test fixes

.gitignore

@@ -45,4 +45,3 @@ node_modules/
 /storage/*
 !/storage/.keep
 /public/uploads
-.rspec_status

app/controllers/users/sessions_controller.rb

@@ -2,22 +2,45 @@ module Users
   class SessionsController < Devise::SessionsController
     respond_to :json
 
+    before_action :set_json_format
+
     prepend_before_action only: :destroy do
       unless warden.authenticated?(:user)
         render json: { error: "Unauthorized", code: "unauthorized" }, status: :unauthorized
       end
     end
 
     def create
-      resource = warden.authenticate!(auth_options)
-      sign_in(resource_name, resource)
-      token, = Warden::JWTAuth::UserEncoder.new.call(resource, :user, nil)
-      render json: { token: token, user: { id: resource.id, email: resource.email } }, status: :ok
+      credentials = sign_in_params
+      resource = User.find_for_database_authentication(email: credentials[:email])
+
+      if resource&.valid_password?(credentials[:password])
+        sign_in(resource_name, resource)
+        token, = Warden::JWTAuth::UserEncoder.new.call(resource, :user, nil)
+        render json: { token: token, user: { id: resource.id, email: resource.email } }, status: :ok
+      else
+        render json: { error: "Invalid Email or password.", code: "unauthorized" }, status: :unauthorized
+      end
     end
 
     def destroy
       sign_out(current_user)
       head :no_content
     end
+
+    private
+
+    def set_json_format
+      request.format = :json
+    end
+
+    def sign_in_params
+      source = params[:user].presence || params
+
+      {
+        email: source[:email].to_s.strip.downcase,
+        password: source[:password].to_s
+      }
+    end
   end
 end

config/initializers/cors.rb

@@ -11,6 +11,18 @@
     origins = ENV["CORS_ALLOWED_ORIGINS"]&.split(",") || ["http://localhost:5174"]
     origins origins
 
+    resource "/users/sign_in",
+      headers: :any,
+      methods: %i[get post put patch delete options head],
+      credentials: false,
+      max_age: 600
+
+    resource "/users/sign_out",
+      headers: :any,
+      methods: %i[get post put patch delete options head],
+      credentials: false,
+      max_age: 600  
+
     resource "/api/*",
       headers: :any,
       methods: %i[get post put patch delete options head],

config/routes.rb

@@ -2,7 +2,9 @@
   namespace :api do
     namespace :v1 do
       resource :me, only: :show, controller: :me
-      resources :attendance_entries, only: %i[index create update destroy]
+      resources :attendance_entries, only: %i[index create destroy] do
+        member { put :update, action: :update }
+      end
     end
   end
   devise_for :users, controllers: { sessions: 'users/sessions' }

spec/integration/attendance_entries_update_destroy_spec.rb

@@ -2,7 +2,7 @@
 
 RSpec.describe 'AttendanceEntries API', type: :request do
   path '/api/v1/attendance_entries/{id}' do
-    patch 'Update an attendance entry' do
+    put 'Update an attendance entry' do
       tags 'AttendanceEntries'
       consumes 'application/json'
       produces 'application/json'

spec/integration/auth_spec.rb

@@ -0,0 +1,131 @@
+require 'swagger_helper'
+
+RSpec.describe 'Auth API', type: :request do
+  path '/users/sign_in' do
+    post 'Sign in and receive JWT' do
+      tags 'Auth'
+      consumes 'application/json'
+      produces 'application/json'
+      parameter name: :user, in: :body, schema: {
+        type: :object,
+        properties: {
+          user: {
+            type: :object,
+            properties: {
+              email: { type: :string, format: :email },
+              password: { type: :string }
+            },
+            required: %w[email password]
+          }
+        },
+        required: ['user']
+      }
+
+      response '200', 'signed in' do
+        schema type: :object,
+               properties: {
+                 token: { type: :string },
+                 user: {
+                   type: :object,
+                   properties: {
+                     id: { type: :integer },
+                     email: { type: :string, format: :email }
+                   },
+                   required: %w[id email]
+                 }
+               },
+               required: %w[token user]
+
+        let(:existing_user) { create(:user, email: 'auth@example.com', password: 'password') }
+        let(:user) { { user: { email: existing_user.email, password: 'password' } } }
+
+        run_test!
+      end
+
+      response '401', 'unauthorized' do
+        schema type: :object,
+               properties: {
+                 error: { type: :string },
+                 code: { type: :string, example: 'unauthorized' }
+               },
+               required: %w[error code]
+
+        let(:user) { { user: { email: 'auth@example.com', password: 'wrong' } } }
+
+        run_test!
+      end
+    end
+  end
+
+  path '/users/sign_out' do
+    delete 'Revoke current JWT' do
+      tags 'Auth'
+      produces 'application/json'
+      parameter name: :Authorization, in: :header, type: :string, required: false, description: 'Bearer token'
+
+      response '204', 'signed out' do
+        let(:auth_user) { create(:user, email: 'logout@example.com', password: 'password') }
+        let(:Authorization) do
+          post '/users/sign_in', params: { user: { email: auth_user.email, password: 'password' } }, as: :json
+          "Bearer #{response.parsed_body.fetch('token')}"
+        end
+
+        run_test!
+      end
+
+      response '401', 'unauthorized' do
+        schema type: :object,
+               properties: {
+                 error: { type: :string },
+                 code: { type: :string, example: 'unauthorized' }
+               },
+               required: %w[error code]
+
+        let(:Authorization) { nil }
+
+        run_test!
+      end
+    end
+  end
+
+  path '/api/v1/me' do
+    get 'Get current authenticated user' do
+      tags 'Auth'
+      produces 'application/json'
+      parameter name: :Authorization, in: :header, type: :string, required: true, description: 'Bearer token'
+
+      response '200', 'current user' do
+        schema type: :object,
+               properties: {
+                 user: {
+                   type: :object,
+                   properties: {
+                     id: { type: :integer },
+                     email: { type: :string, format: :email }
+                   },
+                   required: %w[id email]
+                 }
+               },
+               required: ['user']
+
+        let(:me_user) { create(:user, email: 'me@example.com') }
+        let(:Authorization) { "Bearer #{Warden::JWTAuth::UserEncoder.new.call(me_user, :user, nil).first}" }
+
+        run_test!
+      end
+
+      response '401', 'unauthorized' do
+        schema type: :object,
+               properties: {
+                 error: { type: :string },
+                 code: { type: :string, example: 'unauthorized' }
+               },
+               required: %w[error code]
+
+        let(:Authorization) { nil }
+
+        run_test!
+      end
+    end
+  end
+end

spec/requests/api/v1/attendance_entries_spec.rb

@@ -31,25 +31,25 @@ def auth_headers(user)
     end
   end
 
-  describe "PATCH /api/v1/attendance_entries/:id" do
+  describe "PUT /api/v1/attendance_entries/:id" do
     let!(:entry) { create(:attendance_entry, user: user, student_name: "Old") }
     let!(:other_entry) { create(:attendance_entry, user: other_user) }
 
     it "updates an entry owned by the user" do
-      patch "/api/v1/attendance_entries/#{entry.id}",
-            params: { attendance_entry: { student_name: "New" } },
-            headers: auth_headers(user),
-            as: :json
+      put "/api/v1/attendance_entries/#{entry.id}",
+          params: { attendance_entry: { student_name: "New" } },
+          headers: auth_headers(user),
+          as: :json
 
       expect(response).to have_http_status(:ok)
       expect(entry.reload.student_name).to eq("New")
     end
 
     it "returns 404 when trying to update someone else's entry" do
-      patch "/api/v1/attendance_entries/#{other_entry.id}",
-            params: { attendance_entry: { student_name: "Hax" } },
-            headers: auth_headers(user),
-            as: :json
+      put "/api/v1/attendance_entries/#{other_entry.id}",
+          params: { attendance_entry: { student_name: "Hax" } },
+          headers: auth_headers(user),
+          as: :json
 
       expect(response).to have_http_status(:not_found)
     end

spec/requests/api/v1/sessions_spec.rb

@@ -21,6 +21,18 @@ def sign_in_user(user)
       expect(token).to be_present
     end
 
+    it "accepts a flat payload from the frontend" do
+      post "/users/sign_in",
+           params: { email: user.email, password: user.password },
+           as: :json
+
+      expect(response).to have_http_status(:ok)
+      expect(response.parsed_body).to include(
+        "token" => a_kind_of(String),
+        "user" => include("email" => user.email)
+      )
+    end
+
     it "returns unauthorized on bad credentials" do
       post "/users/sign_in",
            params: { user: { email: user.email, password: "wrong" } },