neiam /gitgud

defmodule GitGudWeb.PasswordChangeTest do
  use GitGudWeb.ConnCase, async: true

  import Phoenix.LiveViewTest
  import GitGud.AccountsFixtures

  alias GitGud.Accounts

  @new_password "a brand new secret"

  setup %{conn: conn} do
    user = user_fixture() |> set_password()
    %{conn: log_in_user(conn, user), user: user}
  end

  # The settings form carries the email in a hidden field; the
  # controller re-logs-you-in with it after a successful change.
  defp submit(conn, user, params) do
    post(conn, ~p"/users/update-password", %{
      "user" => Map.put(params, "email", user.email)
    })
  end

  test "the form asks for the current password", %{conn: conn} do
    {:ok, _lv, html} = live(conn, ~p"/users/settings")
    assert html =~ "Current password"
  end

  test "the current password is required to change it", %{conn: conn, user: user} do
    conn =
      submit(conn, user, %{
        "current_password" => "not the password",
        "password" => @new_password,
        "password_confirmation" => @new_password
      })

    assert redirected_to(conn) == ~p"/users/settings"
    assert Phoenix.Flash.get(conn.assigns.flash, :error) =~ "current password"

    # Still the old one.
    assert Accounts.get_user_by_email_and_password(user.email, valid_user_password())
    refute Accounts.get_user_by_email_and_password(user.email, @new_password)
  end

  test "an omitted current password is rejected too", %{conn: conn, user: user} do
    conn =
      submit(conn, user, %{"password" => @new_password, "password_confirmation" => @new_password})

    assert redirected_to(conn) == ~p"/users/settings"
    refute Accounts.get_user_by_email_and_password(user.email, @new_password)
  end

  test "the right current password changes it", %{conn: conn, user: user} do
    conn =
      submit(conn, user, %{
        "current_password" => valid_user_password(),
        "password" => @new_password,
        "password_confirmation" => @new_password
      })

    assert redirected_to(conn) == ~p"/users/settings"
    assert Accounts.get_user_by_email_and_password(user.email, @new_password)
  end

  test "a magic-link-only account can set a first password", %{conn: conn} do
    user = user_fixture()
    refute GitGud.Accounts.User.has_password?(user)

    conn = log_in_user(conn, user)

    {:ok, _lv, html} = live(conn, ~p"/users/settings")
    refute html =~ "Current password"

    conn =
      submit(conn, user, %{
        "password" => @new_password,
        "password_confirmation" => @new_password
      })

    assert redirected_to(conn) == ~p"/users/settings"
    assert Accounts.get_user_by_email_and_password(user.email, @new_password)
  end
end