+    # NOTE: latent bug — load_model rescues a missing asset with
+    # `render nothing: true`, but the `nothing:` option was removed in Rails 5.1.
+    # It's now ignored, so Rails falls through to rendering the (nonexistent)
+    # `new` template and raises MissingTemplate instead of returning an empty
+    # body. Characterizing current behavior; the fix is `head :no_content`.
+    # This is exactly the kind of breakage a Rails 8 upgrade should clean up.
+    it 'raises MissingTemplate for a missing asset (broken rescue path)' do
+      expect {
+        get :new, params: { asset_id: 0 }
+      }.to raise_error(ActionView::MissingTemplate)
+    end
+  end
+end

data/spec/controllers/admin/pages_controller_spec.rb

@@ -0,0 +1,162 @@
+require 'spec_helper'
+
+# Exercises Admin::PagesController — the most heavily customized ResourceController
+# subclass (search, restore, per-site edit guards, meta-row setup, ordering).
+# Controller specs (views not rendered) let us drive the actions and their many
+# private helpers without the asset-pipeline-heavy admin HTML layout. This is the
+# highest-blast-radius controller in the app, so keep it green across the Rails 8 bump.
+RSpec.describe Admin::PagesController, type: :controller do
+  routes { TrustyCms::Application.routes }
+
+  let(:admin) { create(:admin) }
+  let!(:home) { create(:home, title: 'Home') }
+
+  before do
+    allow(controller).to receive(:authenticate_user!).and_return(true)
+    allow(controller).to receive(:current_user).and_return(admin)
+    # #current_site / Page.current_site / Page.homepage come from the multi-site
+    # extension, which isn't loaded in the dummy app; stub the touch points.
+    allow(Page).to receive(:current_site).and_return(nil)
+    allow(Page).to receive(:homepage).and_return(home)
+  end
+
+  describe 'GET #index' do
+    it 'succeeds and sets up the site/homepage/search' do
+      get :index
+      expect(response).to have_http_status(:ok)
+      expect(controller.instance_variable_get(:@homepage)).to eq(home)
+    end
+  end
+
+  describe 'GET #new' do
+    it 'builds a new page with defaults' do
+      get :new
+      expect(response).to have_http_status(:ok)
+      page = controller.instance_variable_get(:@page)
+      expect(page).to be_a(Page).and be_new_record
+    end
+
+    it 'roots a top-level page at "/" when no parent is given' do
+      get :new
+      expect(controller.instance_variable_get(:@page).slug).to eq('/')
+    end
+
+    it 'sets the parent_id from page_id' do
+      get :new, params: { page_id: home.id }
+      expect(controller.instance_variable_get(:@page).parent_id).to eq(home.id)
+    end
+  end
+
+  describe 'GET #edit' do
+    context 'when the page belongs to a site the admin can access' do
+      let(:site) { create(:site) }
+      let(:page) { create(:page, title: 'Editable', parent: home, site_id: site.id) }
+
+      before { admin.sites << site }
+
+      it 'succeeds and loads edit assigns' do
+        get :edit, params: { id: page.id }
+
+        expect(response).to have_http_status(:ok)
+        expect(controller.instance_variable_get(:@page)).to eq(page)
+        expect(controller.instance_variable_get(:@page_url)).to be_present
+      end
+    end
+
+    context 'when the page belongs to a site the admin cannot access' do
+      let(:site) { create(:site) }
+      let(:page) { create(:page, title: 'Forbidden', parent: home, site_id: site.id) }
+
+      it 'redirects back to the pages index' do
+        get :edit, params: { id: page.id }
+        expect(response).to redirect_to(admin_pages_url)
+      end
+    end
+  end
+
+  describe 'POST #create' do
+    it 'creates a page and redirects' do
+      expect {
+        post :create, params: { page: { title: 'Fresh', slug: 'fresh', breadcrumb: 'Fresh', parent_id: home.id } }
+      }.to change(Page, :count).by(1)
+
+      expect(response).to be_redirect
+    end
+
+    it 're-renders new via the rescue_from validation_error handler when invalid' do
+      expect {
+        post :create, params: { page: { title: '', slug: '', breadcrumb: '', parent_id: home.id } }
+      }.not_to change(Page, :count)
+
+      expect(flash[:error]).to be_present
+    end
+  end
+
+  describe 'PUT #update' do
+    it 'updates the page and redirects' do
+      page = create(:page, title: 'Before', parent: home)
+
+      put :update, params: { id: page.id, page: { title: 'After' } }
+
+      expect(response).to be_redirect
+      expect(page.reload.title).to eq('After')
+    end
+  end
+
+  describe 'DELETE #destroy' do
+    it 'destroys the page and counts descendants' do
+      page = create(:page, title: 'Doomed', parent: home)
+
+      expect {
+        delete :destroy, params: { id: page.id }
+      }.to change(Page, :count).by(-1)
+
+      expect(response).to be_redirect
+    end
+  end
+
+  describe 'GET #search' do
+    it 'returns matching pages when a query is present' do
+      create(:page, title: 'Findable', slug: 'findable', parent: home)
+
+      get :search, params: { site_id: nil, search: { query: 'Findable' } }
+
+      expect(response).to have_http_status(:ok)
+      titles = controller.instance_variable_get(:@pages).map(&:title)
+      expect(titles).to include('Findable')
+    end
+
+    it 'does not run a query when none is given' do
+      get :search, params: { site_id: '' }
+      expect(controller.instance_variable_get(:@pages)).to be_nil
+    end
+  end
+
+  describe 'POST #save_table_position' do
+    it 'saves the new order and returns ok' do
+      allow(Page).to receive(:save_order)
+      post :save_table_position, params: { new_position: %w[1 2 3] }
+      expect(response).to have_http_status(:ok)
+      expect(Page).to have_received(:save_order).with(%w[1 2 3])
+    end
+  end
+
+  describe 'PUT #restore' do
+    # NOTE: latent bug / Rails 8 upgrade blocker — restore_page_version calls
+    # PaperTrail's `reify`, which YAML-loads the stored version. Under Psych 4+
+    # (psych 5.4 is pinned) safe-loading rejects ActiveSupport::TimeWithZone
+    # because no permitted classes are configured, so restoring any page that has
+    # a timestamp in its versioned state raises Psych::DisallowedClass. Page
+    # restore is effectively broken until paper_trail's serializer is configured
+    # with permitted classes (e.g. via ActiveRecord::Base.yaml_column_permitted_classes
+    # or a custom serializer). Characterizing current behavior.
+    it 'currently fails to reify a versioned page (Psych safe-load blocker)' do
+      page = create(:page, title: 'V1', parent: home)
+      PaperTrail.request(whodunnit: admin.id.to_s) { page.update!(title: 'V2') }
+
+      expect {
+        put :restore, params: { id: page.id, version_index: 1 }
+      }.to raise_error(Psych::DisallowedClass, /TimeWithZone/)
+    end
+  end
+end

data/spec/controllers/admin/preferences_controller_spec.rb

@@ -0,0 +1,44 @@
+require 'spec_helper'
+
+# Exercises Admin::PreferencesController, which lets the current user edit their
+# own profile/preferences. Simple ApplicationController subclass; covers the
+# show/edit render paths and the valid/invalid update branches.
+RSpec.describe Admin::PreferencesController, type: :controller do
+  routes { TrustyCms::Application.routes }
+
+  let(:admin) { create(:admin) }
+
+  before do
+    allow(controller).to receive(:authenticate_user!).and_return(true)
+    allow(controller).to receive(:current_user).and_return(admin)
+  end
+
+  describe 'GET #show' do
+    it 'succeeds' do
+      get :show
+      expect(response).to have_http_status(:ok)
+    end
+  end
+
+  describe 'GET #edit' do
+    it 'succeeds' do
+      get :edit
+      expect(response).to have_http_status(:ok)
+    end
+  end
+
+  describe 'PUT #update' do
+    it 'updates the current user and redirects to configuration' do
+      put :update, params: { user: { first_name: 'Preferred' } }
+
+      expect(response).to redirect_to(admin_configuration_path)
+      expect(admin.reload.first_name).to eq('Preferred')
+    end
+
+    it 're-renders edit with an error when the update is invalid' do
+      put :update, params: { user: { email: 'not-an-email' } }
+
+      expect(flash[:error]).to be_present
+    end
+  end
+end

data/spec/controllers/admin/security_controller_spec.rb

@@ -0,0 +1,85 @@
+require 'spec_helper'
+
+# Exercises Admin::SecurityController — password changes and TOTP two-factor
+# enable/disable/verify for the current user. Touches devise-two-factor and QR
+# provisioning, both plausible upgrade casualties.
+RSpec.describe Admin::SecurityController, type: :controller do
+  routes { TrustyCms::Application.routes }
+
+  let(:user) { create(:admin) }
+
+  before do
+    allow(controller).to receive(:authenticate_user!).and_return(true)
+    allow(controller).to receive(:current_user).and_return(user)
+    # sign_out/sign_in need Warden wiring we don't set up here; the auth side
+    # effect isn't what these specs are checking.
+    allow(controller).to receive(:sign_out)
+  end
+
+  describe 'GET #show' do
+    it 'generates an OTP secret and QR provisioning data' do
+      expect(user.otp_secret).to be_blank
+
+      get :show
+
+      expect(response).to have_http_status(:ok)
+      expect(user.reload.otp_secret).to be_present
+      expect(controller.instance_variable_get(:@qr_png_data)).to start_with('data:image/png')
+    end
+  end
+
+  describe 'GET #edit' do
+    it 'succeeds' do
+      get :edit
+      expect(response).to have_http_status(:ok)
+    end
+  end
+
+  describe 'PUT #update' do
+    it 'updates the password, signs out, and redirects to sign-in' do
+      put :update, params: { user: { password: 'NewComplex1!', password_confirmation: 'NewComplex1!' } }
+
+      expect(controller).to have_received(:sign_out).with(user)
+      expect(response).to redirect_to(new_user_session_path)
+    end
+
+    it 're-renders edit when the password change is invalid' do
+      put :update, params: { user: { password: 'x', password_confirmation: 'y' } }
+
+      expect(flash[:error]).to be_present
+    end
+  end
+
+  describe 'POST #verify_two_factor' do
+    it 'enables 2FA when the OTP is valid' do
+      allow(user).to receive(:validate_and_consume_otp!).with('123456').and_return(true)
+
+      post :verify_two_factor, params: { otp_attempt: '123456' }
+
+      expect(user.reload.otp_required_for_login).to be(true)
+      expect(response).to redirect_to(admin_security_path)
+    end
+
+    it 'reports an error when the OTP is invalid' do
+      allow(user).to receive(:validate_and_consume_otp!).and_return(false)
+
+      post :verify_two_factor, params: { otp_attempt: 'bad' }
+
+      expect(flash[:error]).to be_present
+      expect(response).to redirect_to(admin_security_path)
+    end
+  end
+
+  describe 'POST #disable_two_factor' do
+    it 'clears the OTP settings and redirects' do
+      user.update!(otp_required_for_login: true, otp_secret: User.generate_otp_secret)
+
+      post :disable_two_factor
+
+      user.reload
+      expect(user.otp_required_for_login).to be(false)
+      expect(user.otp_secret).to be_nil
+      expect(response).to redirect_to(admin_security_path)
+    end
+  end
+end

data/spec/controllers/admin/sessions_controller_spec.rb

@@ -0,0 +1,56 @@
+require 'spec_helper'
+
+# Exercises Admin::SessionsController#create — the custom login flow that
+# branches into the two-factor handoff for OTP-enabled users. Overriding a
+# Devise controller is exactly the sort of thing that can break across a Devise
+# major, so pin the three branches (2FA, plain sign-in, bad credentials).
+RSpec.describe Admin::SessionsController, type: :controller do
+  routes { TrustyCms::Application.routes }
+  include Devise::Test::ControllerHelpers
+
+  let(:password) { 'ComplexPass1!' }
+
+  before do
+    request.env['devise.mapping'] = Devise.mappings[:user]
+    # sign_in needs Warden wiring that isn't the focus here.
+    allow(controller).to receive(:sign_in)
+  end
+
+  describe 'POST #create' do
+    it 'signs in a valid non-2FA user and redirects' do
+      user = create(:admin, password: password)
+
+      post :create, params: { user: { email: user.email, password: password } }
+
+      expect(controller).to have_received(:sign_in).with(:user, user)
+      expect(response).to redirect_to(admin_pages_path)
+    end
+
+    it 'starts the 2FA handoff for an OTP-enabled user' do
+      user = create(:admin, password: password, otp_required_for_login: true)
+
+      post :create, params: { user: { email: user.email, password: password } }
+
+      expect(response).to redirect_to(admin_two_factor_path)
+      expect(session[:pre_2fa_user_id]).to eq(user.id)
+      expect(session[:pre_2fa_started_at]).to be_present
+      expect(controller).not_to have_received(:sign_in)
+    end
+
+    it 're-renders the sign-in form on bad credentials' do
+      user = create(:admin, password: password)
+
+      post :create, params: { user: { email: user.email, password: 'wrong' } }
+
+      expect(controller).not_to have_received(:sign_in)
+      expect(flash.now[:alert]).to be_present
+    end
+
+    it 're-renders the sign-in form for an unknown email' do
+      post :create, params: { user: { email: 'nobody@example.com', password: password } }
+
+      expect(controller).not_to have_received(:sign_in)
+      expect(flash.now[:alert]).to be_present
+    end
+  end
+end

data/spec/controllers/admin/two_factor_controller_spec.rb

@@ -0,0 +1,63 @@
+require 'spec_helper'
+
+# Exercises Admin::TwoFactorController — the mid-login TOTP challenge. It runs
+# BEFORE the user is fully signed in (authenticate_user! is skipped) and drives
+# the flow off a short-lived session handoff (:pre_2fa_user_id / :started_at).
+RSpec.describe Admin::TwoFactorController, type: :controller do
+  routes { TrustyCms::Application.routes }
+  # current_user is read via Devise even though authenticate_user! is skipped.
+  include Devise::Test::ControllerHelpers
+
+  let(:user) { create(:admin, otp_required_for_login: true) }
+
+  # Put the user mid-2FA: pending id in the session, started just now.
+  def begin_2fa!(started_at: Time.current.to_i)
+    session[:pre_2fa_user_id] = user.id
+    session[:pre_2fa_started_at] = started_at
+  end
+
+  before { allow(controller).to receive(:sign_in) }
+
+  describe 'GET #show' do
+    it 'renders the challenge for a user mid-2FA' do
+      begin_2fa!
+      get :show
+      expect(response).to have_http_status(:ok)
+    end
+
+    it 'redirects to sign-in when there is no pending 2FA session' do
+      get :show
+      expect(response).to redirect_to(new_user_session_path)
+      expect(flash[:alert]).to be_present
+    end
+
+    it 'redirects to sign-in when the 2FA session has expired' do
+      begin_2fa!(started_at: 10.minutes.ago.to_i)
+      get :show
+      expect(response).to redirect_to(new_user_session_path)
+    end
+  end
+
+  describe 'POST #create' do
+    before { begin_2fa! }
+
+    it 'signs the user in and clears the handoff when the code is valid' do
+      allow_any_instance_of(User).to receive(:validate_and_consume_otp!).with('123456').and_return(true)
+
+      post :create, params: { otp_attempt: '123456' }
+
+      expect(controller).to have_received(:sign_in).with(:user, an_instance_of(User))
+      expect(response).to redirect_to(admin_pages_path)
+      expect(session[:pre_2fa_user_id]).to be_nil
+    end
+
+    it 'resets the session and redirects when the code is invalid' do
+      allow_any_instance_of(User).to receive(:validate_and_consume_otp!).and_return(false)
+
+      post :create, params: { otp_attempt: 'wrong' }
+
+      expect(response).to redirect_to(new_user_session_path)
+      expect(flash[:alert]).to be_present
+    end
+  end
+end