Ensure user is authenticated before doing onboarding Actions (#5937)

* ensure user is authenticated before doing onboarding checks

* add specs for authenticating users for onboarding updates

app/controllers/users_controller.rb

@@ -3,6 +3,7 @@ class UsersController < ApplicationController
   before_action :raise_banned, only: %i[update]
   before_action :set_user, only: %i[update update_twitch_username update_language_settings confirm_destroy request_destroy full_delete remove_association]
   after_action :verify_authorized, except: %i[signout_confirm add_org_admin remove_org_admin remove_from_org]
+  before_action :authenticate_user!, only: %i[onboarding_update onboarding_checkbox_update]
 
   # GET /settings/@tab
   def edit

spec/requests/users_onboarding_spec.rb

@@ -3,14 +3,29 @@ require "rails_helper"
 RSpec.describe "UsersOnboarding", type: :request do
   let(:user) { create(:user, saw_onboarding: false) }
 
-  before do
-    sign_in user
-  end
-
   describe "PATCH /onboarding_update" do
     it "updates saw_onboarding boolean" do
+      sign_in user
       patch "/onboarding_update.json", params: {}
       expect(user.saw_onboarding).to eq(true)
     end
+
+    it "returns a not found error if user is not signed in" do
+      patch "/onboarding_update.json", params: {}
+      expect(response.parsed_body["error"]).to include("Please sign in")
+    end
+  end
+
+  describe "PATCH /onboarding_checkbox_update" do
+    it "updates saw_onboarding boolean" do
+      sign_in user
+      patch "/onboarding_checkbox_update.json", params: {}
+      expect(user.saw_onboarding).to eq(true)
+    end
+
+    it "returns a not found error if user is not signed in" do
+      patch "/onboarding_checkbox_update.json", params: {}
+      expect(response.parsed_body["error"]).to include("Please sign in")
+    end
   end
 end