Finished phase005

spec/requests/sessions_spec.rb

@@ -0,0 +1,79 @@
+require "rails_helper"
+
+RSpec.describe "Sessions" do
+  describe "GET /identify" do
+    it "renders the identification page" do
+      get identify_path
+
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to include("Identify yourself")
+    end
+  end
+
+  describe "POST /identify" do
+    it "identifies a new user with the current access key" do
+      access_key = AccessKey.current
+
+      expect do
+        post session_path, params: { name: "Driver One", email: "DRIVER@example.com", key: access_key.raw_key }
+      end.to change(User, :count).by(1).and change(UserSession, :count).by(1)
+
+      expect(response).to redirect_to(vehicles_path)
+      expect(User.last.email).to eq("driver@example.com")
+    end
+
+    it "identifies an existing user when the name matches" do
+      access_key = AccessKey.current
+      user = create(:user, name: "Driver One", email: "driver@example.com")
+
+      expect do
+        post session_path, params: { name: "Driver One", email: "driver@example.com", key: access_key.raw_key }
+      end.to change(UserSession, :count).by(1).and change(User, :count).by(0)
+
+      expect(response).to redirect_to(vehicles_path)
+      expect(UserSession.last.user).to eq(user)
+    end
+
+    it "rejects an existing email when the name does not match" do
+      access_key = AccessKey.current
+      create(:user, name: "Driver One", email: "driver@example.com")
+
+      expect do
+        post session_path, params: { name: "Driver Two", email: "driver@example.com", key: access_key.raw_key }
+      end.not_to change(UserSession, :count)
+
+      expect(response).to have_http_status(:unprocessable_content)
+      expect(response.body).to include("name does not match")
+    end
+
+    it "rejects invalid access keys and logs the attempt" do
+      AccessKey.current
+      allow(Rails.logger).to receive(:warn)
+
+      expect do
+        post session_path, params: { name: "Driver One", email: "driver@example.com", key: "wrong-key" }
+      end.not_to change(UserSession, :count)
+
+      expect(response).to have_http_status(:unprocessable_content)
+      expect(response.body).to include("access key is not valid")
+      expect(Rails.logger).to have_received(:warn).with(/Invalid access key identification attempt/)
+    end
+  end
+
+  describe "DELETE /session" do
+    it "logs the user out" do
+      identify_user
+
+      expect do
+        delete logout_path
+      end.to change(UserSession, :count).by(-1)
+
+      expect(response).to redirect_to(identify_path)
+    end
+  end
+
+  def identify_user(user = create(:user))
+    access_key = AccessKey.current
+    post session_path, params: { name: user.name, email: user.email, key: access_key.raw_key }
+  end
+end