Contents

require 'spec_helper'

describe SorceryController do

  let(:user) { double('user', id: 42, email: '[e-mail]') }

  def request_test_login
    get :test_login, email: '[e-mail]', password: 'blabla'
  end

  # ----------------- SESSION TIMEOUT -----------------------
  describe "brute force protection features" do

    before(:all) do
      sorcery_reload!([:brute_force_protection])
    end

    after(:each) do
      Sorcery::Controller::Config.reset!
      sorcery_controller_property_set(:user_class, User)
      Timecop.return
    end

    it "counts login retries" do
      allow(User).to receive(:authenticate)
      allow(User.sorcery_adapter).to receive(:find_by_credentials).with(['[e-mail]', 'blabla']).and_return(user)

      expect(user).to receive(:register_failed_login!).exactly(3).times

      3.times { request_test_login }
    end

    it "resets the counter on a good login" do
      # dirty hack for rails 4
      allow(@controller).to receive(:register_last_activity_time_to_db)

      allow(User).to receive(:authenticate).and_return(user)
      expect(user).to receive_message_chain(:sorcery_adapter, :update_attribute).with(:failed_logins_count, 0)

      get :test_login, email: '[e-mail]', password: 'secret'
    end
  end
end

Version data entries

4 entries across 4 versions & 3 rubygems

Version	Path
sorcery-0.9.1	spec/controllers/controller_brute_force_protection_spec.rb
sorcery-0.9.0	spec/controllers/controller_brute_force_protection_spec.rb
cbsorcery-0.8.6	spec/controllers/controller_brute_force_protection_spec.rb
cb-sorcery-0.8.6	spec/controllers/controller_brute_force_protection_spec.rb