From be314e39164d361d214df37dd588dbf53e10f249 Mon Sep 17 00:00:00 2001
From: Claudio Ortolina <cloud8421@gmail.com>
Date: Mon, 21 Oct 2024 09:59:29 +0100
Subject: [PATCH] Reset session when hitting /login

---
 .../controllers/session_controller.ex         |  4 +-
 .../controllers/session_controller_test.exs   | 60 +++++++++++++++++++
 test/support/conn_case.ex                     | 10 +++-
 3 files changed, 71 insertions(+), 3 deletions(-)
 create mode 100644 test/music_library_web/controllers/session_controller_test.exs

diff --git a/lib/music_library_web/controllers/session_controller.ex b/lib/music_library_web/controllers/session_controller.ex
index 993967b0..fd62a6f1 100644
--- a/lib/music_library_web/controllers/session_controller.ex
+++ b/lib/music_library_web/controllers/session_controller.ex
@@ -4,7 +4,9 @@ defmodule MusicLibraryWeb.SessionController do
   @empty_form %{"password" => ""}
 
   def new(conn, _params) do
-    conn |> render(:new, form: @empty_form, layout: {MusicLibraryWeb.Layouts, "unauthenticated"})
+    conn
+    |> delete_session(:logged_in)
+    |> render(:new, form: @empty_form, layout: {MusicLibraryWeb.Layouts, "unauthenticated"})
   end
 
   def create(conn, %{"password" => request_password}) do
diff --git a/test/music_library_web/controllers/session_controller_test.exs b/test/music_library_web/controllers/session_controller_test.exs
new file mode 100644
index 00000000..fcae3def
--- /dev/null
+++ b/test/music_library_web/controllers/session_controller_test.exs
@@ -0,0 +1,60 @@
+defmodule MusicLibraryWeb.SessionControllerTest do
+  use MusicLibraryWeb.ConnCase
+
+  describe "GET /login" do
+    @tag :logged_out
+    test "it shows the login form", %{conn: conn} do
+      conn = get(conn, "/login")
+
+      response = html_response(conn, 200)
+      assert response =~ "Welcome to your Music Library"
+      assert response =~ "Password"
+      assert response =~ "Sign in"
+    end
+
+    test "it resets the session", %{conn: conn} do
+      conn = get(conn, "/login")
+
+      session = get_session(conn)
+
+      refute session["logged_in"]
+    end
+  end
+
+  describe "POST /sessions/create" do
+    @tag :logged_out
+    test "it refuses an invalid password", %{conn: conn} do
+      conn = post(conn, ~p"/sessions/create", %{"password" => "wrong password"})
+
+      {"location", location} =
+        conn.resp_headers
+        |> List.keyfind("location", 0)
+
+      session = get_session(conn)
+
+      assert conn.status == 302
+      assert location == "/login"
+      assert conn.assigns.flash == %{"error" => "Invalid password"}
+      refute session["logged_in"]
+    end
+
+    test "it accepts a valid password", %{conn: conn} do
+      valid_password =
+        Application.get_env(:music_library, MusicLibraryWeb)
+        |> Keyword.fetch!(:auth_password)
+
+      conn = post(conn, ~p"/sessions/create", %{"password" => valid_password})
+
+      session = get_session(conn)
+
+      {"location", location} =
+        conn.resp_headers
+        |> List.keyfind("location", 0)
+
+      assert conn.status == 302
+      assert location == "/"
+      assert conn.assigns.flash == %{}
+      assert session["logged_in"]
+    end
+  end
+end
diff --git a/test/support/conn_case.ex b/test/support/conn_case.ex
index 0ffbd526..00e29f5b 100644
--- a/test/support/conn_case.ex
+++ b/test/support/conn_case.ex
@@ -34,9 +34,15 @@ defmodule MusicLibraryWeb.ConnCase do
   setup tags do
     MusicLibrary.DataCase.setup_sandbox(tags)
 
+    # The majority of functionality assumes a logged in user,
+    # so we default to that.
     conn =
-      Phoenix.ConnTest.build_conn()
-      |> Phoenix.ConnTest.init_test_session(%{logged_in: true})
+      if tags[:logged_out] do
+        Phoenix.ConnTest.build_conn()
+      else
+        Phoenix.ConnTest.build_conn()
+        |> Phoenix.ConnTest.init_test_session(%{logged_in: true})
+      end
 
     {:ok, conn: conn}
   end