BUG Fixing logout issues with steps

[halkyon]

Firstly, stepIAmNotLoggedIn() would previously just kill the test
session, but this has the side effect of losing the current testsession
temporary database, so this causes steps of logging out to fail the
rest of the steps in a scenario.

Secondly, if we're logging a user in with stepILogInWith(), make
sure they are logged out first, otherwise "You don't have permission"
message will appear, but there is no form elements available to log
in with in this case. Logging out first by visiting Security/login
fixes this.

[srizzling]

I had this in working as well. :) except I defined it as I will be logged out of the CMS instead because the test is to specific to the CMS and will probably cause lingering issues later if different users are required to log in and out of a website

[halkyon]

@srizzling When you log out there's no difference between logging out of the CMS and the website, everything goes through Security/login or Security/logout. Could you explain what you mean (and what you did) by logging out of the CMS instead of website?

[srizzling]

So, if I created a website which provided a service where users login it would still go through Security/login?

[halkyon]

@srizzling Yes. So if you had a "frontend" members page, users would go through Security/login. Likewise, logging into /admin takes the user to Security/login where they login and are redirected back to /admin.

[srizzling]

Ah, my bad. Maybe, we could extract that string and put it in context class similar to how $c->getLoginUrl() works?

[halkyon]

@srizzling Could do, although Security class currently has no set_logout_url() functionality to match set_login_url() at the moment, so it wouldn't really make much sense to have getLogoutUrl() and setLogoutUrl() in Behat until that's been implemented.

[chillu]

I've pushed the setIAmNotLoggedIn() bit with 8141ced.
Requesting Security/logout every time the login step is executed will cause too much overheads, its a step for pretty much every CMS scenario. For now I've added a "Given I am not logged in" above the case where it relies on being logged out. Improvement suggestion: Check for existence of the login form in that step, and redirect to Security/logout only when required.