test: options_for_get and options_for_create endpoints

Author: nicolastemciuc

spec/requests/devise/passkeys_controller_spec.rb

@@ -117,4 +117,62 @@
       end
     end
   end
+
+  # rubocop:disable RSpec/MultipleExpectations
+  describe "GET #options_for_get" do
+    it "returns authentication options and stores the challenge in the session" do
+      get options_for_get_account_passkeys_path
+
+      expect(response).to have_http_status(:ok)
+      expect(response.media_type).to eq("application/json")
+
+      body = response.parsed_body
+      expect(body).to include("challenge")
+      expect(session[:authentication_challenge]).to be_present
+    end
+  end
+
+  describe "GET #options_for_create" do
+    context "when user is authenticated" do
+      before do
+        sign_in user, scope: :account
+      end
+
+      it "returns passkey creation options and stores the challenge in the session" do
+        get options_for_create_account_passkeys_path
+
+        expect(response).to have_http_status(:ok)
+        expect(response.media_type).to eq("application/json")
+
+        body = response.parsed_body
+        expect(body).to include("challenge")
+        expect(body.dig("user", "name")).to eq(user.email)
+        expect(session[:webauthn_challenge]).to be_present
+      end
+
+      it "includes existing passkeys in the excludeCredentials list" do
+        user.passkeys.create!(
+          external_id: "existing-external-id",
+          name: "Existing Passkey",
+          public_key: "public-key",
+          sign_count: 0
+        )
+
+        get options_for_create_account_passkeys_path
+
+        body = response.parsed_body
+        exclude_credentials = body["excludeCredentials"] || []
+
+        expect(exclude_credentials.size).to eq(user.passkeys.count)
+      end
+    end
+
+    context "when user is not authenticated" do
+      it "redirects to the sign-in page" do
+        get options_for_create_account_passkeys_path
+        expect(response).to redirect_to(new_account_session_path)
+      end
+    end
+  end
+  # rubocop:enable RSpec/MultipleExpectations
 end

spec/requests/devise/second_factor_webauthn_credentials_controller_spec.rb

@@ -121,4 +121,87 @@
       end
     end
   end
+
+  # rubocop:disable RSpec/MultipleExpectations
+  describe "GET #options_for_get" do
+    before do
+      user.webauthn_credentials.create!(
+        external_id: "second-factor-id",
+        name: "Second Factor Key",
+        public_key: "pk",
+        sign_count: 0
+      )
+
+      # rubocop:disable RSpec/AnyInstance
+      allow_any_instance_of(described_class)
+        .to receive(:set_resource) do |instance|
+          instance.instance_variable_set(:@resource, user)
+        end
+      # rubocop:enable RSpec/AnyInstance
+    end
+
+    it "returns authentication options and stores the challenge in the session" do
+      get options_for_get_account_second_factor_webauthn_credentials_path
+
+      expect(response).to have_http_status(:ok)
+      expect(response.media_type).to eq("application/json")
+
+      body = response.parsed_body
+      expect(body).to include("challenge")
+      expect(body["userVerification"]).to eq("discouraged")
+
+      expect(body["allowCredentials"].size).to eq(1)
+
+      expect(session[:two_factor_authentication_challenge]).to be_present
+    end
+  end
+
+  describe "GET #options_for_create" do
+    context "when user is authenticated" do
+      before do
+        sign_in user, scope: :account
+      end
+
+      it "returns security key creation options and stores the challenge in the session" do
+        get options_for_create_account_second_factor_webauthn_credentials_path
+
+        expect(response).to have_http_status(:ok)
+        expect(response.media_type).to eq("application/json")
+
+        body = response.parsed_body
+        expect(body).to include("challenge")
+        expect(body.dig("user", "name")).to eq(user.email)
+
+        expect(body.dig("authenticatorSelection", "residentKey")).to eq("discouraged")
+        expect(body.dig("authenticatorSelection", "userVerification")).to eq("discouraged")
+
+        expect(session[:webauthn_challenge]).to be_present
+      end
+
+      it "includes existing first-factor credentials in the excludeCredentials list" do
+        user.webauthn_credentials.create!(
+          external_id: "existing-id",
+          name: "Existing Key",
+          public_key: "pk",
+          sign_count: 0
+        )
+
+        get options_for_create_account_second_factor_webauthn_credentials_path
+
+        body = response.parsed_body
+        exclude_credentials = body["excludeCredentials"] || []
+
+        expect(exclude_credentials.size).to eq(user.webauthn_credentials.count)
+      end
+    end
+
+    context "when user is not authenticated" do
+      it "redirects to the sign-in page" do
+        get options_for_create_account_second_factor_webauthn_credentials_path
+
+        expect(response).to redirect_to(new_account_session_path)
+      end
+    end
+  end
+  # rubocop:enable RSpec/MultipleExpectations
 end