I wrote yesterday that I was trying to simulate the OpenID website talking in my integration tests. This evening I sat down and attempted to do it better as I wasn't happy with the tests still doing some OpenID related work. I'm pleased to say that I actually got it working. I had tried this approach before but it didn't actually work, but that was because I was doing it in the wrong place. I stuck this in my test_helper.rb file:
require 'session_controller'
class SessionController
def create
redirect_to home_path
end
def complete
@user = User.get($mockuser.openid_url)
if @user.nil?
@user = User.new(:email => $mockuser.email,
:nickname => $mockuser.nickname,
:gender => $mockuser.gender)
@user.openid_url = $mockuser.openid_url
@user.save
session[:return_to] = edit_user_path
end
@user.last_login = Time.now
@user.save
session[:user_id] = @user.id
redirect_back_or_default(dashboard_path)
end
end
What this does is reopens the
SessionController class (the controller that handles the login) and overrides the two methods
create and
complete so that they run different code to the original methods in the
SessionController class.
The
create method just performs a redirect as the OpenID code would redirect the user to the OpenID website at this point. The
complete method is a bit more complicated as it first checks if the user exists, if not then it creates a new user object, saves it, then stores the users profile page, after that it updates the last login time, saves the user to update it, stores the users id, and finally performs the redirect.
To glue all this together I just have to set
$mockuser from within my actual test. For example
def login
$mockuser = user
get 'login'
assert_response :success
post 'session', :openid_url => user.openid_url
assert_response :redirect
get 'session/complete'
assert_response :redirect
assert_redirected_to dashboard_path
assert_equal user.id, session[:user_id]
end
which logs in an existing user (I have a different method for logging in a new user as I haven't attempted to combine the methods yet - although I just thought of a good way of doing it!).
This makes all the tests pass plus it doesn't involve any OpenID related code. You might say "well, your tests always assume that the user can login! you don't test for invalid users trying to login". My reply to that is that the OpenID website handles all the checking to see if you are who you say you are. If you are you then the OpenID website redirects back to my website telling me this. If you are not who you say you are then the OpenID website redirects back to my website and tells me that also. Users are only logged in (and created if they're a new user) if the OpenID website tells me that you're real. If it says otherwise then you're redirected back to the login page which displays an appropiate message. I trust that the OpenID code works fine in that regard and that it would never lie about a user being real when they're not, so that's why I'm not too bothered about it.
