|
1 | | -RSpec.describe "Spam trap protection for public forms", type: :request do |
2 | | - before do |
3 | | - allow_any_instance_of(Users::PasswordsController).to receive(:auth_service).and_return( |
4 | | - AuthService.new(Auth::MockAdapter.new) |
5 | | - ) |
6 | | - end |
7 | 1 |
|
8 | | - forms = [ |
9 | | - { |
10 | | - name: "Password reset instructions", |
11 | | - path: "/users/forgot-password", |
12 | | - param_key: :users_forgot_password_form, |
13 | | - valid_params: { |
14 | | - email: "UsernameDoesntExistForSure@example.com" |
15 | | - } |
16 | | - }, |
17 | | - { |
18 | | - name: "Password confirm reset", |
19 | | - path: "/users/reset-password", |
20 | | - param_key: :users_reset_password_form, |
21 | | - valid_params: { |
22 | | - email: "testIsANewUser@example.com", |
23 | | - code: "123456", |
24 | | - password: "aLongPassword123" |
25 | | - } |
26 | | - }, |
27 | | - { |
28 | | - name: "Registration", |
29 | | - path: "/users/registrations", |
30 | | - param_key: :users_registration_form, |
31 | | - valid_params: { |
32 | | - email: "evenneweruser@example.com", |
33 | | - password: "aLongPassword123" |
34 | | - } |
35 | | - }, |
36 | | - { |
37 | | - name: "Login", |
38 | | - path: "/users/sign_in", |
39 | | - param_key: :users_new_session_form, |
40 | | - valid_params: { |
41 | | - email: "test@example.com", |
42 | | - password: "password" |
43 | | - } |
44 | | - } |
45 | | - ] |
46 | 2 |
|
47 | | - forms.each do |form| |
48 | | - describe "#{form[:name]} form" do |
49 | | - let(:spam_params) do |
50 | | - { |
51 | | - form[:param_key] => form[:valid_params].merge(spam_trap: "I am a bot") |
52 | | - } |
53 | | - end |
54 | 3 |
|
55 | | - let(:valid_params) do |
56 | | - { |
57 | | - form[:param_key] => form[:valid_params] |
| 4 | + |
| 5 | + |
| 6 | + RSpec.describe "Spam trap protection for public forms", type: :request do |
| 7 | + before do |
| 8 | + Users::PasswordsController.auth_service = AuthService.new(Auth::MockAdapter.new) |
| 9 | + Users::RegistrationsController.auth_service = AuthService.new(Auth::MockAdapter.new) |
| 10 | + Users::SessionsController.auth_service = AuthService.new(Auth::MockAdapter.new(uid_generator: -> { "mock-uid" })) |
| 11 | + end |
| 12 | + |
| 13 | + after do |
| 14 | + # Clean up so this doesn't leak across tests |
| 15 | + Users::PasswordsController.auth_service = nil |
| 16 | + Users::RegistrationsController.auth_service = nil |
| 17 | + Users::SessionsController.auth_service = nil |
| 18 | + end |
| 19 | + |
| 20 | + forms = [ |
| 21 | + { |
| 22 | + name: "Password reset instructions", |
| 23 | + path: "/users/forgot-password", |
| 24 | + param_key: :users_forgot_password_form, |
| 25 | + valid_params: { |
| 26 | + email: "UsernameDoesntExistForSure@example.com" |
58 | 27 | } |
59 | | - end |
| 28 | + }, |
| 29 | + { |
| 30 | + name: "Password confirm reset", |
| 31 | + path: "/users/reset-password", |
| 32 | + param_key: :users_reset_password_form, |
| 33 | + valid_params: { |
| 34 | + email: "testIsANewUser@example.com", |
| 35 | + code: "123456", |
| 36 | + password: "aLongPassword123" |
| 37 | + } |
| 38 | + }, |
| 39 | + { |
| 40 | + name: "Registration", |
| 41 | + path: "/users/registrations", |
| 42 | + param_key: :users_registration_form, |
| 43 | + valid_params: { |
| 44 | + email: "evenneweruser@example.com", |
| 45 | + password: "aLongPassword123" |
| 46 | + } |
| 47 | + }, |
| 48 | + { |
| 49 | + name: "Login", |
| 50 | + path: "/users/sign_in", |
| 51 | + param_key: :users_new_session_form, |
| 52 | + valid_params: { |
| 53 | + email: "test@example.com", |
| 54 | + password: "password" |
| 55 | + } |
| 56 | + } |
| 57 | + ] |
| 58 | + |
| 59 | + forms.each do |form| |
| 60 | + describe "#{form[:name]} form" do |
| 61 | + let(:spam_params) do |
| 62 | + { |
| 63 | + form[:param_key] => form[:valid_params].merge(spam_trap: "I am a bot") |
| 64 | + } |
| 65 | + end |
60 | 66 |
|
61 | | - it "rejects spam submissions" do |
62 | | - post form[:path], params: spam_params |
63 | | - expect(response).to have_http_status(422), "Expected 422 for #{form[:name]} form, but got #{response.status}" |
| 67 | + it "rejects spam submissions" do |
| 68 | + post form[:path], params: spam_params |
| 69 | + expect(response).to have_http_status(422), "Expected 422 for #{form[:name]} form, but got #{response.status}" |
| 70 | + end |
64 | 71 | end |
65 | 72 | end |
66 | 73 | end |
67 | | -end |
|
0 commit comments