neiam /gitgud

defmodule GitGudWeb.SettingsSudoTest do
  @moduledoc """
  Every account-settings page that manages a credential sits behind
  sudo mode.

  Sudo is declared per-LiveView via `on_mount`, not in the router, so a
  new settings page is ungated by default — which is how
  /users/settings/two-factor, /tokens and /invites came to be reachable
  with only a session. This test enumerates them so the next one that's
  added has to be considered.
  """

  use GitGudWeb.ConnCase, async: false

  import Phoenix.LiveViewTest
  import GitGud.AccountsFixtures

  @gated [
    "/users/settings",
    "/users/settings/ssh-keys",
    "/users/settings/two-factor",
    "/users/settings/tokens",
    "/users/settings/invites"
  ]

  # `register_and_log_in_user` authenticates far enough back that sudo
  # has lapsed, which is exactly the state being tested: a live session,
  # no recent re-authentication.
  defp stale_conn(conn) do
    user = user_fixture()
    log_in_user(conn, user, token_authenticated_at: hours_ago(2))
  end

  defp hours_ago(n), do: DateTime.utc_now(:second) |> DateTime.add(-n * 3600, :second)

  for path <- @gated do
    test "#{path} redirects to log-in without recent auth", %{conn: conn} do
      assert {:error, {:redirect, %{to: to}}} = live(stale_conn(conn), unquote(path))
      assert to =~ "/users/log-in"
    end
  end

  # /users/settings predates the tuple form and still uses the bare
  # one, so it drops you on the default page after re-auth rather than
  # back where you were. Left alone here — it's a UX wart, not a hole.
  for path <- @gated -- ["/users/settings"] do
    test "#{path} carries a return_to so re-auth lands back there", %{conn: conn} do
      assert {:error, {:redirect, %{to: to}}} = live(stale_conn(conn), unquote(path))
      assert to =~ "return_to"
    end
  end

  test "a freshly authenticated session reaches two-factor setup", %{conn: conn} do
    user = user_fixture()
    conn = log_in_user(conn, user)

    {:ok, _lv, html} = live(conn, ~p"/users/settings/two-factor")
    assert html =~ "factor" or html =~ "Factor"
  end

  test "a freshly authenticated session reaches the tokens page", %{conn: conn} do
    user = user_fixture()
    conn = log_in_user(conn, user)

    {:ok, _lv, _html} = live(conn, ~p"/users/settings/tokens")
  end

  test "anonymous visitors are bounced before sudo even applies", %{conn: conn} do
    for path <- @gated do
      assert {:error, {:redirect, %{to: to}}} = live(conn, path)
      assert to =~ "/users/log-in"
    end
  end
end