Sucessfully running Behat scenarios for OAuth sign-in

[headrevision]

As mentioned in Sylius#354 (comment), the Behat scenarios for testing the OAuth sign-in are to complex/insecure so far. Thus I simply removed the critical ones. I kept only one scenario to test at least the reachability of the resource owner's login page from Sylius. You only need to specify an actual client ID + secret for Login with Amazon (configured with http://localhost/login/check-amazon as an allowed return URL) when installing via composer.

The use of Amazon serves as a PoC here. We should substitute it with another resource owner and include pre-configured credentials (client ID + secret) in parameters.yml.dist. Twitter configured with the Sylius Twitter account? Any other suggestions?

[pjedrzejewski]

Why? I was about to try saucelabs again. :)

[headrevision]

It is just not necessary for the OAuth testing when using Goutte, but of course using Selenium2/SauceLabs instead is feasible as well.

[pjedrzejewski]

@headrevision This might be a dumb question, but I'm not sure I get your comment, do we need to have a fake amazon account for tests here?

[headrevision]

Yes, that is right. You need an Amazon account to setup the resource owner (Login with Amazon). The same with Twitter or any other resource owner.

[stloyd]

Hey, removal of testing the real pages is good idea, but instead of removing testing fully, I would vote to use html fixtures instead of real network calls.

1. Go at Amazon page,
2. Save the html,
3. Put it into fixtures,
4. Add step that parses that html not real page,
5. ???
6. Profit! =)

What do you think?

[headrevision]

@stloyd You cannot mock/simulate the OAuth 2.0 login process via static pages. Even if you succeeded, you would simply mock your SUT.

[stloyd]

@headrevision I know I can't simulate whole process, I and don't want =) I'm just suggesting the faking it for testing purposes with assumptions we have working & failing connect results.

Here is quick description of steps I have in mind:

Given I'm logged in as "dummy"
  And I'm at connect page
 When I click "Connect with Amazon"
 Then I see some "Amazon Connect" form
 When I connect the account
 Then My account is marked as connected

Given I'm logged in as "dummy"
  And I'm at connect page
 When I click "Connect with Amazon"
 Then I see some "Amazon Connect" form
 When I decline the connection of account
 Then My account is not marked as connected

The part below is working on fake data as well as directly on security tokens etc.:

 Then I see some "Amazon Connect" form
 When I decline the connection of account
 Then My account is not marked as connected

[headrevision]

@stloyd This way you fake all your When and Then steps (except of When I click "Connect with Amazon", which already works). Faking (instead of simulating) the user interaction that you describe with the steps makes the concept of BDD completely useless.