Unable to sign_in in CrudTestModelsController specs

[mberlanda]

I would like firsty to congratulate for the great job.

I am having some hard time to get the default tests to pass.

In my Gemfile I have:

gem 'rails', '~> 5.0.2'
gem 'devise', '~> 4.3'
gem 'rspec-rails', '~> 3.6.0'

ruby '2.4.0'

Requiring Support Files

The first issue I faced to pass the gem auto-generated test was to require automatically all files in support folder by adding to spec/rails_helper.rb

Dir[File.expand_path('../support/*.rb', __FILE__)].each {|file| require file }

Authenticate in Controllers specs

Since I am using Devise gem for authentication, the most of controller's specs fail due to authentication issues. My initial setup was:

# spec/support/devise.rb
RSpec.configure do |config|
  config.include Devise::Test::ControllerHelpers, type: :controller
end

I firstly tried the usual behavior of Rspec and Devise:

# spec/controllers/crud_test_models_controller_spec.rb
describe CrudTestModelsController do
  before(:all) do
    reset_db
    setup_db
    create_test_data

    user = FactoryGirl.create(:user)
    sign_in user
  end

But it seems that crud_test_models_controller_spec.rb is acting like an integration test - such as Capybara tests - so I encountered the following issue:

   NoMethodError:
     undefined method `env' for nil:NilClass 

So I have added the @request.env as follows

# spec/controllers/crud_test_models_controller_spec.rb

  before(:all) do
    #...
    @request.env["devise.mapping"] = Devise.mappings[:user]
    @user = FactoryGirl.create(:user)
    sign_in @user
  end

       Failure/Error: @request.env["devise.mapping"] = Devise.mappings[:user]
       
       NoMethodError:
         undefined method `env' for nil:NilClass
       # ./spec/controllers/crud_test_models_controller_spec.rb:17:in `block (2 levels) in <top (required)>'

Based on this StackOverflow answer, I have changed my test as follows:

# spec/controllers/crud_test_models_controller_spec.rb
describe CrudTestModelsController, type: :controller do
  include CrudTestHelper
  include Devise::Test::IntegrationHelpers

  before(:all) do
    reset_db
    setup_db
    create_test_data

    @user = FactoryGirl.create(:user)
    sign_in @user
  end

From the test output I have attached, it seems that it is not logging in properly.
crud_test_models_controller_spec.pdf
I tried then to implement the login_as authentication using include Warden::Test::Helpers without different results.

I also tried to downgrade devise gem to 4.1 for a different testhelper suite, but still the same issue.

This is the repository where I am trying to integrate dry_crud: https://github.com/mberlanda/cheidelacoriera

Do you have any idea of I could I make it work properly?

Thanks

[mberlanda]

I have created a separated branch to reporduce the issue:
https://github.com/mberlanda/cheidelacoriera/tree/dry_crud

[mberlanda]

In order to run these test correctly, I disabled the authentication for the abstract controller CrudController and I am including it in each and every sub-controller:

class CrudController < ListController
  skip_before_action :authenticate_user!
  #...
end

I noticed that brakeman warns about this security issue generated by the scaffolding:

+----------------------+-------+
| Warning Type         | Total |
+----------------------+-------+
| Cross Site Scripting | 1     |
+----------------------+-------+


View Warnings:

+------------+-----------------------------------------------+----------------------+------------------------------------------------------------------------+
| Confidence | Template                                      | Warning Type         | Message                                                                |
+------------+-----------------------------------------------+----------------------+------------------------------------------------------------------------+
| Weak       | layouts/_flash (Template:layouts/application) | Cross Site Scripting | Unescaped model attribute near line 2: flash[+(Unresolved Model).new+] |
+------------+-----------------------------------------------+----------------------+------------------------------------------------------------------------+