From 0ac511a31a6652ab00bbc765079b1c56128b191f Mon Sep 17 00:00:00 2001
From: Azul <azul@riseup.net>
Date: Thu, 24 Mar 2016 09:03:30 +0100
Subject: split up integration account test

AccountLivecycleTest -> CRUD accounts
SecurityTest -> security specific tests
AdminTest -> admin specific tests
---
 test/integration/browser/account_livecycle_test.rb | 114 +++++++++++++
 test/integration/browser/account_test.rb           | 176 ---------------------
 test/integration/browser/admin_test.rb             |  18 +++
 test/integration/browser/security_test.rb          |  52 ++++++
 4 files changed, 184 insertions(+), 176 deletions(-)
 create mode 100644 test/integration/browser/account_livecycle_test.rb
 delete mode 100644 test/integration/browser/account_test.rb
 create mode 100644 test/integration/browser/security_test.rb

(limited to 'test/integration')

diff --git a/test/integration/browser/account_livecycle_test.rb b/test/integration/browser/account_livecycle_test.rb
new file mode 100644
index 0000000..604f456
--- /dev/null
+++ b/test/integration/browser/account_livecycle_test.rb
@@ -0,0 +1,114 @@
+require 'test_helper'
+
+class AccountLivecycleTest < BrowserIntegrationTest
+
+  teardown do
+    Identity.destroy_all_orphaned
+  end
+
+  test "signup successfully when invited" do
+    username, password = submit_signup
+    assert page.has_content?("Welcome #{username}")
+    click_on 'Log Out'
+    assert page.has_content?("Log In")
+    assert_equal '/', current_path
+    assert user = User.find_by_login(username)
+    user.account.destroy
+  end
+
+  test "signup successfully without invitation" do
+    with_config invite_required: false do
+
+      username ||= "test_#{SecureRandom.urlsafe_base64}".downcase
+      password ||= SecureRandom.base64
+
+      visit '/users/new'
+      fill_in 'Username', with: username
+      fill_in 'Password', with: password
+      fill_in 'Password confirmation', with: password
+      click_on 'Sign Up'
+
+      assert page.has_content?("Welcome #{username}")
+    end
+  end
+
+  test "signup with username ending in dot json" do
+    username = Faker::Internet.user_name + '.json'
+    submit_signup username
+    assert page.has_content?("Welcome #{username}")
+  end
+
+  test "signup with reserved username" do
+    username = 'certmaster'
+    submit_signup username
+    assert page.has_content?("is reserved.")
+  end
+
+  test "successful login" do
+    username, password = submit_signup
+    click_on 'Log Out'
+    attempt_login(username, password)
+    assert page.has_content?("Welcome #{username}")
+    within('.sidenav li.active') do
+      assert page.has_content?("Overview")
+    end
+    User.find_by_login(username).account.destroy
+  end
+
+  test "failed login" do
+    visit '/'
+    attempt_login("username", "wrong password")
+    assert_invalid_login(page)
+  end
+
+  test "account destruction" do
+    username, password = submit_signup
+
+    click_on I18n.t('account_settings')
+    click_on I18n.t('destroy_my_account')
+    assert page.has_content?(I18n.t('account_destroyed'))
+    assert_equal 1, Identity.by_address.key("#{username}@test.me").count
+    attempt_login(username, password)
+    assert_invalid_login(page)
+  end
+
+  test "handle blocked after account destruction" do
+    username, password = submit_signup
+    click_on I18n.t('account_settings')
+    click_on I18n.t('destroy_my_account')
+    submit_signup(username)
+    assert page.has_content?('has already been taken')
+  end
+
+  test "change pgp key" do
+    with_config user_actions: ['change_pgp_key'] do
+      pgp_key = FactoryGirl.build :pgp_key
+      login
+      click_on "Account Settings"
+      within('#update_pgp_key') do
+        fill_in 'Public key', with: pgp_key
+        click_on 'Save'
+      end
+      page.assert_selector 'input[value="Saving..."]'
+      # at some point we're done:
+      page.assert_no_selector 'input[value="Saving..."]'
+      assert page.has_field? 'Public key', with: pgp_key.to_s
+      @user.reload
+      assert_equal pgp_key, @user.public_key
+    end
+  end
+
+  def attempt_login(username, password)
+    click_on 'Log In'
+    fill_in 'Username', with: username
+    fill_in 'Password', with: password
+    click_on 'Log In'
+  end
+
+  def assert_invalid_login(page)
+    assert page.has_selector? '.btn-primary.disabled'
+    assert page.has_content? I18n.t(:invalid_user_pass)
+    assert page.has_no_selector? '.btn-primary.disabled'
+  end
+
+end
diff --git a/test/integration/browser/account_test.rb b/test/integration/browser/account_test.rb
deleted file mode 100644
index 50adb23..0000000
--- a/test/integration/browser/account_test.rb
+++ /dev/null
@@ -1,176 +0,0 @@
-require 'test_helper'
-
-class AccountTest < BrowserIntegrationTest
-
-  teardown do
-    Identity.destroy_all_orphaned
-  end
-
-  test "signup successfully when invited" do
-    username, password = submit_signup
-    assert page.has_content?("Welcome #{username}")
-    click_on 'Log Out'
-    assert page.has_content?("Log In")
-    assert_equal '/', current_path
-    assert user = User.find_by_login(username)
-    user.account.destroy
-  end
-
-  test "signup successfully without invitation" do
-    with_config invite_required: false do
-
-      username ||= "test_#{SecureRandom.urlsafe_base64}".downcase
-      password ||= SecureRandom.base64
-
-      visit '/users/new'
-      fill_in 'Username', with: username
-      fill_in 'Password', with: password
-      fill_in 'Password confirmation', with: password
-      click_on 'Sign Up'
-
-      assert page.has_content?("Welcome #{username}")
-    end
-  end
-
-  test "signup with username ending in dot json" do
-    username = Faker::Internet.user_name + '.json'
-    submit_signup username
-    assert page.has_content?("Welcome #{username}")
-  end
-
-  test "signup with reserved username" do
-    username = 'certmaster'
-    submit_signup username
-    assert page.has_content?("is reserved.")
-  end
-
-  test "successful login" do
-    username, password = submit_signup
-    click_on 'Log Out'
-    attempt_login(username, password)
-    assert page.has_content?("Welcome #{username}")
-    within('.sidenav li.active') do
-      assert page.has_content?("Overview")
-    end
-    User.find_by_login(username).account.destroy
-  end
-
-  test "failed login" do
-    visit '/'
-    attempt_login("username", "wrong password")
-    assert_invalid_login(page)
-  end
-
-  test "account destruction" do
-    username, password = submit_signup
-
-    click_on I18n.t('account_settings')
-    click_on I18n.t('destroy_my_account')
-    assert page.has_content?(I18n.t('account_destroyed'))
-    assert_equal 1, Identity.by_address.key("#{username}@test.me").count
-    attempt_login(username, password)
-    assert_invalid_login(page)
-  end
-
-  test "handle blocked after account destruction" do
-    username, password = submit_signup
-    click_on I18n.t('account_settings')
-    click_on I18n.t('destroy_my_account')
-    submit_signup(username)
-    assert page.has_content?('has already been taken')
-  end
-
-  test "default user actions" do
-    login
-    click_on "Account Settings"
-    assert page.has_content? I18n.t('destroy_my_account')
-    assert page.has_no_css? '#update_login_and_password'
-    assert page.has_no_css? '#update_pgp_key'
-  end
-
-  test "default admin actions" do
-    login
-    with_config admins: [@user.login] do
-      click_on "Account Settings"
-      assert page.has_content? I18n.t('destroy_my_account')
-      assert page.has_no_css? '#update_login_and_password'
-      assert page.has_css? '#update_pgp_key'
-    end
-  end
-
-  test "change pgp key" do
-    with_config user_actions: ['change_pgp_key'] do
-      pgp_key = FactoryGirl.build :pgp_key
-      login
-      click_on "Account Settings"
-      within('#update_pgp_key') do
-        fill_in 'Public key', with: pgp_key
-        click_on 'Save'
-      end
-      page.assert_selector 'input[value="Saving..."]'
-      # at some point we're done:
-      page.assert_no_selector 'input[value="Saving..."]'
-      assert page.has_field? 'Public key', with: pgp_key.to_s
-      @user.reload
-      assert_equal pgp_key, @user.public_key
-    end
-  end
-
-
-  # trying to seed an invalid A for srp login
-  test "detects attempt to circumvent SRP" do
-    InviteCodeValidator.any_instance.stubs(:validate)
-
-    user = FactoryGirl.create :user
-    visit '/login'
-    fill_in 'Username', with: user.login
-    fill_in 'Password', with: "password"
-    inject_malicious_js
-    click_on 'Log In'
-    assert page.has_content?("Invalid random key")
-    assert page.has_no_content?("Welcome")
-    user.destroy
-  end
-
-  test "reports internal server errors" do
-    V1::UsersController.any_instance.stubs(:create).raises
-    submit_signup
-    assert page.has_content?("server failed")
-  end
-
-  test "does not render signup form without js" do
-    Capybara.current_driver = :rack_test # no js
-    visit '/signup'
-    assert page.has_no_content?("Username")
-    assert page.has_no_content?("Password")
-  end
-
-  test "does not render login form without js" do
-    Capybara.current_driver = :rack_test # no js
-    visit '/login'
-    assert page.has_no_content?("Username")
-    assert page.has_no_content?("Password")
-  end
-
-  def attempt_login(username, password)
-    click_on 'Log In'
-    fill_in 'Username', with: username
-    fill_in 'Password', with: password
-    click_on 'Log In'
-  end
-
-  def assert_invalid_login(page)
-    assert page.has_selector? '.btn-primary.disabled'
-    assert page.has_content? I18n.t(:invalid_user_pass)
-    assert page.has_no_selector? '.btn-primary.disabled'
-  end
-
-  def inject_malicious_js
-    page.execute_script <<-EOJS
-      var calc = new srp.Calculate();
-      calc.A = function(_a) {return "00";};
-      calc.S = calc.A;
-      srp.session = new srp.Session(null, calc);
-    EOJS
-  end
-end
diff --git a/test/integration/browser/admin_test.rb b/test/integration/browser/admin_test.rb
index 902c981..0b43c29 100644
--- a/test/integration/browser/admin_test.rb
+++ b/test/integration/browser/admin_test.rb
@@ -2,6 +2,24 @@ require 'test_helper'
 
 class AdminTest < BrowserIntegrationTest
 
+  test "default user actions" do
+    login
+    click_on "Account Settings"
+    assert page.has_content? I18n.t('destroy_my_account')
+    assert page.has_no_css? '#update_login_and_password'
+    assert page.has_no_css? '#update_pgp_key'
+  end
+
+  test "default admin actions" do
+    login
+    with_config admins: [@user.login] do
+      click_on "Account Settings"
+      assert page.has_content? I18n.t('destroy_my_account')
+      assert page.has_no_css? '#update_login_and_password'
+      assert page.has_css? '#update_pgp_key'
+    end
+  end
+
   test "clear blocked handle" do
     id = FactoryGirl.create :identity
     submit_signup(id.login)
diff --git a/test/integration/browser/security_test.rb b/test/integration/browser/security_test.rb
new file mode 100644
index 0000000..c13acd8
--- /dev/null
+++ b/test/integration/browser/security_test.rb
@@ -0,0 +1,52 @@
+require 'test_helper'
+
+class SecurityTest < BrowserIntegrationTest
+
+  teardown do
+    Identity.destroy_all_orphaned
+  end
+
+  # trying to seed an invalid A for srp login
+  test "detects attempt to circumvent SRP" do
+    InviteCodeValidator.any_instance.stubs(:validate)
+
+    user = FactoryGirl.create :user
+    visit '/login'
+    fill_in 'Username', with: user.login
+    fill_in 'Password', with: "password"
+    inject_malicious_js
+    click_on 'Log In'
+    assert page.has_content?("Invalid random key")
+    assert page.has_no_content?("Welcome")
+    user.destroy
+  end
+
+  test "reports internal server errors" do
+    V1::UsersController.any_instance.stubs(:create).raises
+    submit_signup
+    assert page.has_content?("server failed")
+  end
+
+  test "does not render signup form without js" do
+    Capybara.current_driver = :rack_test # no js
+    visit '/signup'
+    assert page.has_no_content?("Username")
+    assert page.has_no_content?("Password")
+  end
+
+  test "does not render login form without js" do
+    Capybara.current_driver = :rack_test # no js
+    visit '/login'
+    assert page.has_no_content?("Username")
+    assert page.has_no_content?("Password")
+  end
+
+  def inject_malicious_js
+    page.execute_script <<-EOJS
+      var calc = new srp.Calculate();
+      calc.A = function(_a) {return "00";};
+      calc.S = calc.A;
+      srp.session = new srp.Session(null, calc);
+    EOJS
+  end
+end
-- 
cgit v1.2.3


From 6d9bd6b966ec2370b7f8659b0810b03c5d1568aa Mon Sep 17 00:00:00 2001
From: Azul <azul@riseup.net>
Date: Thu, 24 Mar 2016 09:08:46 +0100
Subject: upgrade: unique test names

Rails 4.2 runs all tests mixed together. So unit tests and integration tests
may not have conflicting names.
---
 test/integration/api/token_auth_test.rb | 16 ++++++++++++++++
 test/integration/api/token_test.rb      | 16 ----------------
 2 files changed, 16 insertions(+), 16 deletions(-)
 create mode 100644 test/integration/api/token_auth_test.rb
 delete mode 100644 test/integration/api/token_test.rb

(limited to 'test/integration')

diff --git a/test/integration/api/token_auth_test.rb b/test/integration/api/token_auth_test.rb
new file mode 100644
index 0000000..3b83f23
--- /dev/null
+++ b/test/integration/api/token_auth_test.rb
@@ -0,0 +1,16 @@
+require_relative '../../test_helper'
+require_relative 'srp_test'
+
+class TokenAuthTest < SrpTest
+
+  setup do
+    register_user
+  end
+
+  test "stores token SHA512 encoded" do
+    authenticate
+    token = server_auth['token']
+    assert Token.find(Digest::SHA512.hexdigest(token))
+  end
+
+end
diff --git a/test/integration/api/token_test.rb b/test/integration/api/token_test.rb
deleted file mode 100644
index dafbfb7..0000000
--- a/test/integration/api/token_test.rb
+++ /dev/null
@@ -1,16 +0,0 @@
-require_relative '../../test_helper'
-require_relative 'srp_test'
-
-class TokenTest < SrpTest
-
-  setup do
-    register_user
-  end
-
-  test "stores token SHA512 encoded" do
-    authenticate
-    token = server_auth['token']
-    assert Token.find(Digest::SHA512.hexdigest(token))
-  end
-
-end
-- 
cgit v1.2.3


From e05a1b0f5ae40a2aa17976b3009cd563b8e4660a Mon Sep 17 00:00:00 2001
From: Azul <azul@riseup.net>
Date: Sun, 1 May 2016 10:55:33 -0300
Subject: api: allow version bumping - bump to 2

---
 test/integration/api/cert_test.rb                  |  11 +-
 test/integration/api/signup_test.rb                |   2 +-
 test/integration/api/smtp_cert_test.rb             |  14 +-
 test/integration/api/srp_test.rb                   |  18 ++-
 test/integration/api/token_auth_test.rb            |   2 +-
 test/integration/api/update_account_test.rb        |   2 +-
 .../browser/account_livecycle_test.rb.orig         | 153 +++++++++++++++++++++
 test/integration/browser/security_test.rb          |   2 +-
 8 files changed, 187 insertions(+), 17 deletions(-)
 create mode 100644 test/integration/browser/account_livecycle_test.rb.orig

(limited to 'test/integration')

diff --git a/test/integration/api/cert_test.rb b/test/integration/api/cert_test.rb
index 772901d..289d3c6 100644
--- a/test/integration/api/cert_test.rb
+++ b/test/integration/api/cert_test.rb
@@ -5,7 +5,7 @@ class CertTest < ApiIntegrationTest
 
   test "retrieve eip cert" do
     login
-    get '/1/cert', {}, RACK_ENV
+    get cert_url, {}, RACK_ENV
     assert_text_response
     assert_response_includes "BEGIN RSA PRIVATE KEY"
     assert_response_includes "END RSA PRIVATE KEY"
@@ -14,13 +14,13 @@ class CertTest < ApiIntegrationTest
   end
 
   test "fetching certs requires login by default" do
-    get '/1/cert', {}, RACK_ENV
+    get cert_url, {}, RACK_ENV
     assert_login_required
   end
 
   test "retrieve anonymous eip cert" do
     with_config allow_anonymous_certs: true do
-      get '/1/cert', {}, RACK_ENV
+      get cert_url, {}, RACK_ENV
       assert_text_response
       assert_response_includes "BEGIN RSA PRIVATE KEY"
       assert_response_includes "END RSA PRIVATE KEY"
@@ -28,4 +28,9 @@ class CertTest < ApiIntegrationTest
       assert_response_includes "END CERTIFICATE"
     end
   end
+
+  def cert_url
+    "/#{api_version}/cert"
+  end
+
 end
diff --git a/test/integration/api/signup_test.rb b/test/integration/api/signup_test.rb
index 7216496..dc24420 100644
--- a/test/integration/api/signup_test.rb
+++ b/test/integration/api/signup_test.rb
@@ -1,4 +1,4 @@
-require_relative '../../test_helper'
+require 'test_helper'
 require_relative 'srp_test'
 
 class SignupTest < SrpTest
diff --git a/test/integration/api/smtp_cert_test.rb b/test/integration/api/smtp_cert_test.rb
index 681d509..53382c1 100644
--- a/test/integration/api/smtp_cert_test.rb
+++ b/test/integration/api/smtp_cert_test.rb
@@ -11,7 +11,7 @@ class SmtpCertTest < ApiIntegrationTest
   test "retrieve smtp cert" do
     @user = FactoryGirl.create :user, effective_service_level_code: 2, :invite_code => @testcode.invite_code
     login
-    post '/1/smtp_cert', {}, RACK_ENV
+    post smtp_cert_url, {}, RACK_ENV
     assert_text_response
     assert_response_includes "BEGIN RSA PRIVATE KEY"
     assert_response_includes "END RSA PRIVATE KEY"
@@ -22,7 +22,7 @@ class SmtpCertTest < ApiIntegrationTest
   test "cert and key" do
     @user = FactoryGirl.create :user, effective_service_level_code: 2, :invite_code => @testcode.invite_code
     login
-    post '/1/smtp_cert', {}, RACK_ENV
+    post smtp_cert_url, {}, RACK_ENV
     assert_text_response
     cert = OpenSSL::X509::Certificate.new(get_response.body)
     key = OpenSSL::PKey::RSA.new(get_response.body)
@@ -34,7 +34,7 @@ class SmtpCertTest < ApiIntegrationTest
   test "fingerprint is stored with identity" do
     @user = FactoryGirl.create :user, effective_service_level_code: 2, :invite_code => @testcode.invite_code
     login
-    post '/1/smtp_cert', {}, RACK_ENV
+    post smtp_cert_url, {}, RACK_ENV
     assert_text_response
     cert = OpenSSL::X509::Certificate.new(get_response.body)
     fingerprint = OpenSSL::Digest::SHA1.hexdigest(cert.to_der).scan(/../).join(':')
@@ -48,14 +48,18 @@ class SmtpCertTest < ApiIntegrationTest
   test "fetching smtp certs requires email account" do
 
     login
-    post '/1/smtp_cert', {}, RACK_ENV
+    post smtp_cert_url, {}, RACK_ENV
     assert_access_denied
   end
 
   test "no anonymous smtp certs" do
     with_config allow_anonymous_certs: true do
-      post '/1/smtp_cert', {}, RACK_ENV
+      post smtp_cert_url, {}, RACK_ENV
       assert_login_required
     end
   end
+
+  def smtp_cert_url
+    "/#{api_version}/smtp_cert"
+  end
 end
diff --git a/test/integration/api/srp_test.rb b/test/integration/api/srp_test.rb
index 463abcd..b9605f9 100644
--- a/test/integration/api/srp_test.rb
+++ b/test/integration/api/srp_test.rb
@@ -14,7 +14,7 @@ class SrpTest < RackTest
 
   # this test wraps the api and implements the interface the ruby-srp client.
   def handshake(login, aa)
-    post "http://api.lvh.me:3000/1/sessions.json",
+    post api_url("sessions.json"),
       :login => login,
       'A' => aa,
       :format => :json
@@ -27,7 +27,7 @@ class SrpTest < RackTest
   end
 
   def validate(m)
-    put "http://api.lvh.me:3000/1/sessions/" + @login + '.json',
+    put api_url("sessions/#{@login}.json"),
       :client_auth => m,
       :format => :json
     return JSON.parse(last_response.body)
@@ -39,7 +39,7 @@ class SrpTest < RackTest
 
   def register_user(login = "integration_test", password = 'srp, verify me!', invite_code = @testcode.invite_code)
     cleanup_user(login)
-    post 'http://api.lvh.me:3000/1/users.json',
+    post api_url('users.json'),
       user_params(login: login, password: password, invite_code: invite_code)
     assert(@user = User.find_by_login(login), 'user should have been created: %s' % last_response_errors)
     @login = login
@@ -47,7 +47,7 @@ class SrpTest < RackTest
   end
 
   def update_user(params)
-    put "http://api.lvh.me:3000/1/users/" + @user.id + '.json',
+    put api_url("users/#{@user.id}.json"),
       user_params(params),
       auth_headers
   end
@@ -68,7 +68,7 @@ class SrpTest < RackTest
   end
 
   def logout(params=nil, headers=nil)
-    delete "http://api.lvh.me:3000/1/logout.json",
+    delete api_url("logout.json"),
       params || {format: :json},
       headers || auth_headers
   end
@@ -112,4 +112,12 @@ class SrpTest < RackTest
   rescue
     ""
   end
+
+  def api_url(path)
+    "http://api.lvh.me:3000/#{api_version}/#{path}"
+  end
+
+  def api_version
+    2
+  end
 end
diff --git a/test/integration/api/token_auth_test.rb b/test/integration/api/token_auth_test.rb
index 3b83f23..7b20b00 100644
--- a/test/integration/api/token_auth_test.rb
+++ b/test/integration/api/token_auth_test.rb
@@ -1,4 +1,4 @@
-require_relative '../../test_helper'
+require 'test_helper'
 require_relative 'srp_test'
 
 class TokenAuthTest < SrpTest
diff --git a/test/integration/api/update_account_test.rb b/test/integration/api/update_account_test.rb
index 16bbb8c..1492006 100644
--- a/test/integration/api/update_account_test.rb
+++ b/test/integration/api/update_account_test.rb
@@ -14,7 +14,7 @@ class UpdateAccountTest < SrpTest
 
   test "require token" do
     authenticate
-    put "http://api.lvh.me:3000/1/users/" + @user.id + '.json',
+    put "http://api.lvh.me:3000/2/users/" + @user.id + '.json',
       user_params(password: "No! Verify me instead.")
     assert_login_required
   end
diff --git a/test/integration/browser/account_livecycle_test.rb.orig b/test/integration/browser/account_livecycle_test.rb.orig
new file mode 100644
index 0000000..d1f800b
--- /dev/null
+++ b/test/integration/browser/account_livecycle_test.rb.orig
@@ -0,0 +1,153 @@
+require 'test_helper'
+
+class AccountLivecycleTest < BrowserIntegrationTest
+
+  teardown do
+    Identity.destroy_all_orphaned
+  end
+
+  test "signup successfully when invited" do
+    username, password = submit_signup
+    assert page.has_content?("Welcome #{username}")
+    click_on 'Log Out'
+    assert page.has_content?("Log In")
+    assert_equal '/', current_path
+    assert user = User.find_by_login(username)
+    user.account.destroy
+  end
+
+  test "signup successfully without invitation" do
+    with_config invite_required: false do
+
+      username ||= "test_#{SecureRandom.urlsafe_base64}".downcase
+      password ||= SecureRandom.base64
+
+      visit '/users/new'
+      fill_in 'Username', with: username
+      fill_in 'Password', with: password
+      fill_in 'Password confirmation', with: password
+      click_on 'Sign Up'
+
+      assert page.has_content?("Welcome #{username}")
+    end
+  end
+
+  test "signup with username ending in dot json" do
+    username = Faker::Internet.user_name + '.json'
+    submit_signup username
+    assert page.has_content?("Welcome #{username}")
+  end
+
+  test "signup with reserved username" do
+    username = 'certmaster'
+    submit_signup username
+    assert page.has_content?("is reserved.")
+  end
+
+  test "successful login" do
+    username, password = submit_signup
+    click_on 'Log Out'
+    attempt_login(username, password)
+    assert page.has_content?("Welcome #{username}")
+    within('.sidenav li.active') do
+      assert page.has_content?("Overview")
+    end
+    User.find_by_login(username).account.destroy
+  end
+
+  test "failed login" do
+    visit '/'
+    attempt_login("username", "wrong password")
+    assert_invalid_login(page)
+  end
+
+  test "account destruction" do
+    username, password = submit_signup
+
+    click_on I18n.t('account_settings')
+    click_on I18n.t('destroy_my_account')
+    assert page.has_content?(I18n.t('account_destroyed'))
+    assert_equal 1, Identity.by_address.key("#{username}@test.me").count
+    attempt_login(username, password)
+    assert_invalid_login(page)
+  end
+
+  test "handle blocked after account destruction" do
+    username, password = submit_signup
+    click_on I18n.t('account_settings')
+    click_on I18n.t('destroy_my_account')
+    submit_signup(username)
+    assert page.has_content?('has already been taken')
+  end
+
+  test "change pgp key" do
+    with_config user_actions: ['change_pgp_key'] do
+      pgp_key = FactoryGirl.build :pgp_key
+      login
+      click_on "Account Settings"
+      within('#update_pgp_key') do
+        fill_in 'Public key', with: pgp_key
+        click_on 'Save'
+      end
+      page.assert_selector 'input[value="Saving..."]'
+      # at some point we're done:
+      page.assert_no_selector 'input[value="Saving..."]'
+      assert page.has_field? 'Public key', with: pgp_key.to_s
+      @user.reload
+      assert_equal pgp_key, @user.public_key
+    end
+  end
+
+<<<<<<< HEAD:test/integration/browser/account_livecycle_test.rb
+=======
+
+  # trying to seed an invalid A for srp login
+  test "detects attempt to circumvent SRP" do
+    InviteCodeValidator.any_instance.stubs(:validate)
+
+    user = FactoryGirl.create :user
+    visit '/login'
+    fill_in 'Username', with: user.login
+    fill_in 'Password', with: "password"
+    inject_malicious_js
+    click_on 'Log In'
+    assert page.has_content?("Invalid random key")
+    assert page.has_no_content?("Welcome")
+    user.destroy
+  end
+
+  test "reports internal server errors" do
+    Api::UsersController.any_instance.stubs(:create).raises
+    submit_signup
+    assert page.has_content?("server failed")
+  end
+
+  test "does not render signup form without js" do
+    Capybara.current_driver = :rack_test # no js
+    visit '/signup'
+    assert page.has_no_content?("Username")
+    assert page.has_no_content?("Password")
+  end
+
+  test "does not render login form without js" do
+    Capybara.current_driver = :rack_test # no js
+    visit '/login'
+    assert page.has_no_content?("Username")
+    assert page.has_no_content?("Password")
+  end
+
+>>>>>>> api: allow version bumping - bump to 2:test/integration/browser/account_test.rb
+  def attempt_login(username, password)
+    click_on 'Log In'
+    fill_in 'Username', with: username
+    fill_in 'Password', with: password
+    click_on 'Log In'
+  end
+
+  def assert_invalid_login(page)
+    assert page.has_selector? '.btn-primary.disabled'
+    assert page.has_content? I18n.t(:invalid_user_pass)
+    assert page.has_no_selector? '.btn-primary.disabled'
+  end
+
+end
diff --git a/test/integration/browser/security_test.rb b/test/integration/browser/security_test.rb
index c13acd8..825d50b 100644
--- a/test/integration/browser/security_test.rb
+++ b/test/integration/browser/security_test.rb
@@ -22,7 +22,7 @@ class SecurityTest < BrowserIntegrationTest
   end
 
   test "reports internal server errors" do
-    V1::UsersController.any_instance.stubs(:create).raises
+    Api::UsersController.any_instance.stubs(:create).raises
     submit_signup
     assert page.has_content?("server failed")
   end
-- 
cgit v1.2.3


From f20ecdfb249128ba79da069407dce32f6f7e2fca Mon Sep 17 00:00:00 2001
From: Azul <azul@riseup.net>
Date: Fri, 20 May 2016 11:47:38 +0200
Subject: include engine tests in default test

---
 test/integration/navigation_test.rb | 9 ---------
 1 file changed, 9 deletions(-)
 delete mode 100644 test/integration/navigation_test.rb

(limited to 'test/integration')

diff --git a/test/integration/navigation_test.rb b/test/integration/navigation_test.rb
deleted file mode 100644
index eec8c0e..0000000
--- a/test/integration/navigation_test.rb
+++ /dev/null
@@ -1,9 +0,0 @@
-require 'test_helper'
-
-class NavigationTest < ActionDispatch::IntegrationTest
-
-  # test "the truth" do
-  #   assert true
-  # end
-end
-
-- 
cgit v1.2.3


From da00a2068ae8b6129384f06baafdc039bdaab003 Mon Sep 17 00:00:00 2001
From: Azul <azul@riseup.net>
Date: Sat, 21 May 2016 06:48:31 +0200
Subject: tests: reset I18n.locale after locale_path_test

Otherwise this will mess up other tests.
---
 test/integration/locale_path_test.rb | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

(limited to 'test/integration')

diff --git a/test/integration/locale_path_test.rb b/test/integration/locale_path_test.rb
index 738e7f5..22293dc 100644
--- a/test/integration/locale_path_test.rb
+++ b/test/integration/locale_path_test.rb
@@ -21,6 +21,11 @@ require 'test_helper'
 #
 
 class LocalePathTest < ActionDispatch::IntegrationTest
+
+  teardown do
+    I18n.locale = 'en'
+  end
+
   test "redirect if accept-language is not default locale" do
     get_via_redirect '/', {}, 'HTTP_ACCEPT_LANGUAGE' => 'de'
     assert_equal '/de', path
@@ -55,4 +60,4 @@ class LocalePathTest < ActionDispatch::IntegrationTest
     @controller.send(:default_url_options)
   end
 
-end
\ No newline at end of file
+end
-- 
cgit v1.2.3


From f47fc9d6522886cf81cfea26ec1f396219c539ba Mon Sep 17 00:00:00 2001
From: Azul <azul@riseup.net>
Date: Mon, 23 May 2016 12:17:31 +0200
Subject: move signup from users to account_controller

There was a lot of special case handling going on in the users_controller
for this. Lot simpler this way.
---
 test/integration/browser/account_livecycle_test.rb   | 2 +-
 test/integration/browser/password_validation_test.rb | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

(limited to 'test/integration')

diff --git a/test/integration/browser/account_livecycle_test.rb b/test/integration/browser/account_livecycle_test.rb
index 604f456..85dbf13 100644
--- a/test/integration/browser/account_livecycle_test.rb
+++ b/test/integration/browser/account_livecycle_test.rb
@@ -22,7 +22,7 @@ class AccountLivecycleTest < BrowserIntegrationTest
       username ||= "test_#{SecureRandom.urlsafe_base64}".downcase
       password ||= SecureRandom.base64
 
-      visit '/users/new'
+      visit '/signup'
       fill_in 'Username', with: username
       fill_in 'Password', with: password
       fill_in 'Password confirmation', with: password
diff --git a/test/integration/browser/password_validation_test.rb b/test/integration/browser/password_validation_test.rb
index 45eb0bf..51fcc5d 100644
--- a/test/integration/browser/password_validation_test.rb
+++ b/test/integration/browser/password_validation_test.rb
@@ -5,26 +5,26 @@ class PasswordValidationTest < BrowserIntegrationTest
   test "password confirmation is validated" do
     username ||= "test_#{SecureRandom.urlsafe_base64}".downcase
     password ||= SecureRandom.base64
-    visit '/users/new'
+    visit '/signup'
     fill_in 'Username', with: username
     fill_in 'Password', with: password
     fill_in 'Password confirmation', with: password + "-typo"
     click_on 'Sign Up'
     assert page.has_content? "does not match."
-    assert_equal '/users/new', current_path
+    assert_equal '/signup', current_path
     assert page.has_selector? ".error #srp_password_confirmation"
   end
 
   test "password needs to be at least 8 chars long" do
     username ||= "test_#{SecureRandom.urlsafe_base64}".downcase
     password ||= SecureRandom.base64[0,7]
-    visit '/users/new'
+    visit '/signup'
     fill_in 'Username', with: username
     fill_in 'Password', with: password
     fill_in 'Password confirmation', with: password
     click_on 'Sign Up'
     assert page.has_content? "needs to be at least 8 characters long"
-    assert_equal '/users/new', current_path
+    assert_equal '/signup', current_path
     assert page.has_selector? ".error #srp_password"
   end
 end
-- 
cgit v1.2.3


From e2f19bcfb6dbce77746c2d61715340525b29a592 Mon Sep 17 00:00:00 2001
From: NavaL <ayoyo@thoughtworks.com>
Date: Wed, 22 Jun 2016 19:17:15 +0200
Subject: [feature] expose is_admin in the user api

So that whoever consumes the API can use this attribute to
determine if admin functionalities should be made available to
the current user.
---
 test/integration/api/signup_test.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'test/integration')

diff --git a/test/integration/api/signup_test.rb b/test/integration/api/signup_test.rb
index 7216496..05a0abe 100644
--- a/test/integration/api/signup_test.rb
+++ b/test/integration/api/signup_test.rb
@@ -8,7 +8,7 @@ class SignupTest < SrpTest
   end
 
   test "signup response" do
-    assert_json_response :login => @login, :ok => true, :id => @user.id, :enabled => true
+    assert_json_response :login => @login, :ok => true, :is_admin => false, :id => @user.id, :enabled => true
     assert last_response.successful?
   end
 
-- 
cgit v1.2.3


From ab1917c5fe0f03e7719863a5598ad575d9fef302 Mon Sep 17 00:00:00 2001
From: NavaL <ayoyo@thoughtworks.com>
Date: Thu, 14 Jul 2016 15:06:20 +0200
Subject: [feature] restrict is_admin in the user api, to only allow querying
 for him/herself

So that it we do not expose the is_admin property to anyone else
including other admins.
---
 test/integration/api/signup_test.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'test/integration')

diff --git a/test/integration/api/signup_test.rb b/test/integration/api/signup_test.rb
index 2e515c1..dc24420 100644
--- a/test/integration/api/signup_test.rb
+++ b/test/integration/api/signup_test.rb
@@ -8,7 +8,7 @@ class SignupTest < SrpTest
   end
 
   test "signup response" do
-    assert_json_response :login => @login, :ok => true, :is_admin => false, :id => @user.id, :enabled => true
+    assert_json_response :login => @login, :ok => true, :id => @user.id, :enabled => true
     assert last_response.successful?
   end
 
-- 
cgit v1.2.3


From fbad882075e745ab7afbe5f89c67544fb3c607c3 Mon Sep 17 00:00:00 2001
From: Azul <azul@riseup.net>
Date: Thu, 18 Aug 2016 11:00:16 +0200
Subject: respond_to on a per controller basis

If you inherit respond to and call it again in your controller
it will not overwrite the previous but add to it.

Since we always have some exceptions from the rules it's probably
easiest to be explicit in the controllers that require it themselves.
---
 test/integration/api/smtp_cert_test.rb | 12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

(limited to 'test/integration')

diff --git a/test/integration/api/smtp_cert_test.rb b/test/integration/api/smtp_cert_test.rb
index 53382c1..3adddfd 100644
--- a/test/integration/api/smtp_cert_test.rb
+++ b/test/integration/api/smtp_cert_test.rb
@@ -3,13 +3,8 @@ require 'openssl'
 
 class SmtpCertTest < ApiIntegrationTest
 
-  setup do
-    @testcode = InviteCode.new
-    @testcode.save!
-  end
-
   test "retrieve smtp cert" do
-    @user = FactoryGirl.create :user, effective_service_level_code: 2, :invite_code => @testcode.invite_code
+    @user = create_invited_user effective_service_level_code: 2
     login
     post smtp_cert_url, {}, RACK_ENV
     assert_text_response
@@ -20,7 +15,7 @@ class SmtpCertTest < ApiIntegrationTest
   end
 
   test "cert and key" do
-    @user = FactoryGirl.create :user, effective_service_level_code: 2, :invite_code => @testcode.invite_code
+    @user = create_invited_user effective_service_level_code: 2
     login
     post smtp_cert_url, {}, RACK_ENV
     assert_text_response
@@ -32,7 +27,7 @@ class SmtpCertTest < ApiIntegrationTest
   end
 
   test "fingerprint is stored with identity" do
-    @user = FactoryGirl.create :user, effective_service_level_code: 2, :invite_code => @testcode.invite_code
+    @user = create_invited_user effective_service_level_code: 2
     login
     post smtp_cert_url, {}, RACK_ENV
     assert_text_response
@@ -46,7 +41,6 @@ class SmtpCertTest < ApiIntegrationTest
   end
 
   test "fetching smtp certs requires email account" do
-
     login
     post smtp_cert_url, {}, RACK_ENV
     assert_access_denied
-- 
cgit v1.2.3