From a558ce19110685e77fdaf2bc4ae36e2b850f5b0c Mon Sep 17 00:00:00 2001 From: Pablo Brasero Date: Wed, 28 Oct 2026 16:28:11 +0000 Subject: [PATCH] Ensure correct behaviour when the user is unknown This is not a big deal for us, since in this codebase it's equivalent to the password being wrong, etc. However: - We should be testing all potential behaviours, irrespective of how we implement things under the hood. - If we integrate a third-party solution for authentication, this may be different. It's indeed a different code path in Devise, so this PR reduces the size of a potential future Devise PR. --- test/controllers/sessions_controller_test.rb | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/test/controllers/sessions_controller_test.rb b/test/controllers/sessions_controller_test.rb index d52d75895..be8a50828 100644 --- a/test/controllers/sessions_controller_test.rb +++ b/test/controllers/sessions_controller_test.rb @@ -89,6 +89,12 @@ class SessionsControllerTest < ActionDispatch::IntegrationTest assert_equal({ :partial => "sessions/suspended_flash" }, flash[:error]) end + def test_login_invalid_user + post login_path, :params => { :username => "nobody", :password => "noone", :remember_me => "0" } + assert_redirected_to login_path(:username => "nobody", :remember_me => false) + assert_equal(I18n.t("sessions.new.auth failure"), flash[:error]) + end + def test_login_invalid_password user = create(:user) -- 2.47.3