When testing how users log in and what they can do in a Ruby on Rails app, it’s super important to make sure your app is safe. Let’s go through the basics of testing these important features.

1. Set Up Your Test Environment

First, make sure you have RSpec or Minitest ready in your Rails application. These tools help you create and run your tests easily.

2. Testing Authentication

Authentication is about proving who a user is. To check this, you can write tests that try to log in with correct and incorrect information. Here’s a simple example using RSpec:

describe 'User Login' do
  it 'lets a user log in with the right details' do
    user = User.create(username: 'testuser', password: 'password123')
    post '/login', params: { username: 'testuser', password: 'password123' }
    expect(response).to redirect_to(home_path)
  end

  it 'stops login with the wrong details' do
    post '/login', params: { username: 'testuser', password: 'wrongpassword' }
    expect(flash[:alert]).to eq('Invalid credentials')
  end
end

3. Testing Authorization

Authorization is about what a logged-in user can do. You can test this by checking if users can see the right pages. For example:

describe 'Admin Access' do
  it 'lets admin users go to the admin dashboard' do
    admin = User.create(username: 'admin', role: 'admin')
    sign_in(admin)
    get '/admin'
    expect(response).to have_http_status(:success)
  end

  it 'blocks regular users from entering the admin dashboard' do
    user = User.create(username: 'regularuser', role: 'user')
    sign_in(user)
    get '/admin'
    expect(response).to have_http_status(:forbidden)
  end
end

4. Conclusion

By setting up your tests for both authentication and authorization, you can be sure that your Rails app works properly for different users. This keeps your app safe and running smoothly. Happy testing!