refactored for new project name

test/shift73k_web/controllers/user_auth_test.exs

@@ -0,0 +1,171 @@
+defmodule Shift73kWeb.UserAuthTest do
+  use Shift73kWeb.ConnCase, async: true
+
+  alias Shift73k.Accounts
+  alias Shift73kWeb.UserAuth
+  import Shift73k.AccountsFixtures
+
+  setup %{conn: conn} do
+    conn =
+      conn
+      |> Map.replace!(:secret_key_base, Shift73kWeb.Endpoint.config(:secret_key_base))
+      |> init_test_session(%{})
+
+    %{user: user_fixture(), conn: conn}
+  end
+
+  describe "log_in_user/3" do
+    test "stores the user token in the session", %{conn: conn, user: user} do
+      conn = UserAuth.log_in_user(conn, user)
+      assert token = get_session(conn, :user_token)
+      assert get_session(conn, :live_socket_id) == "users_sessions:#{Base.url_encode64(token)}"
+      assert redirected_to(conn) == "/"
+      assert Accounts.get_user_by_session_token(token)
+    end
+
+    test "clears everything previously stored in the session", %{conn: conn, user: user} do
+      conn = conn |> put_session(:to_be_removed, "value") |> UserAuth.log_in_user(user)
+      refute get_session(conn, :to_be_removed)
+    end
+
+    test "redirects to the configured path", %{conn: conn, user: user} do
+      conn = conn |> put_session(:user_return_to, "/hello") |> UserAuth.log_in_user(user)
+      assert redirected_to(conn) == "/hello"
+    end
+
+    test "writes a cookie if remember_me is configured", %{conn: conn, user: user} do
+      conn = conn |> fetch_cookies() |> UserAuth.log_in_user(user, %{"remember_me" => "true"})
+      assert get_session(conn, :user_token) == conn.cookies["user_remember_me"]
+
+      assert %{value: signed_token, max_age: max_age} = conn.resp_cookies["user_remember_me"]
+      assert signed_token != get_session(conn, :user_token)
+      assert max_age == 5_184_000
+    end
+  end
+
+  describe "logout_user/1" do
+    test "erases session and cookies", %{conn: conn, user: user} do
+      user_token = Accounts.generate_user_session_token(user)
+
+      conn =
+        conn
+        |> put_session(:user_token, user_token)
+        |> put_req_cookie("user_remember_me", user_token)
+        |> fetch_cookies()
+        |> UserAuth.log_out_user()
+
+      refute get_session(conn, :user_token)
+      refute conn.cookies["user_remember_me"]
+      assert %{max_age: 0} = conn.resp_cookies["user_remember_me"]
+      assert redirected_to(conn) == "/"
+      refute Accounts.get_user_by_session_token(user_token)
+    end
+
+    test "broadcasts to the given live_socket_id", %{conn: conn} do
+      live_socket_id = "users_sessions:abcdef-token"
+      Shift73kWeb.Endpoint.subscribe(live_socket_id)
+
+      conn
+      |> put_session(:live_socket_id, live_socket_id)
+      |> UserAuth.log_out_user()
+
+      assert_receive %Phoenix.Socket.Broadcast{
+        event: "disconnect",
+        topic: "users_sessions:abcdef-token"
+      }
+    end
+
+    test "works even if user is already logged out", %{conn: conn} do
+      conn = conn |> fetch_cookies() |> UserAuth.log_out_user()
+      refute get_session(conn, :user_token)
+      assert %{max_age: 0} = conn.resp_cookies["user_remember_me"]
+      assert redirected_to(conn) == "/"
+    end
+  end
+
+  describe "fetch_current_user/2" do
+    test "authenticates user from session", %{conn: conn, user: user} do
+      user_token = Accounts.generate_user_session_token(user)
+      conn = conn |> put_session(:user_token, user_token) |> UserAuth.fetch_current_user([])
+      assert conn.assigns.current_user.id == user.id
+    end
+
+    test "authenticates user from cookies", %{conn: conn, user: user} do
+      logged_in_conn =
+        conn |> fetch_cookies() |> UserAuth.log_in_user(user, %{"remember_me" => "true"})
+
+      user_token = logged_in_conn.cookies["user_remember_me"]
+      %{value: signed_token} = logged_in_conn.resp_cookies["user_remember_me"]
+
+      conn =
+        conn
+        |> put_req_cookie("user_remember_me", signed_token)
+        |> UserAuth.fetch_current_user([])
+
+      assert get_session(conn, :user_token) == user_token
+      assert conn.assigns.current_user.id == user.id
+    end
+
+    test "does not authenticate if data is missing", %{conn: conn, user: user} do
+      _ = Accounts.generate_user_session_token(user)
+      conn = UserAuth.fetch_current_user(conn, [])
+      refute get_session(conn, :user_token)
+      refute conn.assigns.current_user
+    end
+  end
+
+  describe "redirect_if_user_is_authenticated/2" do
+    test "redirects if user is authenticated", %{conn: conn, user: user} do
+      conn = conn |> assign(:current_user, user) |> UserAuth.redirect_if_user_is_authenticated([])
+      assert conn.halted
+      assert redirected_to(conn) == "/"
+    end
+
+    test "does not redirect if user is not authenticated", %{conn: conn} do
+      conn = UserAuth.redirect_if_user_is_authenticated(conn, [])
+      refute conn.halted
+      refute conn.status
+    end
+  end
+
+  describe "require_authenticated_user/2" do
+    test "redirects if user is not authenticated", %{conn: conn} do
+      conn = conn |> fetch_flash() |> UserAuth.require_authenticated_user([])
+      assert conn.halted
+      assert redirected_to(conn) == Routes.user_session_path(conn, :new)
+      assert get_flash(conn, :error) == "You must log in to access this page."
+    end
+
+    test "stores the path to redirect to on GET", %{conn: conn} do
+      halted_conn =
+        %{conn | request_path: "/foo", query_string: ""}
+        |> fetch_flash()
+        |> UserAuth.require_authenticated_user([])
+
+      assert halted_conn.halted
+      assert get_session(halted_conn, :user_return_to) == "/foo"
+
+      halted_conn =
+        %{conn | request_path: "/foo", query_string: "bar=baz"}
+        |> fetch_flash()
+        |> UserAuth.require_authenticated_user([])
+
+      assert halted_conn.halted
+      assert get_session(halted_conn, :user_return_to) == "/foo?bar=baz"
+
+      halted_conn =
+        %{conn | request_path: "/foo?bar", method: "POST"}
+        |> fetch_flash()
+        |> UserAuth.require_authenticated_user([])
+
+      assert halted_conn.halted
+      refute get_session(halted_conn, :user_return_to)
+    end
+
+    test "does not redirect if user is authenticated", %{conn: conn, user: user} do
+      conn = conn |> assign(:current_user, user) |> UserAuth.require_authenticated_user([])
+      refute conn.halted
+      refute conn.status
+    end
+  end
+end

test/shift73k_web/controllers/user_confirmation_controller_test.exs

@@ -0,0 +1,84 @@
+defmodule Shift73kWeb.UserConfirmationControllerTest do
+  use Shift73kWeb.ConnCase, async: true
+
+  alias Shift73k.Accounts
+  alias Shift73k.Repo
+  import Shift73k.AccountsFixtures
+
+  setup do
+    %{user: user_fixture()}
+  end
+
+  describe "GET /users/confirm" do
+    test "renders the confirmation page", %{conn: conn} do
+      conn = get(conn, Routes.user_confirmation_path(conn, :new))
+      response = html_response(conn, 200)
+      assert response =~ "Resend confirmation instructions\n  </h2>"
+    end
+  end
+
+  describe "POST /users/confirm" do
+    @tag :capture_log
+    test "sends a new confirmation token", %{conn: conn, user: user} do
+      conn =
+        post(conn, Routes.user_confirmation_path(conn, :create), %{
+          "user" => %{"email" => user.email}
+        })
+
+      assert redirected_to(conn) == "/"
+      assert get_flash(conn, :info) =~ "If your email is in our system"
+      assert Repo.get_by!(Accounts.UserToken, user_id: user.id).context == "confirm"
+    end
+
+    test "does not send confirmation token if account is confirmed", %{conn: conn, user: user} do
+      Repo.update!(Accounts.User.confirm_changeset(user))
+
+      conn =
+        post(conn, Routes.user_confirmation_path(conn, :create), %{
+          "user" => %{"email" => user.email}
+        })
+
+      assert redirected_to(conn) == "/"
+      assert get_flash(conn, :info) =~ "If your email is in our system"
+      refute Repo.get_by(Accounts.UserToken, user_id: user.id)
+    end
+
+    test "does not send confirmation token if email is invalid", %{conn: conn} do
+      conn =
+        post(conn, Routes.user_confirmation_path(conn, :create), %{
+          "user" => %{"email" => "unknown@example.com"}
+        })
+
+      assert redirected_to(conn) == "/"
+      assert get_flash(conn, :info) =~ "If your email is in our system"
+      assert Repo.all(Accounts.UserToken) == []
+    end
+  end
+
+  describe "GET /users/confirm/:token" do
+    test "confirms the given token once", %{conn: conn, user: user} do
+      token =
+        extract_user_token(fn url ->
+          Accounts.deliver_user_confirmation_instructions(user, url)
+        end)
+
+      conn = get(conn, Routes.user_confirmation_path(conn, :confirm, token))
+      assert redirected_to(conn) == "/"
+      assert get_flash(conn, :info) =~ "Account confirmed successfully"
+      assert Accounts.get_user!(user.id).confirmed_at
+      refute get_session(conn, :user_token)
+      assert Repo.all(Accounts.UserToken) == []
+
+      conn = get(conn, Routes.user_confirmation_path(conn, :confirm, token))
+      assert redirected_to(conn) == "/"
+      assert get_flash(conn, :error) =~ "Confirmation link is invalid or it has expired"
+    end
+
+    test "does not confirm email with invalid token", %{conn: conn, user: user} do
+      conn = get(conn, Routes.user_confirmation_path(conn, :confirm, "oops"))
+      assert redirected_to(conn) == "/"
+      assert get_flash(conn, :error) =~ "Confirmation link is invalid or it has expired"
+      refute Accounts.get_user!(user.id).confirmed_at
+    end
+  end
+end

test/shift73k_web/controllers/user_registration_controller_test.exs

@@ -0,0 +1,21 @@
+defmodule Shift73kWeb.UserRegistrationControllerTest do
+  use Shift73kWeb.ConnCase, async: true
+
+  import Shift73k.AccountsFixtures
+
+  describe "GET /users/register" do
+    test "renders registration page", %{conn: conn} do
+      conn = get(conn, Routes.user_registration_path(conn, :new))
+      response = html_response(conn, 200)
+      assert response =~ "Register\n  </h2>"
+      assert response =~ "Log in\n</a>"
+      assert response =~ "Register\n</a>"
+    end
+
+    test "redirects if already logged in", %{conn: conn} do
+      to = Routes.user_registration_path(conn, :new)
+      conn = conn |> log_in_user(user_fixture()) |> get(to)
+      assert redirected_to(conn) == "/"
+    end
+  end
+end

test/shift73k_web/controllers/user_reset_password_controller_test.exs

@@ -0,0 +1,84 @@
+defmodule Shift73kWeb.UserResetPasswordControllerTest do
+  use Shift73kWeb.ConnCase, async: true
+
+  alias Shift73k.Accounts
+  alias Shift73k.Repo
+  import Shift73k.AccountsFixtures
+
+  setup do
+    %{user: user_fixture()}
+  end
+
+  describe "GET /users/reset_password" do
+    test "renders the reset password page", %{conn: conn} do
+      conn = get(conn, Routes.user_reset_password_path(conn, :new))
+      response = html_response(conn, 200)
+      assert response =~ "Forgot your password?\n  </h2>"
+    end
+
+    test "redirects if already logged in", %{conn: conn} do
+      to = Routes.user_reset_password_path(conn, :new)
+      conn = conn |> log_in_user(user_fixture()) |> get(to)
+      assert redirected_to(conn) == "/"
+    end
+  end
+
+  describe "POST /users/reset_password" do
+    @tag :capture_log
+    test "sends a new reset password token", %{conn: conn, user: user} do
+      conn =
+        post(conn, Routes.user_reset_password_path(conn, :create), %{
+          "user" => %{"email" => user.email}
+        })
+
+      assert redirected_to(conn) == "/"
+      assert get_flash(conn, :info) =~ "If your email is in our system"
+      assert Repo.get_by!(Accounts.UserToken, user_id: user.id).context == "reset_password"
+    end
+
+    test "does not send reset password token if email is invalid", %{conn: conn} do
+      conn =
+        post(conn, Routes.user_reset_password_path(conn, :create), %{
+          "user" => %{"email" => "unknown@example.com"}
+        })
+
+      assert redirected_to(conn) == "/"
+      assert get_flash(conn, :info) =~ "If your email is in our system"
+      assert Repo.all(Accounts.UserToken) == []
+    end
+  end
+
+  describe "GET /users/reset_password/:token" do
+    setup %{user: user} do
+      token =
+        extract_user_token(fn url ->
+          Accounts.deliver_user_reset_password_instructions(user, url)
+        end)
+
+      %{token: token}
+    end
+
+    test "renders reset password with user_id in session", %{conn: conn, token: token, user: user} do
+      conn = get(conn, Routes.user_reset_password_path(conn, :edit, token))
+      assert get_session(conn, "user_id") == user.id
+      assert html_response(conn, 200) =~ "Reset password\n  </h2>"
+    end
+
+    test "does not render reset password with invalid token", %{conn: conn} do
+      conn = get(conn, Routes.user_reset_password_path(conn, :edit, "oops"))
+      assert redirected_to(conn) == "/"
+      assert get_flash(conn, :error) =~ "Reset password link is invalid or it has expired"
+    end
+  end
+
+  describe "PUT /users/reset_password/:token" do
+    setup %{user: user} do
+      token =
+        extract_user_token(fn url ->
+          Accounts.deliver_user_reset_password_instructions(user, url)
+        end)
+
+      %{token: token}
+    end
+  end
+end

test/shift73k_web/controllers/user_session_controller_test.exs

@@ -0,0 +1,131 @@
+defmodule Shift73kWeb.UserSessionControllerTest do
+  use Shift73kWeb.ConnCase, async: true
+
+  import Shift73k.AccountsFixtures
+
+  setup do
+    %{user: user_fixture()}
+  end
+
+  describe "GET /users/log_in" do
+    test "renders log in page", %{conn: conn} do
+      conn = get(conn, Routes.user_session_path(conn, :new))
+      response = html_response(conn, 200)
+      assert response =~ "\n    Log in\n  </h2>"
+      assert response =~ "Register\n</a>"
+      assert response =~ "Log in\n</a>"
+    end
+
+    test "redirects if already logged in", %{conn: conn, user: user} do
+      conn = conn |> log_in_user(user) |> get(Routes.user_session_path(conn, :new))
+      assert redirected_to(conn) == "/"
+    end
+  end
+
+  describe "POST /users/log_in with credential params" do
+    test "credential params logs the user in", %{conn: conn, user: user} do
+      conn =
+        post(conn, Routes.user_session_path(conn, :create), %{
+          "user" => %{"email" => user.email, "password" => valid_user_password()}
+        })
+
+      assert get_session(conn, :user_token)
+      assert redirected_to(conn) =~ "/"
+
+      # Now do a logged in request and assert on the menu
+      conn = get(conn, "/")
+      response = html_response(conn, 200)
+      assert response =~ user.email
+      assert response =~ "Settings\n</a>"
+      assert response =~ "Log out\n</a>"
+    end
+
+    test "logs the user in with remember me", %{conn: conn, user: user} do
+      conn =
+        post(conn, Routes.user_session_path(conn, :create), %{
+          "user" => %{
+            "email" => user.email,
+            "password" => valid_user_password(),
+            "remember_me" => "true"
+          }
+        })
+
+      assert conn.resp_cookies["user_remember_me"]
+      assert redirected_to(conn) =~ "/"
+    end
+
+    test "emits error message with invalid credentials", %{conn: conn, user: user} do
+      conn =
+        post(conn, Routes.user_session_path(conn, :create), %{
+          "user" => %{"email" => user.email, "password" => "invalid_password"}
+        })
+
+      response = html_response(conn, 200)
+      assert response =~ "\n    Log in\n  </h2>"
+      assert response =~ "Invalid email or password"
+    end
+  end
+
+  describe "POST /users/log_in with params token" do
+    test "params token logs the user in", %{conn: conn, user: user} do
+      params_token = login_params_token(user, "/users/settings")
+
+      conn =
+        post(conn, Routes.user_session_path(conn, :create), %{
+          "user" => %{"params_token" => params_token}
+        })
+
+      assert get_session(conn, :user_token)
+      assert redirected_to(conn) =~ "/"
+
+      # Now do a logged in request and assert on the menu
+      conn = get(conn, "/")
+      response = html_response(conn, 200)
+      assert response =~ user.email
+      assert response =~ "Settings\n</a>"
+      assert response =~ "Log out\n</a>"
+    end
+
+    test "logs the user in with remember me", %{conn: conn, user: user} do
+      params_token = login_params_token(user, "/users/settings")
+
+      conn =
+        post(conn, Routes.user_session_path(conn, :create), %{
+          "user" => %{
+            "params_token" => params_token,
+            "remember_me" => "true"
+          }
+        })
+
+      assert conn.resp_cookies["user_remember_me"]
+      assert redirected_to(conn) =~ "/"
+    end
+
+    test "emits error message with invalid params token", %{conn: conn} do
+      conn =
+        post(conn, Routes.user_session_path(conn, :create), %{
+          "user" => %{"params_token" => "invalid params token"}
+        })
+
+      response = html_response(conn, 200)
+      assert response =~ "\n    Log in\n  </h2>"
+      assert response =~ "Invalid email or password"
+    end
+  end
+
+  describe "DELETE /users/log_out" do
+    test "logs the user out", %{conn: conn, user: user} do
+      conn = conn |> log_in_user(user) |> delete(Routes.user_session_path(conn, :delete))
+      assert redirected_to(conn) == "/"
+      refute get_session(conn, :user_token)
+      assert get_flash(conn, :info) =~ "Logged out successfully"
+    end
+
+    test "succeeds even if the user is not logged in", %{conn: conn} do
+      conn = delete(conn, Routes.user_session_path(conn, :delete))
+      assert redirected_to(conn) == "/"
+      refute get_session(conn, :user_token)
+      assert get_flash(conn, :info) =~ "Logged out successfully"
+    end
+  end
+end

test/shift73k_web/controllers/user_settings_controller_test.exs

@@ -0,0 +1,60 @@
+defmodule Shift73kWeb.UserSettingsControllerTest do
+  use Shift73kWeb.ConnCase, async: true
+
+  alias Shift73k.Accounts
+  import Shift73k.AccountsFixtures
+
+  setup :register_and_log_in_user
+
+  describe "GET /users/settings" do
+    test "renders settings page", %{conn: conn} do
+      conn = get(conn, Routes.user_settings_path(conn, :edit))
+      response = html_response(conn, 200)
+      assert response =~ "User Settings\n</h2>"
+    end
+
+    test "redirects if user is not logged in" do
+      conn = build_conn()
+      conn = get(conn, Routes.user_settings_path(conn, :edit))
+      assert redirected_to(conn) == Routes.user_session_path(conn, :new)
+    end
+  end
+
+  describe "GET /users/settings/confirm_email/:token" do
+    setup %{user: user} do
+      email = unique_user_email()
+
+      token =
+        extract_user_token(fn url ->
+          Accounts.deliver_update_email_instructions(%{user | email: email}, user.email, url)
+        end)
+
+      %{token: token, email: email}
+    end
+
+    test "updates the user email once", %{conn: conn, user: user, token: token, email: email} do
+      conn = get(conn, Routes.user_settings_path(conn, :confirm_email, token))
+      assert redirected_to(conn) == Routes.user_settings_path(conn, :edit)
+      assert get_flash(conn, :info) =~ "Email changed successfully"
+      refute Accounts.get_user_by_email(user.email)
+      assert Accounts.get_user_by_email(email)
+
+      conn = get(conn, Routes.user_settings_path(conn, :confirm_email, token))
+      assert redirected_to(conn) == Routes.user_settings_path(conn, :edit)
+      assert get_flash(conn, :error) =~ "Email change link is invalid or it has expired"
+    end
+
+    test "does not update email with invalid token", %{conn: conn, user: user} do
+      conn = get(conn, Routes.user_settings_path(conn, :confirm_email, "oops"))
+      assert redirected_to(conn) == Routes.user_settings_path(conn, :edit)
+      assert get_flash(conn, :error) =~ "Email change link is invalid or it has expired"
+      assert Accounts.get_user_by_email(user.email)
+    end
+
+    test "redirects if user is not logged in", %{token: token} do
+      conn = build_conn()
+      conn = get(conn, Routes.user_settings_path(conn, :confirm_email, token))
+      assert redirected_to(conn) == Routes.user_session_path(conn, :new)
+    end
+  end
+end

test/shift73k_web/live/admin_dashboard_live_test.exs

@@ -0,0 +1,80 @@
+defmodule Shift73kWeb.AdminDashboardLiveTest do
+  use Shift73kWeb.ConnCase
+
+  import Phoenix.LiveViewTest
+  import Shift73k.AccountsFixtures
+
+  test "disconnected and connected render without authentication should redirect to login page",
+       %{conn: conn} do
+    # If we don't previously log in we will be redirected to the login page
+    assert {:error, {:redirect, %{to: "/users/log_in"}}} = live(conn, "/admin_dashboard")
+  end
+
+  test "disconnected and connected render authenticated with user role should redirect to index page",
+       %{
+         conn: conn
+       } do
+    conn = conn |> log_in_user(user_fixture())
+    assert {:error, {:redirect, %{to: "/"}}} = live(conn, "/admin_dashboard")
+  end
+
+  test "disconnected and connected render authenticated with admin role should redirect to index page",
+       %{
+         conn: conn
+       } do
+    conn = conn |> log_in_user(admin_fixture())
+    {:ok, admin_dashboard, disconnected_html} = live(conn, "/admin_dashboard")
+    assert disconnected_html =~ "Welcome to the admin dashboard!"
+    assert render(admin_dashboard) =~ "Welcome to the admin dashboard!"
+  end
+
+  test "logs out when force logout on logged user", %{
+    conn: conn
+  } do
+    admin = admin_fixture()
+    conn = conn |> log_in_user(admin)
+
+    {:ok, admin_dashboard, disconnected_html} = live(conn, "/admin_dashboard")
+    assert disconnected_html =~ "Welcome to the admin dashboard!"
+    assert render(admin_dashboard) =~ "Welcome to the admin dashboard!"
+
+    Shift73k.Accounts.logout_user(admin)
+
+    # Assert our liveview process is down
+    ref = Process.monitor(admin_dashboard.pid)
+    assert_receive {:DOWN, ^ref, _, _, _}
+    refute Process.alive?(admin_dashboard.pid)
+
+    # Assert our liveview was redirected, following first to /users/force_logout, then to "/", and then to "/users/log_in"
+    assert_redirect(admin_dashboard, "/users/force_logout")
+
+    conn = get(conn, "/users/force_logout")
+    assert "/" = redir_path = redirected_to(conn, 302)
+    conn = get(recycle(conn), redir_path)
+
+    assert html_response(conn, 200) =~
+             "You were logged out. Please login again to continue using our application."
+  end
+
+  test "doesn't log out when force logout on another user", %{
+    conn: conn
+  } do
+    admin1 = admin_fixture()
+    admin2 = admin_fixture()
+    conn = conn |> log_in_user(admin1)
+
+    {:ok, admin_dashboard, disconnected_html} = live(conn, "/admin_dashboard")
+    assert disconnected_html =~ "Welcome to the admin dashboard!"
+    assert render(admin_dashboard) =~ "Welcome to the admin dashboard!"
+
+    Shift73k.Accounts.logout_user(admin2)
+
+    # Assert our liveview is alive
+    ref = Process.monitor(admin_dashboard.pid)
+    refute_receive {:DOWN, ^ref, _, _, _}
+    assert Process.alive?(admin_dashboard.pid)
+
+    # If we are able to rerender the page it means nothing happened
+    assert render(admin_dashboard) =~ "Welcome to the admin dashboard!"
+  end
+end

test/shift73k_web/live/page_live_test.exs

@@ -0,0 +1,66 @@
+defmodule Shift73kWeb.PageLiveTest do
+  use Shift73kWeb.ConnCase
+
+  import Phoenix.LiveViewTest
+  import Shift73k.AccountsFixtures
+
+  test "disconnected and connected render with authentication should redirect to index page", %{
+    conn: conn
+  } do
+    conn = conn |> log_in_user(user_fixture())
+
+    {:ok, page_live, disconnected_html} = live(conn, "/")
+    assert disconnected_html =~ "Welcome to Phoenix!"
+    assert render(page_live) =~ "Welcome to Phoenix!"
+  end
+
+  test "logs out when force logout on logged user", %{
+    conn: conn
+  } do
+    user = user_fixture()
+    conn = conn |> log_in_user(user)
+
+    {:ok, page_live, disconnected_html} = live(conn, "/")
+    assert disconnected_html =~ "Welcome to Phoenix!"
+    assert render(page_live) =~ "Welcome to Phoenix!"
+
+    Shift73k.Accounts.logout_user(user)
+
+    # Assert our liveview process is down
+    ref = Process.monitor(page_live.pid)
+    assert_receive {:DOWN, ^ref, _, _, _}
+    refute Process.alive?(page_live.pid)
+
+    # Assert our liveview was redirected, following first to /users/force_logout, then to "/", and then to "/users/log_in"
+    assert_redirect(page_live, "/users/force_logout")
+
+    conn = get(conn, "/users/force_logout")
+    assert "/" = redir_path = redirected_to(conn, 302)
+    conn = get(recycle(conn), redir_path)
+
+    assert html_response(conn, 200) =~
+             "You were logged out. Please login again to continue using our application."
+  end
+
+  test "doesn't log out when force logout on another user", %{
+    conn: conn
+  } do
+    user1 = user_fixture()
+    user2 = user_fixture()
+    conn = conn |> log_in_user(user2)
+
+    {:ok, page_live, disconnected_html} = live(conn, "/")
+    assert disconnected_html =~ "Welcome to Phoenix!"
+    assert render(page_live) =~ "Welcome to Phoenix!"
+
+    Shift73k.Accounts.logout_user(user1)
+
+    # Assert our liveview is alive
+    ref = Process.monitor(page_live.pid)
+    refute_receive {:DOWN, ^ref, _, _, _}
+    assert Process.alive?(page_live.pid)
+
+    # If we are able to rerender the page it means nothing happened
+    assert render(page_live) =~ "Welcome to Phoenix!"
+  end
+end

test/shift73k_web/live/property_live_test.exs

@@ -0,0 +1,409 @@
+defmodule Shift73kWeb.PropertyLiveTest do
+  use Shift73kWeb.ConnCase
+
+  import Phoenix.LiveViewTest
+  import Shift73k.AccountsFixtures
+
+  alias Shift73k.Properties
+
+  @create_attrs %{description: "some description", name: "some name", price: "120.5"}
+  @update_attrs %{
+    description: "some updated description",
+    name: "some updated name",
+    price: "456.7"
+  }
+  @invalid_attrs %{description: nil, name: nil, price: nil}
+
+  defp fixture(:property, user) do
+    create_attributes = Enum.into(%{user_id: user.id}, @create_attrs)
+    {:ok, property} = Properties.create_property(create_attributes)
+    property
+  end
+
+  describe "Index" do
+    setup %{conn: conn} do
+      user = user_fixture()
+      conn = log_in_user(conn, user)
+      property = fixture(:property, user)
+      property_from_another_user = fixture(:property, user_fixture())
+
+      %{
+        conn: conn,
+        property: property,
+        property_from_another_user: property_from_another_user,
+        user: user
+      }
+    end
+
+    test "lists all properties", %{conn: conn, property: property} do
+      {:ok, _index_live, html} = live(conn, Routes.property_index_path(conn, :index))
+
+      assert html =~ "Listing Properties"
+      assert html =~ property.description
+    end
+
+    test "saves new property", %{conn: conn} do
+      {:ok, index_live, _html} = live(conn, Routes.property_index_path(conn, :index))
+
+      assert index_live |> element("a", "New Property") |> render_click() =~
+               "New Property"
+
+      assert_patch(index_live, Routes.property_index_path(conn, :new))
+
+      assert index_live
+             |> form("#property-form", property: @invalid_attrs)
+             |> render_change() =~ "can't be blank"
+
+      # update form attrs
+      index_live
+      |> form("#property-form", property: @update_attrs)
+      |> render_change()
+
+      # submit new form attrs
+      index_live
+      |> form("#property-form", property: @update_attrs)
+      |> render_submit()
+
+      # send modal close event & observe results
+      send(index_live.pid, {:close_modal, true})
+      html = render(index_live)
+
+      assert_patched(index_live, Routes.property_index_path(conn, :index))
+      assert html =~ "Property created successfully"
+      assert html =~ "some updated description"
+    end
+
+    test "updates property in listing", %{conn: conn, property: property} do
+      {:ok, index_live, _html} = live(conn, Routes.property_index_path(conn, :index))
+
+      assert index_live |> element("#property-#{property.id} a", "Edit") |> render_click() =~
+               "Edit Property"
+
+      assert_patch(index_live, Routes.property_index_path(conn, :edit, property))
+
+      assert index_live
+             |> form("#property-form", property: @invalid_attrs)
+             |> render_change() =~ "can't be blank"
+
+      # update form attrs
+      index_live
+      |> form("#property-form", property: @update_attrs)
+      |> render_change()
+
+      # submit new form attrs
+      index_live
+      |> form("#property-form", property: @update_attrs)
+      |> render_submit()
+
+      # send modal close event & observe results
+      send(index_live.pid, {:close_modal, true})
+      html = render(index_live)
+
+      assert_patched(index_live, Routes.property_index_path(conn, :index))
+      assert html =~ "Property updated successfully"
+      assert html =~ "some updated description"
+    end
+
+    test "deletes property in listing", %{conn: conn, property: property} do
+      {:ok, index_live, _html} = live(conn, Routes.property_index_path(conn, :index))
+
+      assert index_live |> element("#property-#{property.id} a", "Delete") |> render_click()
+      refute has_element?(index_live, "#property-#{property.id}")
+    end
+
+    test "can see property from from other user in listing",
+         %{
+           conn: conn,
+           property_from_another_user: property
+         } do
+      {:ok, index_live, _html} = live(conn, Routes.property_index_path(conn, :index))
+
+      assert has_element?(index_live, "#property-#{property.id}")
+    end
+
+    test "can't see edit action for property from other user in listing",
+         %{
+           conn: conn,
+           property_from_another_user: property
+         } do
+      {:ok, index_live, _html} = live(conn, Routes.property_index_path(conn, :index))
+
+      refute has_element?(index_live, "#property-#{property.id} a", "Edit")
+    end
+
+    test "as an admin, I can update property from other user in listing", %{
+      conn: conn,
+      property_from_another_user: property
+    } do
+      conn = log_in_user(conn, admin_fixture())
+
+      {:ok, index_live, _html} = live(conn, Routes.property_index_path(conn, :index))
+
+      assert index_live |> element("#property-#{property.id} a", "Edit") |> render_click() =~
+               "Edit Property"
+
+      assert_patch(index_live, Routes.property_index_path(conn, :edit, property))
+
+      assert index_live
+             |> form("#property-form", property: @invalid_attrs)
+             |> render_change() =~ "can't be blank"
+
+      # update form attrs
+      index_live
+      |> form("#property-form", property: @update_attrs)
+      |> render_change()
+
+      # submit new form attrs
+      index_live
+      |> form("#property-form", property: @update_attrs)
+      |> render_submit()
+
+      # send modal close event & observe results
+      send(index_live.pid, {:close_modal, true})
+      html = render(index_live)
+
+      assert_patched(index_live, Routes.property_index_path(conn, :index))
+      assert html =~ "Property updated successfully"
+      assert html =~ "some updated description"
+    end
+
+    test "can't see delete action for property from other user in listing", %{
+      conn: conn,
+      property_from_another_user: property
+    } do
+      {:ok, index_live, _html} = live(conn, Routes.property_index_path(conn, :index))
+
+      refute has_element?(index_live, "#property-#{property.id} a", "Delete")
+    end
+
+    test "as an admin, I can delete property from others in listing", %{
+      conn: conn,
+      property_from_another_user: property
+    } do
+      conn = log_in_user(conn, admin_fixture())
+
+      {:ok, index_live, _html} = live(conn, Routes.property_index_path(conn, :index))
+
+      assert index_live |> element("#property-#{property.id} a", "Delete") |> render_click()
+      refute has_element?(index_live, "#property-#{property.id}")
+    end
+
+    test "can't edit property from other user in listing",
+         %{
+           conn: conn,
+           property_from_another_user: property
+         } do
+      assert {:error, {:redirect, %{to: "/"}}} =
+               live(conn, Routes.property_index_path(conn, :edit, property))
+    end
+
+    test "logs out when force logout on logged user", %{
+      conn: conn
+    } do
+      user = user_fixture()
+      conn = conn |> log_in_user(user)
+
+      {:ok, index_live, html} = live(conn, Routes.property_index_path(conn, :index))
+
+      assert html =~ "Listing Properties"
+      assert render(index_live) =~ "Listing Properties"
+
+      Shift73k.Accounts.logout_user(user)
+
+      # Assert our liveview process is down
+      ref = Process.monitor(index_live.pid)
+      assert_receive {:DOWN, ^ref, _, _, _}
+      refute Process.alive?(index_live.pid)
+
+      # Assert our liveview was redirected, following first to /users/force_logout, then to "/"
+      assert_redirect(index_live, "/users/force_logout")
+
+      conn = get(conn, "/users/force_logout")
+      assert "/" = redir_path = redirected_to(conn, 302)
+      conn = get(recycle(conn), redir_path)
+
+      assert html_response(conn, 200) =~
+               "You were logged out. Please login again to continue using our application."
+    end
+
+    test "doesn't log out when force logout on another user", %{
+      conn: conn
+    } do
+      user1 = user_fixture()
+      user2 = user_fixture()
+      conn = conn |> log_in_user(user2)
+
+      {:ok, index_live, html} = live(conn, Routes.property_index_path(conn, :index))
+
+      assert html =~ "Listing Properties"
+      assert render(index_live) =~ "Listing Properties"
+
+      Shift73k.Accounts.logout_user(user1)
+
+      # Assert our liveview is alive
+      ref = Process.monitor(index_live.pid)
+      refute_receive {:DOWN, ^ref, _, _, _}
+      assert Process.alive?(index_live.pid)
+
+      # If we are able to rerender the page it means nothing happened
+      assert render(index_live) =~ "Listing Properties"
+    end
+  end
+
+  describe "Show" do
+    setup %{conn: conn} do
+      user = user_fixture()
+      conn = log_in_user(conn, user)
+      property = fixture(:property, user)
+      property_from_another_user = fixture(:property, user_fixture())
+
+      %{
+        conn: conn,
+        property: property,
+        property_from_another_user: property_from_another_user,
+        user: user
+      }
+    end
+
+    test "displays property", %{conn: conn, property: property} do
+      {:ok, _show_live, html} = live(conn, Routes.property_show_path(conn, :show, property))
+
+      assert html =~ "Show Property"
+      assert html =~ property.description
+    end
+
+    test "updates property within modal", %{conn: conn, property: property} do
+      {:ok, show_live, _html} = live(conn, Routes.property_show_path(conn, :show, property))
+
+      assert show_live |> element("a", "Edit") |> render_click() =~
+               "Edit Property"
+
+      assert_patch(show_live, Routes.property_show_path(conn, :edit, property))
+
+      assert show_live
+             |> form("#property-form", property: @invalid_attrs)
+             |> render_change() =~ "can't be blank"
+
+      # update form attrs
+      show_live
+      |> form("#property-form", property: @update_attrs)
+      |> render_change()
+
+      # submit new form attrs
+      show_live
+      |> form("#property-form", property: @update_attrs)
+      |> render_submit()
+
+      # send modal close event & observe results
+      send(show_live.pid, {:close_modal, true})
+      html = render(show_live)
+
+      assert_patched(show_live, Routes.property_show_path(conn, :show, property))
+      assert html =~ "Property updated successfully"
+      assert html =~ "some updated description"
+    end
+
+    test "can't see edit action for property from another user in show page", %{
+      conn: conn,
+      property_from_another_user: property
+    } do
+      {:ok, show_live, _html} = live(conn, Routes.property_show_path(conn, :show, property))
+
+      refute has_element?(show_live, "a", "Edit")
+    end
+
+    test "as an admin, can updates property from others within modal", %{
+      conn: conn,
+      property_from_another_user: property
+    } do
+      conn = log_in_user(conn, admin_fixture())
+
+      {:ok, show_live, _html} = live(conn, Routes.property_show_path(conn, :show, property))
+
+      assert show_live |> element("a", "Edit") |> render_click() =~
+               "Edit Property"
+
+      assert_patch(show_live, Routes.property_show_path(conn, :edit, property))
+
+      assert show_live
+             |> form("#property-form", property: @invalid_attrs)
+             |> render_change() =~ "can't be blank"
+
+      # update form attrs
+      show_live
+      |> form("#property-form", property: @update_attrs)
+      |> render_change()
+
+      # submit new form attrs
+      show_live
+      |> form("#property-form", property: @update_attrs)
+      |> render_submit()
+
+      # send modal close event & observe results
+      send(show_live.pid, {:close_modal, true})
+      html = render(show_live)
+
+      assert_patched(show_live, Routes.property_show_path(conn, :show, property))
+      assert html =~ "Property updated successfully"
+      assert html =~ "some updated description"
+    end
+
+    test "can't edit property from another user in show page", %{
+      conn: conn,
+      property_from_another_user: property
+    } do
+      assert {:error, {:redirect, %{to: "/"}}} =
+               live(conn, Routes.property_show_path(conn, :edit, property))
+    end
+
+    test "logs out when force logout on logged user", %{conn: conn, property: property} do
+      user = user_fixture()
+      conn = conn |> log_in_user(user)
+
+      {:ok, show_live, html} = live(conn, Routes.property_show_path(conn, :show, property))
+
+      assert html =~ "Show Property"
+      assert html =~ property.description
+      assert render(show_live) =~ property.description
+
+      Shift73k.Accounts.logout_user(user)
+
+      # Assert our liveview process is down
+      ref = Process.monitor(show_live.pid)
+      assert_receive {:DOWN, ^ref, _, _, _}
+      refute Process.alive?(show_live.pid)
+
+      # Assert our liveview was redirected, following first to /users/force_logout, then to "/", and then to "/users/log_in"
+      assert_redirect(show_live, "/users/force_logout")
+
+      conn = get(conn, "/users/force_logout")
+      assert "/" = redir_path = redirected_to(conn, 302)
+      conn = get(recycle(conn), redir_path)
+
+      assert html_response(conn, 200) =~
+               "You were logged out. Please login again to continue using our application."
+    end
+
+    test "doesn't log out when force logout on another user", %{conn: conn, property: property} do
+      user1 = user_fixture()
+      user2 = user_fixture()
+      conn = conn |> log_in_user(user2)
+
+      {:ok, show_live, html} = live(conn, Routes.property_show_path(conn, :show, property))
+
+      assert html =~ "Show Property"
+      assert html =~ property.description
+      assert render(show_live) =~ property.description
+
+      Shift73k.Accounts.logout_user(user1)
+
+      # Assert our liveview is alive
+      ref = Process.monitor(show_live.pid)
+      refute_receive {:DOWN, ^ref, _, _, _}
+      assert Process.alive?(show_live.pid)
+
+      # If we are able to rerender the page it means nothing happened
+      assert render(show_live) =~ property.description
+    end
+  end
+end

test/shift73k_web/live/user/registration_test.exs

@@ -0,0 +1,71 @@
+defmodule Shift73kWeb.UserLive.RegistrationTest do
+  use Shift73kWeb.ConnCase
+
+  import Phoenix.LiveViewTest
+  import Shift73k.AccountsFixtures
+
+  alias Shift73k.Accounts
+  alias Shift73k.Accounts.User
+
+  describe "Registration" do
+    setup %{conn: conn} do
+      user_return_to = "/path-requires-auth"
+      conn = init_test_session(conn, %{"user_return_to" => user_return_to})
+      %{conn: conn, user_return_to: user_return_to}
+    end
+
+    test "displays registration form", %{conn: conn} do
+      {:ok, _view, html} = live_isolated(conn, Shift73kWeb.UserLive.Registration)
+
+      assert html =~ "Register\n  </h2>"
+      assert html =~ "Email</label>"
+    end
+
+    test "render errors for invalid data", %{conn: conn} do
+      {:ok, view, _html} = live_isolated(conn, Shift73kWeb.UserLive.Registration)
+
+      html =
+        view
+        |> form("#reg_form", %{"user" => %{"email" => "abc", "password" => "abc"}})
+        |> render_change()
+
+      assert html =~ "Register\n  </h2>"
+      assert html =~ "must be a valid email address"
+      assert html =~ "should be at least #{User.min_password()} character(s)"
+      assert html =~ "type=\"submit\" disabled=\"disabled\""
+    end
+
+    @tag :capture_log
+    test "creates account, sets login token & phx-trigger-action", %{
+      conn: conn,
+      user_return_to: user_return_to
+    } do
+      {:ok, view, html} = live_isolated(conn, Shift73kWeb.UserLive.Registration)
+
+      # Login trigger form not triggered yet
+      refute html =~ "phx-trigger-action=\"phx-trigger-action\""
+
+      # Render registering a new user
+      email = unique_user_email()
+      form_data = %{"user" => %{"email" => email, "password" => valid_user_password()}}
+      html = form(view, "#reg_form", form_data) |> render_submit()
+
+      # Confirm user was registered
+      %User{email: new_user_email, id: new_user_id} = Accounts.get_user_by_email(email)
+      assert new_user_email == email
+
+      # Login trigger form activated?
+      assert html =~ "phx-trigger-action=\"phx-trigger-action\""
+
+      # Collect the rendered login params token
+      [params_token] = Floki.attribute(html, "input#user_params_token", "value")
+      {:ok, params} = Phoenix.Token.decrypt(Shift73kWeb.Endpoint, "login_params", params_token)
+      %{user_id: param_user_id, user_return_to: param_return_path} = params
+
+      # Token in login trigger form has correct user ID?
+      assert new_user_id == param_user_id
+      # ... and correct user_return_to path?
+      assert user_return_to == param_return_path
+    end
+  end
+end

test/shift73k_web/live/user/reset_password_test.exs

@@ -0,0 +1,56 @@
+defmodule Shift73kWeb.UserLive.ResetPasswordTest do
+  use Shift73kWeb.ConnCase
+
+  import Phoenix.LiveViewTest
+  import Shift73k.AccountsFixtures
+
+  alias Shift73k.Repo
+  alias Shift73k.Accounts
+  alias Shift73k.Accounts.{User, UserToken}
+
+  setup %{conn: conn} do
+    user = user_fixture()
+    conn = init_test_session(conn, %{"user_id" => user.id})
+    %{conn: conn, user: user}
+  end
+
+  test "displays registration form", %{conn: conn, user: user} do
+    {:ok, _view, html} = live_isolated(conn, Shift73kWeb.UserLive.ResetPassword)
+
+    assert html =~ "Reset password\n  </h2>"
+    assert html =~ user.email
+    assert html =~ "New password</label>"
+  end
+
+  test "render errors for invalid data", %{conn: conn} do
+    {:ok, view, _html} = live_isolated(conn, Shift73kWeb.UserLive.ResetPassword)
+
+    form_data = %{"user" => %{"password" => "abc", "password_confirmation" => "def"}}
+    html = form(view, "#pw_reset_form", form_data) |> render_change()
+
+    assert html =~ "Reset password\n  </h2>"
+    assert html =~ "should be at least #{User.min_password()} character(s)"
+    assert html =~ "does not match password"
+    assert html =~ "type=\"submit\" disabled=\"disabled\""
+  end
+
+  @tag :capture_log
+  test "saves new password once", %{conn: conn, user: user} do
+    {:ok, view, _html} = live_isolated(conn, Shift73kWeb.UserLive.ResetPassword)
+
+    # Render submitting a new password
+    new_pw = "valid_new_pass_123"
+    form_data = %{"user" => %{"password" => new_pw, "password_confirmation" => new_pw}}
+    _html = form(view, "#pw_reset_form", form_data) |> render_submit()
+
+    # Confirm redirected
+    flash = assert_redirected(view, Routes.user_session_path(conn, :new))
+    assert flash["info"] == "Password reset successfully."
+
+    # Confirm password was updated
+    assert Accounts.get_user_by_email_and_password(user.email, new_pw)
+
+    # Tokens have been deleted
+    assert [] == Repo.all(UserToken.user_and_contexts_query(user, :all))
+  end
+end

test/shift73k_web/live/user_dashboard_live_test.exs

@@ -0,0 +1,82 @@
+defmodule Shift73kWeb.UserDashboardLiveTest do
+  use Shift73kWeb.ConnCase
+
+  import Phoenix.LiveViewTest
+  import Shift73k.AccountsFixtures
+
+  test "disconnected and connected render without authentication should redirect to login page",
+       %{conn: conn} do
+    # If we don't previously log in we will be redirected to the login page
+    assert {:error, {:redirect, %{to: "/users/log_in"}}} = live(conn, "/user_dashboard")
+  end
+
+  test "disconnected and connected render authenticated with user role should redirect to index page",
+       %{
+         conn: conn
+       } do
+    conn = conn |> log_in_user(user_fixture())
+    {:ok, user_dashboard, disconnected_html} = live(conn, "/user_dashboard")
+    assert disconnected_html =~ "Welcome to the user dashboard!"
+    assert render(user_dashboard) =~ "Welcome to the user dashboard!"
+  end
+
+  test "disconnected and connected render authenticated with admin role should redirect to index page",
+       %{
+         conn: conn
+       } do
+    conn = conn |> log_in_user(admin_fixture())
+    {:ok, user_dashboard, disconnected_html} = live(conn, "/user_dashboard")
+    assert disconnected_html =~ "Welcome to the user dashboard!"
+    assert render(user_dashboard) =~ "Welcome to the user dashboard!"
+  end
+
+  test "logs out when force logout on logged user", %{
+    conn: conn
+  } do
+    user = user_fixture()
+    conn = conn |> log_in_user(user)
+
+    {:ok, user_dashboard, disconnected_html} = live(conn, "/user_dashboard")
+    assert disconnected_html =~ "Welcome to the user dashboard!"
+    assert render(user_dashboard) =~ "Welcome to the user dashboard!"
+
+    Shift73k.Accounts.logout_user(user)
+
+    # Assert our liveview process is down
+    ref = Process.monitor(user_dashboard.pid)
+    assert_receive {:DOWN, ^ref, _, _, _}
+    refute Process.alive?(user_dashboard.pid)
+
+    # Assert our liveview was redirected, following first to /users/force_logout, then to "/", and then to "/users/log_in"
+    assert_redirect(user_dashboard, "/users/force_logout")
+
+    conn = get(conn, "/users/force_logout")
+    assert "/" = redir_path = redirected_to(conn, 302)
+    conn = get(recycle(conn), redir_path)
+
+    assert html_response(conn, 200) =~
+             "You were logged out. Please login again to continue using our application."
+  end
+
+  test "doesn't log out when force logout on another user", %{
+    conn: conn
+  } do
+    user1 = user_fixture()
+    user2 = user_fixture()
+    conn = conn |> log_in_user(user1)
+
+    {:ok, user_dashboard, disconnected_html} = live(conn, "/user_dashboard")
+    assert disconnected_html =~ "Welcome to the user dashboard!"
+    assert render(user_dashboard) =~ "Welcome to the user dashboard!"
+
+    Shift73k.Accounts.logout_user(user2)
+
+    # Assert our liveview is alive
+    ref = Process.monitor(user_dashboard.pid)
+    refute_receive {:DOWN, ^ref, _, _, _}
+    assert Process.alive?(user_dashboard.pid)
+
+    # If we are able to rerender the page it means nothing happened
+    assert render(user_dashboard) =~ "Welcome to the user dashboard!"
+  end
+end

test/shift73k_web/views/error_view_test.exs

@@ -0,0 +1,14 @@
+defmodule Shift73kWeb.ErrorViewTest do
+  use Shift73kWeb.ConnCase, async: true
+
+  # Bring render/3 and render_to_string/3 for testing custom views
+  import Phoenix.View
+
+  test "renders 404.html" do
+    assert render_to_string(Shift73kWeb.ErrorView, "404.html", []) == "Not Found"
+  end
+
+  test "renders 500.html" do
+    assert render_to_string(Shift73kWeb.ErrorView, "500.html", []) == "Internal Server Error"
+  end
+end

test/shift73k_web/views/layout_view_test.exs

@@ -0,0 +1,8 @@
+defmodule Shift73kWeb.LayoutViewTest do
+  use Shift73kWeb.ConnCase, async: true
+
+  # When testing helpers, you may want to import Phoenix.HTML and
+  # use functions such as safe_to_string() to convert the helper
+  # result into an HTML string.
+  # import Phoenix.HTML
+end