You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

541 lines
15 KiB

7 years ago
7 years ago
7 years ago
  1. require 'rails_helper'
  2. require 'devise_two_factor/spec_helpers'
  3. RSpec.describe User, type: :model do
  4. it_behaves_like 'two_factor_backupable'
  5. describe 'otp_secret' do
  6. it 'is encrypted with OTP_SECRET environment variable' do
  7. user = Fabricate(:user,
  8. encrypted_otp_secret: "Fttsy7QAa0edaDfdfSz094rRLAxc8cJweDQ4BsWH/zozcdVA8o9GLqcKhn2b\nGi/V\n",
  9. encrypted_otp_secret_iv: 'rys3THICkr60BoWC',
  10. encrypted_otp_secret_salt: '_LMkAGvdg7a+sDIKjI3mR2Q==')
  11. expect(user.otp_secret).to eq 'anotpsecretthatshouldbeencrypted'
  12. end
  13. end
  14. describe 'validations' do
  15. it 'is invalid without an account' do
  16. user = Fabricate.build(:user, account: nil)
  17. user.valid?
  18. expect(user).to model_have_error_on_field(:account)
  19. end
  20. it 'is invalid without a valid locale' do
  21. user = Fabricate.build(:user, locale: 'toto')
  22. user.valid?
  23. expect(user).to model_have_error_on_field(:locale)
  24. end
  25. it 'is invalid without a valid email' do
  26. user = Fabricate.build(:user, email: 'john@')
  27. user.valid?
  28. expect(user).to model_have_error_on_field(:email)
  29. end
  30. it 'is valid with an invalid e-mail that has already been saved' do
  31. user = Fabricate.build(:user, email: 'invalid-email')
  32. user.save(validate: false)
  33. expect(user.valid?).to be true
  34. end
  35. it 'cleans out empty string from languages' do
  36. user = Fabricate.build(:user, filtered_languages: [''])
  37. user.valid?
  38. expect(user.filtered_languages).to eq []
  39. end
  40. end
  41. describe 'scopes' do
  42. describe 'recent' do
  43. it 'returns an array of recent users ordered by id' do
  44. user_1 = Fabricate(:user)
  45. user_2 = Fabricate(:user)
  46. expect(User.recent).to eq [user_2, user_1]
  47. end
  48. end
  49. describe 'admins' do
  50. it 'returns an array of users who are admin' do
  51. user_1 = Fabricate(:user, admin: false)
  52. user_2 = Fabricate(:user, admin: true)
  53. expect(User.admins).to match_array([user_2])
  54. end
  55. end
  56. describe 'confirmed' do
  57. it 'returns an array of users who are confirmed' do
  58. user_1 = Fabricate(:user, confirmed_at: nil)
  59. user_2 = Fabricate(:user, confirmed_at: Time.now)
  60. expect(User.confirmed).to match_array([user_2])
  61. end
  62. end
  63. describe 'inactive' do
  64. it 'returns a relation of inactive users' do
  65. specified = Fabricate(:user, current_sign_in_at: 15.days.ago)
  66. Fabricate(:user, current_sign_in_at: 6.days.ago)
  67. expect(User.inactive).to match_array([specified])
  68. end
  69. end
  70. describe 'matches_email' do
  71. it 'returns a relation of users whose email starts with the given string' do
  72. specified = Fabricate(:user, email: 'specified@spec')
  73. Fabricate(:user, email: 'unspecified@spec')
  74. expect(User.matches_email('specified')).to match_array([specified])
  75. end
  76. end
  77. describe 'with_recent_ip_address' do
  78. it 'returns a relation of users who is, or was at last time, online with the given IP address' do
  79. specifieds = [
  80. Fabricate(:user, current_sign_in_ip: '0.0.0.42', last_sign_in_ip: '0.0.0.0'),
  81. Fabricate(:user, current_sign_in_ip: nil, last_sign_in_ip: '0.0.0.42')
  82. ]
  83. Fabricate(:user, current_sign_in_ip: '0.0.0.0', last_sign_in_ip: '0.0.0.0')
  84. expect(User.with_recent_ip_address('0.0.0.42')).to match_array(specifieds)
  85. end
  86. end
  87. end
  88. let(:account) { Fabricate(:account, username: 'alice') }
  89. let(:password) { 'abcd1234' }
  90. describe 'blacklist' do
  91. around(:each) do |example|
  92. old_blacklist = Rails.configuration.x.email_blacklist
  93. Rails.configuration.x.email_domains_blacklist = 'mvrht.com'
  94. example.run
  95. Rails.configuration.x.email_domains_blacklist = old_blacklist
  96. end
  97. it 'should allow a non-blacklisted user to be created' do
  98. user = User.new(email: 'foo@example.com', account: account, password: password)
  99. expect(user.valid?).to be_truthy
  100. end
  101. it 'should not allow a blacklisted user to be created' do
  102. user = User.new(email: 'foo@mvrht.com', account: account, password: password)
  103. expect(user.valid?).to be_falsey
  104. end
  105. it 'should not allow a subdomain blacklisted user to be created' do
  106. user = User.new(email: 'foo@mvrht.com.topdomain.tld', account: account, password: password)
  107. expect(user.valid?).to be_falsey
  108. end
  109. end
  110. describe '#confirmed?' do
  111. it 'returns true when a confirmed_at is set' do
  112. user = Fabricate.build(:user, confirmed_at: Time.now.utc)
  113. expect(user.confirmed?).to be true
  114. end
  115. it 'returns false if a confirmed_at is nil' do
  116. user = Fabricate.build(:user, confirmed_at: nil)
  117. expect(user.confirmed?).to be false
  118. end
  119. end
  120. describe '#confirm' do
  121. it 'sets email to unconfirmed_email' do
  122. user = Fabricate.build(:user, confirmed_at: Time.now.utc, unconfirmed_email: 'new-email@example.com')
  123. user.confirm
  124. expect(user.email).to eq 'new-email@example.com'
  125. end
  126. end
  127. describe '#disable_two_factor!' do
  128. it 'saves false for otp_required_for_login' do
  129. user = Fabricate.build(:user, otp_required_for_login: true)
  130. user.disable_two_factor!
  131. expect(user.reload.otp_required_for_login).to be false
  132. end
  133. it 'saves cleared otp_backup_codes' do
  134. user = Fabricate.build(:user, otp_backup_codes: %w(dummy dummy))
  135. user.disable_two_factor!
  136. expect(user.reload.otp_backup_codes.empty?).to be true
  137. end
  138. end
  139. describe '#send_confirmation_instructions' do
  140. around do |example|
  141. queue_adapter = ActiveJob::Base.queue_adapter
  142. example.run
  143. ActiveJob::Base.queue_adapter = queue_adapter
  144. end
  145. it 'delivers confirmation instructions later' do
  146. user = Fabricate(:user)
  147. ActiveJob::Base.queue_adapter = :test
  148. expect { user.send_confirmation_instructions }.to have_enqueued_job(ActionMailer::DeliveryJob)
  149. end
  150. end
  151. describe 'settings' do
  152. it 'is instance of Settings::ScopedSettings' do
  153. user = Fabricate(:user)
  154. expect(user.settings).to be_kind_of Settings::ScopedSettings
  155. end
  156. end
  157. describe '#setting_default_privacy' do
  158. it 'returns default privacy setting if user has configured' do
  159. user = Fabricate(:user)
  160. user.settings[:default_privacy] = 'unlisted'
  161. expect(user.setting_default_privacy).to eq 'unlisted'
  162. end
  163. it "returns 'private' if user has not configured default privacy setting and account is locked" do
  164. user = Fabricate(:user, account: Fabricate(:account, locked: true))
  165. expect(user.setting_default_privacy).to eq 'private'
  166. end
  167. it "returns 'public' if user has not configured default privacy setting and account is not locked" do
  168. user = Fabricate(:user, account: Fabricate(:account, locked: false))
  169. expect(user.setting_default_privacy).to eq 'public'
  170. end
  171. end
  172. describe 'whitelist' do
  173. around(:each) do |example|
  174. old_whitelist = Rails.configuration.x.email_whitelist
  175. Rails.configuration.x.email_domains_whitelist = 'mastodon.space'
  176. example.run
  177. Rails.configuration.x.email_domains_whitelist = old_whitelist
  178. end
  179. it 'should not allow a user to be created unless they are whitelisted' do
  180. user = User.new(email: 'foo@example.com', account: account, password: password)
  181. expect(user.valid?).to be_falsey
  182. end
  183. it 'should allow a user to be created if they are whitelisted' do
  184. user = User.new(email: 'foo@mastodon.space', account: account, password: password)
  185. expect(user.valid?).to be_truthy
  186. end
  187. it 'should not allow a user with a whitelisted top domain as subdomain in their email address to be created' do
  188. user = User.new(email: 'foo@mastodon.space.userdomain.com', account: account, password: password)
  189. expect(user.valid?).to be_falsey
  190. end
  191. context do
  192. around do |example|
  193. old_blacklist = Rails.configuration.x.email_blacklist
  194. example.run
  195. Rails.configuration.x.email_domains_blacklist = old_blacklist
  196. end
  197. it 'should not allow a user to be created with a specific blacklisted subdomain even if the top domain is whitelisted' do
  198. Rails.configuration.x.email_domains_blacklist = 'blacklisted.mastodon.space'
  199. user = User.new(email: 'foo@blacklisted.mastodon.space', account: account, password: password)
  200. expect(user.valid?).to be_falsey
  201. end
  202. end
  203. end
  204. it_behaves_like 'Settings-extended' do
  205. def create!
  206. User.create!(account: Fabricate(:account), email: 'foo@mastodon.space', password: 'abcd1234' )
  207. end
  208. def fabricate
  209. Fabricate(:user)
  210. end
  211. end
  212. describe 'token_for_app' do
  213. let(:user) { Fabricate(:user) }
  214. let(:app) { Fabricate(:application, owner: user) }
  215. it 'returns a token' do
  216. expect(user.token_for_app(app)).to be_a(Doorkeeper::AccessToken)
  217. end
  218. it 'persists a token' do
  219. t = user.token_for_app(app)
  220. expect(user.token_for_app(app)).to eql(t)
  221. end
  222. it 'is nil if user does not own app' do
  223. app.update!(owner: nil)
  224. expect(user.token_for_app(app)).to be_nil
  225. end
  226. end
  227. describe '#role' do
  228. it 'returns admin for admin' do
  229. user = User.new(admin: true)
  230. expect(user.role).to eq 'admin'
  231. end
  232. it 'returns moderator for moderator' do
  233. user = User.new(moderator: true)
  234. expect(user.role).to eq 'moderator'
  235. end
  236. it 'returns user otherwise' do
  237. user = User.new
  238. expect(user.role).to eq 'user'
  239. end
  240. end
  241. describe '#role?' do
  242. it 'returns false when invalid role requested' do
  243. user = User.new(admin: true)
  244. expect(user.role?('disabled')).to be false
  245. end
  246. it 'returns true when exact role match' do
  247. user = User.new
  248. mod = User.new(moderator: true)
  249. admin = User.new(admin: true)
  250. expect(user.role?('user')).to be true
  251. expect(mod.role?('moderator')).to be true
  252. expect(admin.role?('admin')).to be true
  253. end
  254. it 'returns true when role higher than needed' do
  255. mod = User.new(moderator: true)
  256. admin = User.new(admin: true)
  257. expect(mod.role?('user')).to be true
  258. expect(admin.role?('user')).to be true
  259. expect(admin.role?('moderator')).to be true
  260. end
  261. end
  262. describe '#disable!' do
  263. subject(:user) { Fabricate(:user, disabled: false, current_sign_in_at: current_sign_in_at, last_sign_in_at: nil) }
  264. let(:current_sign_in_at) { Time.zone.now }
  265. before do
  266. user.disable!
  267. end
  268. it 'disables user' do
  269. expect(user).to have_attributes(disabled: true, current_sign_in_at: nil, last_sign_in_at: current_sign_in_at)
  270. end
  271. end
  272. describe '#disable!' do
  273. subject(:user) { Fabricate(:user, disabled: false, current_sign_in_at: current_sign_in_at, last_sign_in_at: nil) }
  274. let(:current_sign_in_at) { Time.zone.now }
  275. before do
  276. user.disable!
  277. end
  278. it 'disables user' do
  279. expect(user).to have_attributes(disabled: true, current_sign_in_at: nil, last_sign_in_at: current_sign_in_at)
  280. end
  281. end
  282. describe '#enable!' do
  283. subject(:user) { Fabricate(:user, disabled: true) }
  284. before do
  285. user.enable!
  286. end
  287. it 'enables user' do
  288. expect(user).to have_attributes(disabled: false)
  289. end
  290. end
  291. describe '#confirm!' do
  292. subject(:user) { Fabricate(:user, confirmed_at: confirmed_at) }
  293. before do
  294. ActionMailer::Base.deliveries.clear
  295. user.confirm!
  296. end
  297. after { ActionMailer::Base.deliveries.clear }
  298. context 'when user is new' do
  299. let(:confirmed_at) { nil }
  300. it 'confirms user' do
  301. expect(user.confirmed_at).to be_present
  302. end
  303. it 'delivers mails' do
  304. expect(ActionMailer::Base.deliveries.count).to eq 2
  305. end
  306. end
  307. context 'when user is not new' do
  308. let(:confirmed_at) { Time.zone.now }
  309. it 'confirms user' do
  310. expect(user.confirmed_at).to be_present
  311. end
  312. it 'does not deliver mail' do
  313. expect(ActionMailer::Base.deliveries.count).to eq 0
  314. end
  315. end
  316. end
  317. describe '#promote!' do
  318. subject(:user) { Fabricate(:user, admin: is_admin, moderator: is_moderator) }
  319. before do
  320. user.promote!
  321. end
  322. context 'when user is an admin' do
  323. let(:is_admin) { true }
  324. context 'when user is a moderator' do
  325. let(:is_moderator) { true }
  326. it 'changes moderator filed false' do
  327. expect(user).to be_admin
  328. expect(user).not_to be_moderator
  329. end
  330. end
  331. context 'when user is not a moderator' do
  332. let(:is_moderator) { false }
  333. it 'does not change status' do
  334. expect(user).to be_admin
  335. expect(user).not_to be_moderator
  336. end
  337. end
  338. end
  339. context 'when user is not admin' do
  340. let(:is_admin) { false }
  341. context 'when user is a moderator' do
  342. let(:is_moderator) { true }
  343. it 'changes user into an admin' do
  344. expect(user).to be_admin
  345. expect(user).not_to be_moderator
  346. end
  347. end
  348. context 'when user is not a moderator' do
  349. let(:is_moderator) { false }
  350. it 'changes user into a moderator' do
  351. expect(user).not_to be_admin
  352. expect(user).to be_moderator
  353. end
  354. end
  355. end
  356. end
  357. describe '#demote!' do
  358. subject(:user) { Fabricate(:user, admin: admin, moderator: moderator) }
  359. before do
  360. user.demote!
  361. end
  362. context 'when user is an admin' do
  363. let(:admin) { true }
  364. context 'when user is a moderator' do
  365. let(:moderator) { true }
  366. it 'changes user into a moderator' do
  367. expect(user).not_to be_admin
  368. expect(user).to be_moderator
  369. end
  370. end
  371. context 'when user is not a moderator' do
  372. let(:moderator) { false }
  373. it 'changes user into a moderator' do
  374. expect(user).not_to be_admin
  375. expect(user).to be_moderator
  376. end
  377. end
  378. end
  379. context 'when user is not an admin' do
  380. let(:admin) { false }
  381. context 'when user is a moderator' do
  382. let(:moderator) { true }
  383. it 'changes user into a plain user' do
  384. expect(user).not_to be_admin
  385. expect(user).not_to be_moderator
  386. end
  387. end
  388. context 'when user is not a moderator' do
  389. let(:moderator) { false }
  390. it 'does not change any fields' do
  391. expect(user).not_to be_admin
  392. expect(user).not_to be_moderator
  393. end
  394. end
  395. end
  396. end
  397. describe '#active_for_authentication?' do
  398. subject { user.active_for_authentication? }
  399. let(:user) { Fabricate(:user, disabled: disabled, confirmed_at: confirmed_at) }
  400. context 'when user is disabled' do
  401. let(:disabled) { true }
  402. context 'when user is confirmed' do
  403. let(:confirmed_at) { Time.zone.now }
  404. it { is_expected.to be false }
  405. end
  406. context 'when user is not confirmed' do
  407. let(:confirmed_at) { nil }
  408. it { is_expected.to be false }
  409. end
  410. end
  411. context 'when user is not disabled' do
  412. let(:disabled) { false }
  413. context 'when user is confirmed' do
  414. let(:confirmed_at) { Time.zone.now }
  415. it { is_expected.to be true }
  416. end
  417. context 'when user is not confirmed' do
  418. let(:confirmed_at) { nil }
  419. it { is_expected.to be false }
  420. end
  421. end
  422. end
  423. end