fix: .password_valid? for nil

kiqr · Apr 3, 2024 · c9e7047 · c9e7047
1 parent d611832
commit c9e7047
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 1 deletion.
diff --git a/app/controllers/users/sessions_controller.rb b/app/controllers/users/sessions_controller.rb
@@ -25,7 +25,7 @@ def show_otp_code_form
     session.delete(:otp_user_id)
 
     self.resource = User.find_by(email: sign_in_params[:email])
-    if resource.valid_password?(sign_in_params[:password]) && resource.otp_required_for_login?
+    if resource&.otp_required_for_login? && resource&.valid_password?(sign_in_params[:password])
       session[:otp_user_id] = resource.id
       render :otp, status: :unprocessable_entity
     end

diff --git a/test/controllers/users/sessions_controller_test.rb b/test/controllers/users/sessions_controller_test.rb
@@ -14,4 +14,17 @@ class Users::SessionsControllerTest < ActionDispatch::IntegrationTest
     assert_response :redirect
     assert_redirected_to dashboard_path
   end
+
+  test "renders form again if invalid email" do
+    post user_session_path, params: {user: {email: "unknown.email", password: "randompassword"}}
+    assert_response :unprocessable_entity
+    assert_template "users/sessions/new"
+  end
+
+  test "renders form again if invalid password" do
+    user = create(:user)
+    post user_session_path, params: {user: {email: user.email, password: "randompassword"}}
+    assert_response :unprocessable_entity
+    assert_template "users/sessions/new"
+  end
 end