mastodon/spec/models/user_spec.rb

600 lines
19 KiB
Ruby
Raw Normal View History

# frozen_string_literal: true
2016-02-22 15:00:20 +00:00
require 'rails_helper'
require 'devise_two_factor/spec_helpers'
2016-02-22 15:00:20 +00:00
RSpec.describe User do
let(:password) { 'abcd1234' }
let(:account) { Fabricate(:account, username: 'alice') }
it_behaves_like 'two_factor_backupable'
describe 'legacy_otp_secret' do
it 'is encrypted with OTP_SECRET environment variable' do
user = Fabricate(:user,
encrypted_otp_secret: "Fttsy7QAa0edaDfdfSz094rRLAxc8cJweDQ4BsWH/zozcdVA8o9GLqcKhn2b\nGi/V\n",
encrypted_otp_secret_iv: 'rys3THICkr60BoWC',
encrypted_otp_secret_salt: '_LMkAGvdg7a+sDIKjI3mR2Q==')
expect(user.send(:legacy_otp_secret)).to eq 'anotpsecretthatshouldbeencrypted'
end
end
describe 'otp_secret' do
it 'encrypts the saved value' do
user = Fabricate(:user, otp_secret: '123123123')
user.reload
expect(user.otp_secret).to eq '123123123'
expect(user.attributes_before_type_cast[:otp_secret]).to_not eq '123123123'
end
end
2017-04-04 22:29:56 +00:00
describe 'validations' do
it 'is invalid without an account' do
user = Fabricate.build(:user, account: nil)
user.valid?
expect(user).to model_have_error_on_field(:account)
end
2016-02-24 23:17:01 +00:00
2017-04-04 22:29:56 +00:00
it 'is invalid without a valid email' do
user = Fabricate.build(:user, email: 'john@')
user.valid?
expect(user).to model_have_error_on_field(:email)
end
it 'is valid with an invalid e-mail that has already been saved' do
user = Fabricate.build(:user, email: 'invalid-email')
user.save(validate: false)
expect(user.valid?).to be true
end
it 'is valid with a localhost e-mail address' do
user = Fabricate.build(:user, email: 'admin@localhost')
user.valid?
expect(user.valid?).to be true
end
end
describe 'Normalizations' do
describe 'locale' do
it 'preserves valid locale' do
user = Fabricate.build(:user, locale: 'en')
expect(user.locale).to eq('en')
end
it 'cleans out invalid locale' do
user = Fabricate.build(:user, locale: 'toto')
expect(user.locale).to be_nil
end
end
describe 'time_zone' do
it 'preserves valid timezone' do
user = Fabricate.build(:user, time_zone: 'UTC')
expect(user.time_zone).to eq('UTC')
end
it 'cleans out invalid timezone' do
user = Fabricate.build(:user, time_zone: 'toto')
expect(user.time_zone).to be_nil
end
end
describe 'languages' do
it 'preserves valid options for languages' do
user = Fabricate.build(:user, chosen_languages: ['en', 'fr', ''])
expect(user.chosen_languages).to eq(['en', 'fr'])
end
it 'cleans out empty string from languages' do
user = Fabricate.build(:user, chosen_languages: [''])
expect(user.chosen_languages).to be_nil
end
end
2017-04-04 22:29:56 +00:00
end
describe 'scopes', :inline_jobs do
2017-04-04 22:29:56 +00:00
describe 'recent' do
it 'returns an array of recent users ordered by id' do
first_user = Fabricate(:user)
second_user = Fabricate(:user)
expect(described_class.recent).to eq [second_user, first_user]
2017-04-04 22:29:56 +00:00
end
end
describe 'confirmed' do
it 'returns an array of users who are confirmed' do
Fabricate(:user, confirmed_at: nil)
confirmed_user = Fabricate(:user, confirmed_at: Time.zone.now)
expect(described_class.confirmed).to contain_exactly(confirmed_user)
2017-04-04 22:29:56 +00:00
end
end
describe 'signed_in_recently' do
it 'returns a relation of users who have signed in during the recent period' do
recent_sign_in_user = Fabricate(:user, current_sign_in_at: within_duration_window_days.ago)
Fabricate(:user, current_sign_in_at: exceed_duration_window_days.ago)
expect(described_class.signed_in_recently)
.to contain_exactly(recent_sign_in_user)
end
end
describe 'not_signed_in_recently' do
it 'returns a relation of users who have not signed in during the recent period' do
no_recent_sign_in_user = Fabricate(:user, current_sign_in_at: exceed_duration_window_days.ago)
Fabricate(:user, current_sign_in_at: within_duration_window_days.ago)
expect(described_class.not_signed_in_recently)
.to contain_exactly(no_recent_sign_in_user)
end
end
describe 'account_not_suspended' do
it 'returns with linked accounts that are not suspended' do
suspended_account = Fabricate(:account, suspended_at: 10.days.ago)
non_suspended_account = Fabricate(:account, suspended_at: nil)
suspended_user = Fabricate(:user, account: suspended_account)
non_suspended_user = Fabricate(:user, account: non_suspended_account)
expect(described_class.account_not_suspended)
.to include(non_suspended_user)
.and not_include(suspended_user)
end
end
describe 'matches_email' do
it 'returns a relation of users whose email starts with the given string' do
specified = Fabricate(:user, email: 'specified@spec')
Fabricate(:user, email: 'unspecified@spec')
expect(described_class.matches_email('specified')).to contain_exactly(specified)
end
end
2022-02-16 12:14:53 +00:00
describe 'matches_ip' do
it 'returns a relation of users whose ip address is matching with the given CIDR' do
user1 = Fabricate(:user)
user2 = Fabricate(:user)
Fabricate(:session_activation, user: user1, ip: '2160:2160::22', session_id: '1')
Fabricate(:session_activation, user: user1, ip: '2160:2160::23', session_id: '2')
Fabricate(:session_activation, user: user2, ip: '2160:8888::24', session_id: '3')
Fabricate(:session_activation, user: user2, ip: '2160:8888::25', session_id: '4')
expect(described_class.matches_ip('2160:2160::/32')).to contain_exactly(user1)
2022-02-16 12:14:53 +00:00
end
end
def exceed_duration_window_days
described_class::ACTIVE_DURATION + 2.days
end
def within_duration_window_days
described_class::ACTIVE_DURATION - 2.days
end
2017-04-05 01:31:26 +00:00
end
describe 'email domains denylist integration' do
2023-11-07 09:10:36 +00:00
around do |example|
original = Rails.configuration.x.email_domains_denylist
Rails.configuration.x.email_domains_denylist = 'mvrht.com'
example.run
Rails.configuration.x.email_domains_denylist = original
end
it 'allows a user with an email domain that is not on the denylist to be created' do
user = described_class.new(email: 'foo@example.com', account: account, password: password, agreement: true)
expect(user).to be_valid
end
2017-04-05 01:31:26 +00:00
it 'does not allow a user with an email domain on the deylist to be created' do
user = described_class.new(email: 'foo@mvrht.com', account: account, password: password, agreement: true)
expect(user).to_not be_valid
end
it 'does not allow a user with an email where the subdomain is on the denylist to be created' do
user = described_class.new(email: 'foo@mvrht.com.topdomain.tld', account: account, password: password, agreement: true)
expect(user).to_not be_valid
end
end
describe '#confirmed?' do
it 'returns true when a confirmed_at is set' do
user = Fabricate.build(:user, confirmed_at: Time.now.utc)
expect(user.confirmed?).to be true
end
it 'returns false if a confirmed_at is nil' do
user = Fabricate.build(:user, confirmed_at: nil)
expect(user.confirmed?).to be false
end
end
describe '#confirm' do
subject { user.confirm }
let(:new_email) { 'new-email@example.com' }
before do
allow(TriggerWebhookWorker).to receive(:perform_async)
end
context 'when the user is already confirmed' do
let!(:user) { Fabricate(:user, confirmed_at: Time.now.utc, approved: true, unconfirmed_email: new_email) }
it 'sets email to unconfirmed_email and does not trigger web hook' do
expect { subject }.to change { user.reload.email }.to(new_email)
2023-02-20 01:33:27 +00:00
expect(TriggerWebhookWorker).to_not have_received(:perform_async).with('account.approved', 'Account', user.account_id)
end
end
context 'when the user is a new user' do
let(:user) { Fabricate(:user, confirmed_at: nil, unconfirmed_email: new_email) }
context 'when the user is already approved' do
before do
Setting.registrations_mode = 'approved'
user.approve!
end
it 'sets email to unconfirmed_email and triggers `account.approved` web hook' do
expect { subject }.to change { user.reload.email }.to(new_email)
expect(TriggerWebhookWorker).to have_received(:perform_async).with('account.approved', 'Account', user.account_id).once
end
end
context 'when the user does not require explicit approval' do
before do
Setting.registrations_mode = 'open'
end
it 'sets email to unconfirmed_email and triggers `account.approved` web hook' do
expect { subject }.to change { user.reload.email }.to(new_email)
expect(TriggerWebhookWorker).to have_received(:perform_async).with('account.approved', 'Account', user.account_id).once
end
end
context 'when the user requires explicit approval but is not approved' do
before do
Setting.registrations_mode = 'approved'
end
it 'sets email to unconfirmed_email and does not trigger web hook' do
expect { subject }.to change { user.reload.email }.to(new_email)
expect(TriggerWebhookWorker).to_not have_received(:perform_async).with('account.approved', 'Account', user.account_id)
end
end
end
end
describe '#approve!' do
subject { user.approve! }
before do
Setting.registrations_mode = 'approved'
allow(TriggerWebhookWorker).to receive(:perform_async)
end
context 'when the user is already confirmed' do
let(:user) { Fabricate(:user, confirmed_at: Time.now.utc, approved: false) }
it 'sets the approved flag and triggers `account.approved` web hook' do
expect { subject }.to change { user.reload.approved? }.to(true)
expect(TriggerWebhookWorker).to have_received(:perform_async).with('account.approved', 'Account', user.account_id).once
end
end
context 'when the user is not confirmed' do
let(:user) { Fabricate(:user, confirmed_at: nil, approved: false) }
it 'sets the approved flag and does not trigger web hook' do
expect { subject }.to change { user.reload.approved? }.to(true)
2023-02-20 01:33:27 +00:00
expect(TriggerWebhookWorker).to_not have_received(:perform_async).with('account.approved', 'Account', user.account_id)
end
end
end
describe '#disable_two_factor!' do
it 'saves false for otp_required_for_login' do
user = Fabricate.build(:user, otp_required_for_login: true)
user.disable_two_factor!
expect(user.reload.otp_required_for_login).to be false
end
Add WebAuthn as an alternative 2FA method (#14466) * feat: add possibility of adding WebAuthn security keys to use as 2FA This adds a basic UI for enabling WebAuthn 2FA. We did a little refactor to the Settings page for editing the 2FA methods – now it will list the methods that are available to the user (TOTP and WebAuthn) and from there they'll be able to add or remove any of them. Also, it's worth mentioning that for enabling WebAuthn it's required to have TOTP enabled, so the first time that you go to the 2FA Settings page, you'll be asked to set it up. This work was inspired by the one donde by Github in their platform, and despite it could be approached in different ways, we decided to go with this one given that we feel that this gives a great UX. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add request for WebAuthn as second factor at login if enabled This commits adds the feature for using WebAuthn as a second factor for login when enabled. If users have WebAuthn enabled, now a page requesting for the use of a WebAuthn credential for log in will appear, although a link redirecting to the old page for logging in using a two-factor code will also be present. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add possibility of deleting WebAuthn Credentials Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: disable WebAuthn when an Admin disables 2FA for a user Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: remove ability to disable TOTP leaving only WebAuthn as 2FA Following examples form other platforms like Github, we decided to make Webauthn 2FA secondary to 2FA with TOTP, so that we removed the possibility of removing TOTP authentication only, leaving users with just WEbAuthn as 2FA. Instead, users will have to click on 'Disable 2FA' in order to remove second factor auth. The reason for WebAuthn being secondary to TOPT is that in that way, users will still be able to log in using their code from their phone's application if they don't have their security keys with them – or maybe even lost them. * We had to change a little the flow for setting up TOTP, given that now it's possible to setting up again if you already had TOTP, in order to let users modify their authenticator app – given that now it's not possible for them to disable TOTP and set it up again with another authenticator app. So, basically, now instead of storing the new `otp_secret` in the user, we store it in the session until the process of set up is finished. This was because, as it was before, when users clicked on 'Edit' in the new two-factor methods lists page, but then went back without finishing the flow, their `otp_secret` had been changed therefore invalidating their previous authenticator app, making them unable to log in again using TOTP. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * refactor: fix eslint errors The PR build was failing given that linting returning some errors. This commit attempts to fix them. * refactor: normalize i18n translations The build was failing given that i18n translations files were not normalized. This commits fixes that. * refactor: avoid having the webauthn gem locked to a specific version * refactor: use symbols for routes without '/' * refactor: avoid sending webauthn disabled email when 2FA is disabled When an admins disable 2FA for users, we were sending two mails to them, one notifying that 2FA was disabled and the other to notify that WebAuthn was disabled. As the second one is redundant since the first email includes it, we can remove it and send just one email to users. * refactor: avoid creating new env variable for webauthn_origin config * refactor: improve flash error messages for webauthn pages Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com>
2020-08-24 14:46:27 +00:00
it 'saves nil for otp_secret' do
user = Fabricate.build(:user, otp_secret: 'oldotpcode')
user.disable_two_factor!
2023-02-17 12:45:27 +00:00
expect(user.reload.otp_secret).to be_nil
Add WebAuthn as an alternative 2FA method (#14466) * feat: add possibility of adding WebAuthn security keys to use as 2FA This adds a basic UI for enabling WebAuthn 2FA. We did a little refactor to the Settings page for editing the 2FA methods – now it will list the methods that are available to the user (TOTP and WebAuthn) and from there they'll be able to add or remove any of them. Also, it's worth mentioning that for enabling WebAuthn it's required to have TOTP enabled, so the first time that you go to the 2FA Settings page, you'll be asked to set it up. This work was inspired by the one donde by Github in their platform, and despite it could be approached in different ways, we decided to go with this one given that we feel that this gives a great UX. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add request for WebAuthn as second factor at login if enabled This commits adds the feature for using WebAuthn as a second factor for login when enabled. If users have WebAuthn enabled, now a page requesting for the use of a WebAuthn credential for log in will appear, although a link redirecting to the old page for logging in using a two-factor code will also be present. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add possibility of deleting WebAuthn Credentials Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: disable WebAuthn when an Admin disables 2FA for a user Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: remove ability to disable TOTP leaving only WebAuthn as 2FA Following examples form other platforms like Github, we decided to make Webauthn 2FA secondary to 2FA with TOTP, so that we removed the possibility of removing TOTP authentication only, leaving users with just WEbAuthn as 2FA. Instead, users will have to click on 'Disable 2FA' in order to remove second factor auth. The reason for WebAuthn being secondary to TOPT is that in that way, users will still be able to log in using their code from their phone's application if they don't have their security keys with them – or maybe even lost them. * We had to change a little the flow for setting up TOTP, given that now it's possible to setting up again if you already had TOTP, in order to let users modify their authenticator app – given that now it's not possible for them to disable TOTP and set it up again with another authenticator app. So, basically, now instead of storing the new `otp_secret` in the user, we store it in the session until the process of set up is finished. This was because, as it was before, when users clicked on 'Edit' in the new two-factor methods lists page, but then went back without finishing the flow, their `otp_secret` had been changed therefore invalidating their previous authenticator app, making them unable to log in again using TOTP. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * refactor: fix eslint errors The PR build was failing given that linting returning some errors. This commit attempts to fix them. * refactor: normalize i18n translations The build was failing given that i18n translations files were not normalized. This commits fixes that. * refactor: avoid having the webauthn gem locked to a specific version * refactor: use symbols for routes without '/' * refactor: avoid sending webauthn disabled email when 2FA is disabled When an admins disable 2FA for users, we were sending two mails to them, one notifying that 2FA was disabled and the other to notify that WebAuthn was disabled. As the second one is redundant since the first email includes it, we can remove it and send just one email to users. * refactor: avoid creating new env variable for webauthn_origin config * refactor: improve flash error messages for webauthn pages Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com>
2020-08-24 14:46:27 +00:00
end
it 'saves cleared otp_backup_codes' do
user = Fabricate.build(:user, otp_backup_codes: %w(dummy dummy))
user.disable_two_factor!
expect(user.reload.otp_backup_codes.empty?).to be true
end
end
describe '#send_confirmation_instructions' do
around do |example|
queue_adapter = ActiveJob::Base.queue_adapter
example.run
ActiveJob::Base.queue_adapter = queue_adapter
end
it 'delivers confirmation instructions later' do
user = Fabricate(:user)
ActiveJob::Base.queue_adapter = :test
expect { user.send_confirmation_instructions }.to have_enqueued_job(ActionMailer::MailDeliveryJob)
end
end
describe 'settings' do
it 'is instance of UserSettings' do
user = Fabricate(:user)
expect(user.settings).to be_a UserSettings
end
end
describe '#setting_default_privacy' do
it 'returns default privacy setting if user has configured' do
user = Fabricate(:user)
user.settings[:default_privacy] = 'unlisted'
expect(user.setting_default_privacy).to eq 'unlisted'
end
it "returns 'private' if user has not configured default privacy setting and account is locked" do
user = Fabricate(:account, locked: true).user
expect(user.setting_default_privacy).to eq 'private'
end
it "returns 'public' if user has not configured default privacy setting and account is not locked" do
user = Fabricate(:account, locked: false).user
expect(user.setting_default_privacy).to eq 'public'
end
end
describe 'allowlist integration' do
2023-11-07 09:10:36 +00:00
around do |example|
original = Rails.configuration.x.email_domains_allowlist
Rails.configuration.x.email_domains_allowlist = 'mastodon.space'
example.run
Rails.configuration.x.email_domains_allowlist = original
end
it 'does not allow a user to be created when their email is not on the allowlist' do
user = described_class.new(email: 'foo@example.com', account: account, password: password, agreement: true)
expect(user).to_not be_valid
end
it 'allows a user to be created when their email is on the allowlist' do
user = described_class.new(email: 'foo@mastodon.space', account: account, password: password, agreement: true)
expect(user).to be_valid
end
it 'does not allow a user with an email subdomain included on the top level domain allowlist to be created' do
user = described_class.new(email: 'foo@mastodon.space.userdomain.com', account: account, password: password, agreement: true)
expect(user).to_not be_valid
end
context 'with a subdomain on the denylist' do
around do |example|
original = Rails.configuration.x.email_domains_denylist
example.run
Rails.configuration.x.email_domains_denylist = original
end
it 'does not allow a user to be created with an email subdomain on the denylist even if the top domain is on the allowlist' do
Rails.configuration.x.email_domains_denylist = 'denylisted.mastodon.space'
user = described_class.new(email: 'foo@denylisted.mastodon.space', account: account, password: password)
expect(user).to_not be_valid
end
end
2017-04-04 22:29:56 +00:00
end
2017-06-04 15:07:39 +00:00
describe 'token_for_app' do
let(:user) { Fabricate(:user) }
let(:app) { Fabricate(:application, owner: user) }
it 'returns a token' do
expect(user.token_for_app(app)).to be_a(Doorkeeper::AccessToken)
end
it 'persists a token' do
t = user.token_for_app(app)
expect(user.token_for_app(app)).to eql(t)
end
it 'is nil if user does not own app' do
app.update!(owner: nil)
expect(user.token_for_app(app)).to be_nil
end
end
2018-05-02 12:13:52 +00:00
describe '#disable!' do
subject(:user) { Fabricate(:user, disabled: false, current_sign_in_at: current_sign_in_at, last_sign_in_at: nil) }
2018-05-02 12:13:52 +00:00
let(:current_sign_in_at) { Time.zone.now }
before do
user.disable!
end
it 'disables user' do
expect(user).to have_attributes(disabled: true)
2018-05-02 12:13:52 +00:00
end
end
describe '#enable!' do
subject(:user) { Fabricate(:user, disabled: true) }
before do
user.enable!
end
it 'enables user' do
expect(user).to have_attributes(disabled: false)
end
end
describe '#reset_password!' do
subject(:user) { Fabricate(:user, password: 'foobar12345') }
let!(:session_activation) { Fabricate(:session_activation, user: user) }
let!(:access_token) { Fabricate(:access_token, resource_owner_id: user.id) }
let!(:web_push_subscription) { Fabricate(:web_push_subscription, access_token: access_token) }
let(:redis_pipeline_stub) { instance_double(Redis::Namespace, publish: nil) }
before do
allow(redis).to receive(:pipelined).and_yield(redis_pipeline_stub)
user.reset_password!
end
it 'changes the password immediately' do
expect(user.external_or_valid_password?('foobar12345')).to be false
end
it 'deactivates all sessions' do
expect(user.session_activations.count).to eq 0
expect { session_activation.reload }.to raise_error(ActiveRecord::RecordNotFound)
end
it 'revokes all access tokens' do
expect(Doorkeeper::AccessToken.active_for(user).count).to eq 0
end
it 'revokes streaming access for all access tokens' do
expect(redis_pipeline_stub).to have_received(:publish).with("timeline:access_token:#{access_token.id}", Oj.dump(event: :kill)).once
end
it 'removes push subscriptions' do
expect(Web::PushSubscription.where(user: user).or(Web::PushSubscription.where(access_token: access_token)).count).to eq 0
expect { web_push_subscription.reload }.to raise_error(ActiveRecord::RecordNotFound)
end
end
describe '#mark_email_as_confirmed!' do
subject { user.mark_email_as_confirmed! }
2018-05-02 12:13:52 +00:00
let!(:user) { Fabricate(:user, confirmed_at: confirmed_at) }
2018-05-02 12:13:52 +00:00
context 'when user is new' do
let(:confirmed_at) { nil }
it 'confirms user and delivers welcome email', :inline_jobs do
emails = capture_emails { subject }
2018-05-02 12:13:52 +00:00
expect(user.confirmed_at).to be_present
expect(emails.size)
.to eq(1)
expect(emails.first)
.to have_attributes(
to: contain_exactly(user.email),
subject: eq(I18n.t('user_mailer.welcome.subject'))
)
2018-05-02 12:13:52 +00:00
end
end
context 'when user is not new' do
let(:confirmed_at) { Time.zone.now }
it 'confirms user but does not deliver welcome email' do
emails = capture_emails { subject }
2018-05-02 12:13:52 +00:00
expect(user.confirmed_at).to be_present
expect(emails).to be_empty
2018-05-02 12:13:52 +00:00
end
end
end
describe '#active_for_authentication?' do
subject { user.active_for_authentication? }
2018-05-02 12:13:52 +00:00
let(:user) { Fabricate(:user, disabled: disabled, confirmed_at: confirmed_at) }
context 'when user is disabled' do
let(:disabled) { true }
context 'when user is confirmed' do
let(:confirmed_at) { Time.zone.now }
it { is_expected.to be true }
2018-05-02 12:13:52 +00:00
end
context 'when user is not confirmed' do
let(:confirmed_at) { nil }
it { is_expected.to be true }
2018-05-02 12:13:52 +00:00
end
end
context 'when user is not disabled' do
let(:disabled) { false }
context 'when user is confirmed' do
let(:confirmed_at) { Time.zone.now }
it { is_expected.to be true }
end
context 'when user is not confirmed' do
let(:confirmed_at) { nil }
it { is_expected.to be true }
2018-05-02 12:13:52 +00:00
end
end
end
describe '.those_who_can' do
before { Fabricate(:user, role: UserRole.find_by(name: 'Moderator')) }
context 'when there are not any user roles' do
before { UserRole.destroy_all }
it 'returns an empty list' do
expect(described_class.those_who_can(:manage_blocks)).to eq([])
end
end
context 'when there are not users with the needed role' do
it 'returns an empty list' do
expect(described_class.those_who_can(:manage_blocks)).to eq([])
end
end
context 'when there are users with roles' do
let!(:admin_user) { Fabricate(:user, role: UserRole.find_by(name: 'Admin')) }
it 'returns the users with the role' do
expect(described_class.those_who_can(:manage_blocks)).to eq([admin_user])
end
end
end
2016-02-22 15:00:20 +00:00
end