require 'rails_helper'

RSpec.describe 'Password reset', type: :feature do
  let(:user) { create :user }

  before do
    login_as user, :scope => :user
  end

  scenario 'Send password reset email' do
    expect(user.reset_password_token).to be_nil

    visit settings_account_path
    click_button "Send me a password reset link"
    expect(page).to have_content 'Please check your inbox'
    expect(user.reload.reset_password_token).to be_a(String)
  end

  describe "Password reset form" do
    # Generate a raw reset token, since the stored one is only a digest
    let(:token) { user.send(:set_reset_password_token) }

    before do
      logout
    end

    scenario "Submit with invalid passwords" do
      expect(Devise::LDAP::Adapter).not_to receive(:update_password)

      visit edit_user_password_path(reset_password_token: token)
      fill_in :user_password, with: 'nice try'
      fill_in :user_password_confirmation, with: 'nice try o'
      click_button 'Change my password'
      expect(page).to have_content 'Password is too short'

      fill_in :user_password, with: 'a new password'
      fill_in :user_password_confirmation, with: 'a new password with a typo'
      click_button 'Change my password'
      expect(page).to have_content 'Password confirmation doesn\'t match'
    end

    scenario "Submit with valid passwords" do
      expect(Devise::LDAP::Adapter).to receive(:update_password)
        .with(user.cn, 'catch me if you can').and_return(true)

      visit edit_user_password_path(reset_password_token: token)
      fill_in :user_password, with: 'catch me if you can'
      fill_in :user_password_confirmation, with: 'catch me if you can'
      click_button 'Change my password'
      expect(page).to have_content 'Your password has been changed successfully'
      expect(user.reload.reset_password_token).to be_nil
    end

    scenario "Ignores a stale return location left by an rs/oauth request" do
      expect(Devise::LDAP::Adapter).to receive(:update_password)
        .with(user.cn, 'catch me if you can').and_return(true)

      # Simulate an earlier rs/oauth authorization request that stored a
      # return URL in the session (the original cause of issue #235).
      visit new_rs_oauth_path(user.cn,
                              redirect_uri: "https://example.com",
                              client_id: "https://example.com",
                              scope: "documents")

      visit edit_user_password_path(reset_password_token: token)
      fill_in :user_password, with: 'catch me if you can'
      fill_in :user_password_confirmation, with: 'catch me if you can'
      click_button 'Change my password'

      expect(page).to have_content 'Your password has been changed successfully'
      expect(page).to have_current_path(root_path)
      expect(page).not_to have_content 'Bad request'
    end
  end
end