From bbeb3fc79d6c64084a0328fc6886e160cb3cdfb4 Mon Sep 17 00:00:00 2001
From: Molly Struve <mollylbs@gmail.com>
Date: Fri, 7 Feb 2020 09:56:29 -0500
Subject: [PATCH] Ensure user is authenticated before doing onboarding Actions
 (#5937)

* ensure user is authenticated before doing onboarding checks

* add specs for authenticating users for onboarding updates
---
 app/controllers/users_controller.rb    |  1 +
 spec/requests/users_onboarding_spec.rb | 23 +++++++++++++++++++----
 2 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index a1b0ec9d1..138721abc 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -3,6 +3,7 @@ class UsersController < ApplicationController
   before_action :raise_banned, only: %i[update]
   before_action :set_user, only: %i[update update_twitch_username update_language_settings confirm_destroy request_destroy full_delete remove_association]
   after_action :verify_authorized, except: %i[signout_confirm add_org_admin remove_org_admin remove_from_org]
+  before_action :authenticate_user!, only: %i[onboarding_update onboarding_checkbox_update]
 
   # GET /settings/@tab
   def edit
diff --git a/spec/requests/users_onboarding_spec.rb b/spec/requests/users_onboarding_spec.rb
index 895b102df..238f10835 100644
--- a/spec/requests/users_onboarding_spec.rb
+++ b/spec/requests/users_onboarding_spec.rb
@@ -3,14 +3,29 @@ require "rails_helper"
 RSpec.describe "UsersOnboarding", type: :request do
   let(:user) { create(:user, saw_onboarding: false) }
 
-  before do
-    sign_in user
-  end
-
   describe "PATCH /onboarding_update" do
     it "updates saw_onboarding boolean" do
+      sign_in user
       patch "/onboarding_update.json", params: {}
       expect(user.saw_onboarding).to eq(true)
     end
+
+    it "returns a not found error if user is not signed in" do
+      patch "/onboarding_update.json", params: {}
+      expect(response.parsed_body["error"]).to include("Please sign in")
+    end
+  end
+
+  describe "PATCH /onboarding_checkbox_update" do
+    it "updates saw_onboarding boolean" do
+      sign_in user
+      patch "/onboarding_checkbox_update.json", params: {}
+      expect(user.saw_onboarding).to eq(true)
+    end
+
+    it "returns a not found error if user is not signed in" do
+      patch "/onboarding_checkbox_update.json", params: {}
+      expect(response.parsed_body["error"]).to include("Please sign in")
+    end
   end
 end