Added account confirmation emails for email registrations "fixes #3896"

.gitignore

@@ -106,4 +106,4 @@ features/support/fixtures/cassettes/**
 /config/master.key
 
 /app/assets/builds/*
-!/app/assets/builds/.keep
+!/app/assets/builds/.keep

README.md

@@ -56,4 +56,4 @@ rake user:create_anonymous
 rake vcr_billy_caches:reset
 ```
 
-Updating the pages requires the administrator to run the `rake fetch_github:content_for_static_pages` task.
+Updating the pages requires the administrator to run the `rake fetch_github:content_for_static_pages` task.

app/models/user.rb

@@ -11,8 +11,8 @@ class User < ApplicationRecord
   def_delegator :karma, :hangouts_attended_with_more_than_one_participant
 
   # Include default devise modules. Others available are:
-  # :confirmable, :lockable, :timeoutable and :omniauthable
-  devise :database_authenticatable, :registerable,
+  # :lockable, :timeoutable and :omniauthable
+  devise :database_authenticatable, :registerable, :confirmable,
          :recoverable, :rememberable, :trackable, :validatable
 
   geocoded_by :last_sign_in_ip do |user, results|

db/migrate/20230812031020_add_confirmable_to_users.rb

@@ -0,0 +1,8 @@
+class AddConfirmableToUsers < ActiveRecord::Migration[7.0]
+  def change
+    add_column :users, :confirmation_token, :string
+    add_column :users, :confirmed_at, :datetime
+    add_column :users, :confirmation_sent_at, :datetime
+    add_index :users, :confirmation_token, unique: true
+  end
+end

db/migrate/20230812040924_add_unconfirmed_email_to_users.rb

@@ -0,0 +1,5 @@
+class AddUnconfirmedEmailToUsers < ActiveRecord::Migration[7.0]
+  def change
+    add_column :users, :unconfirmed_email, :string
+  end
+end

db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[7.0].define(version: 2023_03_14_193359) do
+ActiveRecord::Schema[7.0].define(version: 2023_08_12_061445) do
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
 
@@ -363,6 +363,11 @@
     t.integer "event_participation_count", default: 0
     t.boolean "can_see_dashboard", default: false
     t.boolean "admin"
+    t.string "confirmation_token"
+    t.datetime "confirmed_at"
+    t.datetime "confirmation_sent_at"
+    t.string "unconfirmed_email"
+    t.index ["confirmation_token"], name: "index_users_on_confirmation_token", unique: true
     t.index ["deleted_at"], name: "index_users_on_deleted_at"
     t.index ["email"], name: "index_users_on_email", unique: true
     t.index ["reset_password_token"], name: "index_users_on_reset_password_token", unique: true

features/step_definitions/user_steps.rb

@@ -30,7 +30,7 @@
                                  password: password,
                                  password_confirmation: password)
   set_user_as_premium(@user) if premium
-
+  
   visit new_user_session_path
   within('#main') do
     fill_in 'user_email', with: email
@@ -257,6 +257,32 @@ def set_user_as_premium(user, plan = 'Premium')
   expect(page).to_not have_content 'Log out'
 end
 
+And(/^I visit login page/) do
+  visit new_user_session_path
+end
+
+Then(/^a confirmation email should be sent/) do
+  expect(ActionMailer::Base.deliveries.count).to eq(2)
+  # expect(ActionMailer::Base.deliveries[0].to).to include('[email protected]')
+  expect(ActionMailer::Base.deliveries[0].body.to_s).to include(User.last.confirmation_token)
+end
+
+Then(/^I should see a confirmation-email-sent message/) do
+  expect(page).to have_content('A message with a confirmation link has been sent to your email address. Please open the link to activate your account.')
+end
+
+Then(/^I go to the email confirmation link/) do
+  visit ("/users/confirmation?confirmation_token=#{User.last.confirmation_token}")
+end
+
+Then(/^I should see a successful confirmation message/) do
+  expect(page).to have_content('Your account was successfully confirmed.')
+end
+
+Then(/^I should see confirm-your-account-before-continuing message/) do
+  expect(page).to have_content('You have to confirm your account before continuing.')
+end
+
 Then(/^I see a successful sign in message$/) do
   expect(page).to have_content 'Signed in successfully.'
 end

features/users/confirm_user_email.feature

@@ -0,0 +1,104 @@
+Feature: As a developer
+  In order to be able to use the sites features
+  I want to register as a user
+  https://www.pivotaltracker.com/story/show/63047058
+
+  Background:
+    Given I am not logged in
+    And the following pages exist
+      | title           | body                    |
+      | Getting Started | Remote Pair Programming |
+
+  Scenario: Let a visitor register as a site user
+    Given I am on the "registration" page
+    And I submit "[email protected]" as username
+    And I submit "password" as password
+    And I click "Sign up" button
+
+    Then a confirmation email should be sent
+    Then I should see a confirmation-email-sent message
+    And I should see "Signed up successfully."
+
+    And I go to the email confirmation link
+    Then I should see a successful confirmation message
+
+  Scenario: User signs up successfully with no consent for mailings
+    When I sign up with valid user data
+
+    Then a confirmation email should be sent
+    Then I should see a confirmation-email-sent message
+    And I should see "Signed up successfully."
+
+    And I go to the email confirmation link
+    Then I should see a successful confirmation message
+
+    And I visit login page
+    When I sign in with valid credentials
+
+    Then I should see "Signed in successfully."
+    And I should be on the "getting started" page
+
+    And I go to my "edit profile" page
+    Then "receive mailings" should not be checked
+
+  Scenario: User signs up successfully giving consent for mailings
+    When I sign up with valid user data giving consent
+
+    Then a confirmation email should be sent
+    Then I should see a confirmation-email-sent message
+    And I should see "Signed up successfully."
+
+    And I go to the email confirmation link
+    Then I should see a successful confirmation message
+
+    And I visit login page
+    When I sign in with valid credentials
+
+    Then I should see "Signed in successfully."
+    And I should be on the "getting started" page
+
+    And I go to my "edit profile" page
+    Then "receive mailings" should be checked
+
+  Scenario: User cannot sign in if email unconfirmed
+    When I sign up with valid user data giving consent
+
+    Then a confirmation email should be sent
+    Then I should see a confirmation-email-sent message
+    And I should see "Signed up successfully."
+
+    And I visit login page
+    When I sign in with valid credentials
+
+    Then I should see confirm-your-account-before-continuing message
+
+
+
+    @omniauth
+  Scenario: User signs up with a GitHub account
+    Given I am on the "registration" page
+    When I click "GitHub"
+
+    Then a confirmation email should be sent
+    And I should see "Signed up successfully."
+
+    And I go to the email confirmation link
+    Then I should see a successful confirmation message
+
+
+    @omniauth
+  Scenario: User signs in with a Confirmed GitHub account
+    Given I am on the "registration" page
+    When I click "GitHub"
+
+    Then a confirmation email should be sent
+    And I should see "Signed up successfully."
+
+    And I go to the email confirmation link
+    Then I should see a successful confirmation message
+
+    And I visit login page
+    When I click "GitHub"
+
+    Then I should see "Signed in successfully."
+    And I should be on the "getting started" page

features/users/sign_up.feature

@@ -15,23 +15,37 @@ Feature: As a developer
     And I submit "[email protected]" as username
     And I submit "password" as password
     And I click "Sign up" button
-    Then I should be on the "getting started" page
+    Then a confirmation email should be sent
+    Then I should see a confirmation-email-sent message
     And I should see "Signed up successfully."
-    And the page should contain the google adwords conversion code
-    And the user "[email protected]" should have karma
-    And I should see a successful sign up message
-    And I should receive a "Welcome to AgileVentures.org" email
-    And replies to that email should go to "[email protected]"
+    And I go to the email confirmation link
+    Then I should see a successful confirmation message
 
  Scenario: User signs up successfully with no consent for mailings
     When I sign up with valid user data
-    Then I should see a successful sign up message
+    Then a confirmation email should be sent
+    Then I should see a confirmation-email-sent message
+    And I should see "Signed up successfully."
+    And I go to the email confirmation link
+    Then I should see a successful confirmation message
+    And I visit login page
+    When I sign in with valid credentials
+    Then I should see "Signed in successfully."
+    And I should be on the "getting started" page
     And I go to my "edit profile" page
     Then "receive mailings" should not be checked
 
 Scenario: User signs up successfully giving consent for mailings
     When I sign up with valid user data giving consent
-    Then I should see a successful sign up message
+    Then a confirmation email should be sent
+    Then I should see a confirmation-email-sent message
+    And I should see "Signed up successfully."
+    And I go to the email confirmation link
+    Then I should see a successful confirmation message
+    And I visit login page
+    When I sign in with valid credentials
+    Then I should see "Signed in successfully."
+    And I should be on the "getting started" page
     And I go to my "edit profile" page
     Then "receive mailings" should be checked
 
@@ -55,9 +69,13 @@ Scenario: User signs up successfully giving consent for mailings
   Scenario: User signs up with a GitHub account
     Given I am on the "registration" page
     When I click "GitHub"
-    Then I should see "Signed in successfully."
+    Then a confirmation email should be sent
     And I should see "Signed up successfully."
-    And the page should contain the google adwords conversion code
+    And I go to the email confirmation link
+    Then I should see a successful confirmation message
+    And I visit login page
+    When I click "GitHub"
+    Then I should see "Signed in successfully."
     And I should be on the "getting started" page
 
   # @omniauth

lib/tasks/updated_confirmed_at_users.rake

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+task updated_confirmed_at_users: :environment do
+  User.all.each do |user|
+    user.update(confirmed_at: DateTime.now)
+  end
+end

spec/factories/users.rb

@@ -20,6 +20,7 @@
     slug { "#{first_name} #{last_name}".parameterize }
     bio { Faker::Lorem.sentence }
     skill_list { Faker::Lorem.words(number: 4) }
+    confirmed_at {DateTime.now}
 
     after(:save) do |user, evaluator|
       create(:authentication, provider: 'gplus', uid: evaluator.gplus, user_id: user.id)

spec/features/confirm_user_email_spec.rb

@@ -0,0 +1,42 @@
+require 'rails_helper'
+
+describe 'Confirm user email to create account' do
+  feature 'Users signs up' do
+
+    setup do
+      visit new_user_registration_path
+      fill_in 'user_email', with: '[email protected]'
+      fill_in 'user_password', with: 'changemesomeday'
+      fill_in 'user_password_confirmation', with: 'changemesomeday'
+      click_button 'Sign up'
+    end
+
+    scenario 'confirmation email sent on user signup' do
+      expect(User.last.email).to eq('[email protected]')
+
+      expect(ActionMailer::Base.deliveries.count).to eq(2)
+      expect(ActionMailer::Base.deliveries[0].to).to include('[email protected]')
+      expect(ActionMailer::Base.deliveries[0].body.to_s).to include(User.last.confirmation_token)
+    end
+
+    scenario 'confirmation_token link confirms account' do
+      expect(ActionMailer::Base.deliveries[0].body.to_s).to include(User.last.confirmation_token)
+      visit ("/users/confirmation?confirmation_token=#{User.last.confirmation_token}")
+      expect(page).to have_content('Your account was successfully confirmed.')
+    end
+
+
+    scenario 'user cannot sign in for session if email unconfirmed' do
+      expect(ActionMailer::Base.deliveries[0].body.to_s).to include(User.last.confirmation_token)
+      expect(page).to have_content('A message with a confirmation link has been sent to your email address. Please open the link to activate your account.')
+      expect(page).to have_content('Signed up successfully.')
+
+      visit new_user_session_path
+      fill_in 'user_email', with: '[email protected]'
+      fill_in 'user_password', with: 'changemesomeday'
+      click_button 'Sign in'
+      expect(page).to have_content('You have to confirm your account before continuing.')
+    end
+
+  end
+end

spec/features/project_create_and_approval_spec.rb

@@ -1,8 +1,8 @@
 # frozen_string_literal: true
 
 RSpec.describe 'Project is subject to approval' do
-  let!(:admin) { create(:user, admin: true) }
-  let!(:user) { create(:user, admin: false) }
+  let!(:admin) { create(:user, admin: true, confirmed_at: DateTime.now) }
+  let!(:user) { create(:user, admin: false, confirmed_at: DateTime.now) }
 
   subject { page }
 

spec/mailers/sandbox_email_interceptor_spec.rb

@@ -3,9 +3,9 @@
 describe SandboxEmailInterceptor do
   describe '#delivering_email' do
     before(:each) do
-      @user1 = FactoryBot.create(:user)
+      @user1 = FactoryBot.create(:user, confirmed_at: DateTime.now)
       @project = FactoryBot.create(:project, user: @user1)
-      @user2 = FactoryBot.create(:user)
+      @user2 = FactoryBot.create(:user, confirmed_at: DateTime.now)
     end
     it 'delivers all emails to user when intercept_emails is set to true' do
       stub_const('ENV', { 'USER_EMAIL' => '[email protected]' })

spec/requests/events_spec.rb

@@ -2,7 +2,7 @@
 
 require 'capybara/rspec'
 describe 'Events' do
-  let(:user) { User.create!(email: '[email protected]', password: '123456789') }
+  let(:user) { User.create!(email: '[email protected]', password: '123456789', confirmed_at: DateTime.now) }
 
   before { login }