Initial commit

spec/api/v2/identity/general_spec.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe API::V2::Identity::General do
+  describe 'GET /api/v2/identity/time' do
+    it 'returns a server status' do
+      get '/api/v2/identity/ping'
+      expect_status_to_eq(200)
+      expect(json_body[:ping]).to eq('pong')
+    end
+  end
+
+  describe 'GET /api/v2/identity/time' do
+    it 'returns a current UNIX time' do
+      get '/api/v2/identity/time'
+      expect_status_to_eq(200)
+      expect(json_body[:time].to_i).to be <= Time.now.to_i
+    end
+  end
+
+  describe 'GET /api/v2/identity/configs' do
+    it 'returns some of the configurations' do
+      get '/api/v2/identity/configs'
+      expect_status_to_eq(200)
+      expect(json_body[:session_expire_time]).to eq(Barong::App.config.session_expire_time)
+      expect(json_body[:captcha_type]).to eq(Barong::App.config.captcha)
+      expect(json_body[:phone_verification_type]).to eq(Barong::App.config.phone_verification)
+    end
+
+    it 'returns all of the configurations with defaults' do
+      get '/api/v2/identity/configs'
+      expect_status_to_eq(200)
+      expect(json_body[:session_expire_time]).to eq(Barong::App.config.session_expire_time)
+      expect(json_body[:captcha_type]).to eq(Barong::App.config.captcha)
+      expect(json_body[:phone_verification_type]).to eq(Barong::App.config.phone_verification)
+      expect(json_body[:password_min_entropy]).to eq(Barong::App.config.password_min_entropy)
+      expect(json_body[:password_regexp]).to eq(Barong::App.config.password_regexp.to_s)
+    end
+  end
+end

spec/api/v2/identity/sessions_spec.rb

@@ -0,0 +1,462 @@
+# frozen_string_literal: true
+
+describe API::V2::Identity::Sessions do
+  include_context 'geoip mock'
+
+  include ActiveSupport::Testing::TimeHelpers
+  let!(:create_member_permission) do
+    create :permission,
+           role: 'member',
+           verb: 'all'
+  end
+  before do
+    Rails.cache.delete('permissions')
+    allow(Barong::App.config).to receive_messages(captcha: 'recaptcha')
+  end
+
+  describe 'POST /api/v2/identity/sessions' do
+    before { allow(Barong::App.config).to receive_messages(captcha: 'none') }
+
+    let!(:email) { 'user@gmail.com' }
+    let!(:password) { 'testPassword111' }
+    let(:uri) { '/api/v2/identity/sessions' }
+    subject!(:user) do
+      create :user,
+            :with_profile,
+             email: email,
+             password: password,
+             password_confirmation: password
+    end
+    let(:otp_enabled) { false }
+
+    context 'With valid params' do
+      let(:do_request) { post uri, params: params }
+      let(:session_expire_time) do
+        Barong::App.config.session_expire_time
+      end
+      let(:check_session) do
+        get '/api/v2/auth/api/v2/tasty_endpoint'
+      end
+      let(:params) do
+        {
+          email: email,
+          password: password
+        }
+      end
+
+      context 'captcha behaviour when captcha policy is recaptcha' do
+        before { allow(Barong::App.config).to receive_messages(captcha: 'recaptcha') }
+
+        it 'doesnt require captcha if endpoint is not in the protection list' do
+          allow(BarongConfig).to receive(:list).and_return({"captcha_protected_endpoints"=>["user_create"]})
+          do_request
+
+          expect_status_to_eq 200
+          result = JSON.parse(response.body)
+          expect(result['profiles'][0]['last_name']).to eq user.profiles.first.sub_masked_last_name
+          expect(result['profiles'][0]['dob']).to eq user.profiles.first.sub_masked_dob
+        end
+
+        it 'require captcha if endpoint is in the protection list' do
+          allow(BarongConfig).to receive(:list).and_return({"captcha_protected_endpoints"=>["user_create", "session_create"]})
+
+          do_request
+          expect_status_to_eq 400
+          expect_body.to eq(errors: ["identity.captcha.required"])
+        end
+      end
+
+      it 'Check current credentials and returns session' do
+        do_request
+
+        expect(session.instance_variable_get(:@delegate)[:uid]).to eq(user.uid)
+        expect_status.to eq(200)
+        result = JSON.parse(response.body)
+        expect(result['profiles'][0]['last_name']).to eq user.profiles.first.sub_masked_last_name
+        expect(result['profiles'][0]['dob']).to eq user.profiles.first.sub_masked_dob
+
+        check_session
+        expect(response.status).to eq(200)
+      end
+
+      it 'Expires a session after configured time' do
+        do_request
+        travel session_expire_time + 30.minutes
+        check_session
+        expect(response.status).to eq(401)
+      end
+
+      let(:captcha_response) { nil }
+      let(:valid_response) { 'valid' }
+      let(:invalid_response) { 'invalid' }
+
+      before do
+        allow_any_instance_of(CaptchaService::RecaptchaVerifier).to receive(:verify_recaptcha)
+          .with(model: user,
+                skip_remote_ip: true,
+                response: valid_response) { true }
+
+        allow_any_instance_of(CaptchaService::RecaptchaVerifier).to receive(:verify_recaptcha)
+          .with(model: user,
+                skip_remote_ip: true,
+                response: invalid_response) { raise StandardError }
+      end
+
+      context 'when captcha response is blank' do
+        let(:params) do
+          {
+            email: email,
+            password: password,
+            captcha_response: captcha_response
+          }
+        end
+      end
+
+      context 'when captcha response is not valid' do
+        let(:params) do
+          {
+            email: email,
+            password: password,
+            captcha_response: invalid_response
+          }
+        end
+
+        before do
+          expect_any_instance_of(CaptchaService::RecaptchaVerifier).to receive(:verify_recaptcha) { false }
+        end
+
+        it 'renders an error' do
+          allow(Barong::App.config).to receive_messages(captcha: 'recaptcha')
+          do_request
+          expect(json_body[:errors]).to eq(["identity.captcha.verification_failed"])
+          expect_status_to_eq 422
+        end
+      end
+
+      context 'when captcha response is valid' do
+        let(:params) do
+          {
+            email: email,
+            password: password,
+            captcha_response: valid_response
+          }
+        end
+
+        before do
+          expect_any_instance_of(CaptchaService::RecaptchaVerifier).to receive(:verify_recaptcha) { true }
+        end
+      end
+    end
+
+    context 'With Invalid params' do
+      context 'Checks current credentials and returns error' do
+        it 'when email, password is missing' do
+          post uri
+          expect_body.to eq(errors: ["identity.session.missing_email", "identity.session.missing_password"])
+          expect(response.status).to eq(422)
+        end
+
+        it 'when password is missing' do
+          post uri, params: { email: email }
+          expect_body.to eq(errors: ["identity.session.missing_password"])
+          expect(response.status).to eq(422)
+        end
+
+        it 'when email is missing' do
+          post uri, params: { password: password }
+          expect_body.to eq(errors: ["identity.session.missing_email"])
+          expect(response.status).to eq(422)
+        end
+
+        it 'when email is blank' do
+          post uri, params: { email: '',password: password }
+          expect_body.to eq(errors: ["identity.session.invalid_params"])
+          expect(response.status).to eq(401)
+        end
+
+        it 'when password is blank' do
+          post uri, params: { email: email, password: '' }
+          expect_body.to eq(errors: ["identity.session.invalid_params"])
+          expect(response.status).to eq(401)
+        end
+
+        it 'when email is space' do
+          post uri, params: { email: ' ',password: password }
+          expect_body.to eq(errors: ["identity.session.invalid_params"])
+          expect(response.status).to eq(401)
+        end
+
+        it 'when password is space' do
+          post uri, params: { email: email, password: ' ' }
+          expect_body.to eq(errors: ["identity.session.invalid_params"])
+          expect(response.status).to eq(401)
+        end
+
+        context 'when Password is wrong' do
+          it 'returns errror' do
+            post uri, params: { email: email, password: 'password' }
+            expect_body.to eq(errors: ["identity.session.invalid_params"])
+            expect(response.status).to eq(401)
+          end
+        end
+      end
+    end
+
+    context 'User state related errors' do
+      context 'When user is banned' do
+        let!(:banned_email) { 'email@random.com' }
+        let!(:user_banned) do
+          create :user,
+                 email: banned_email,
+                 password: password,
+                 password_confirmation: password,
+                 state: 'banned'
+        end
+
+        it 'returns error on banned user' do
+          post uri, params: { email: banned_email, password: password }
+          expect_body.to eq(errors: ["identity.session.banned"])
+          expect(response.status).to eq(401)
+        end
+      end
+
+      let!(:pending_email) { 'pendingemail@random.com' }
+      let!(:user_pending) do
+        create :user,
+               email: pending_email,
+               password: password,
+               password_confirmation: password,
+               state: 'pending'
+      end
+
+      context 'Allow pending user to login by default' do
+        it 'returns error on non-active user' do
+          user_pending.update(state: 'not-active')
+          post uri, params: { email: pending_email, password: password }
+          expect_body.to eq(errors: ["identity.session.not_active"])
+          expect(response.status).to eq(401)
+        end
+
+        it 'sucessfull login for pending user' do
+          user_pending.update(state: 'pending')
+          expect(user_pending.state).to eq('pending')
+
+          post uri, params: { email: pending_email, password: password }
+          expect(response.status).to eq(200)
+        end
+      end
+    end
+
+    context 'event API behavior' do
+      before do
+        allow(EventAPI).to receive(:notify)
+      end
+
+      it 'receive system.session.create notify' do
+        allow_any_instance_of(API::V2::Utils).to receive(:remote_ip).and_return('192.168.0.1')
+        post uri, params: { email: email, password: password }, headers: { 'HTTP_USER_AGENT' => 'random-browser' }
+
+        expect(EventAPI).to have_received(:notify).with('system.session.create',
+          hash_including({ record: hash_including(user: anything, user_ip: '192.168.0.1', user_agent: 'random-browser') })
+        )
+      end
+    end
+  end
+
+  describe 'DELETE /api/v2/identity/sessions' do
+    before { allow(Barong::App.config).to receive_messages(captcha: 'none') }
+
+    let!(:email) { 'user@gmail.com' }
+    let!(:password) { 'testPassword111' }
+    let(:uri) { '/api/v2/identity/sessions' }
+    let(:params) do
+      {
+        email: email,
+        password: password
+      }
+    end
+    subject!(:user) do
+      create :user,
+             email: email,
+             password: password,
+             password_confirmation: password
+    end
+
+    context 'With invalid session' do
+      let(:do_create_session_request) { post uri, params: params }
+      let(:do_delete_session_request) { delete uri }
+
+
+      it 'receives 404 on delete session' do
+        do_delete_session_request
+        expect(response.status).to eq(404)
+        expect(response.body).to eq("{\"errors\":[\"identity.session.not_found\"]}")
+      end
+    end
+
+    context 'With valid session' do
+      let(:do_create_session_request) { post uri, params: params }
+      let(:do_delete_session_request) { delete uri }
+
+      it 'Deletes session' do
+        do_create_session_request
+        expect(session.instance_variable_get(:@delegate)[:uid]).to eq(user.uid)
+
+        do_delete_session_request
+        expect(session.instance_variable_get(:@delegate)[:uid]).to eq(nil)
+      end
+
+      it "return invalid set-cookie header on #logout" do
+        do_create_session_request
+        expect(session.instance_variable_get(:@delegate)[:uid]).to eq(user.uid)
+
+        do_delete_session_request
+        expect(response.status).to eq(200)
+        expect(response.headers['Set-Cookie']).not_to be_nil
+        expect(response.headers['Set-Cookie']).to include "barong_session"
+      end
+    end
+  end
+
+  # describe 'POST /api/v2/indentity/sessions/auth0' do
+  #   let(:uri) { '/api/v2/identity/sessions/auth0' }
+  #
+  #   context 'user doesnt exist' do
+  #     context 'email verified' do
+  #       let(:payload) do
+  #         [
+  #           {
+  #           'email': 'example@barong.io',
+  #           'email_verified': true,
+  #           'iss': 'https://domain.name/',
+  #           'sub': 'google-oauth2|100484476630231723',
+  #           'aud': 'test audience',
+  #           'iat': Time.now.to_i,
+  #           'exp': (Time.now + 5.minutes).to_i
+  #           }.with_indifferent_access,
+  #           {
+  #             'alg': 'RS256',
+  #             'typ': 'JWT',
+  #             'kid': 'ptd2123vE-G12GoDvJ8MQ'
+  #           }
+  #         ]
+  #       end
+  #
+  #       before do
+  #         allow(Barong::Auth0::JWT).to receive(:verify).and_return(payload)
+  #       end
+  #
+  #       it 'create user and label' do
+  #         expect(User.find_by(email: 'example@barong.io')).to eq nil
+  #         post uri, params: { id_token: 'TestToken' }
+  #
+  #         expect(response.status).to eq(201)
+  #         result = JSON.parse(response.body)
+  #         user = User.find_by(email: result['email'])
+  #         expect(user).not_to be nil
+  #         expect(user.level).to eq 1
+  #         expect(user.state).to eq 'active'
+  #         expect(user.labels.count).to eq 1
+  #         expect(user.labels.find_by(key: 'email').value).to eq 'verified'
+  #       end
+  #     end
+  #   end
+  #
+  #   context 'user exists' do
+  #     let(:payload) do
+  #       [
+  #         {
+  #           'email': 'example@barong.io',
+  #           'email_verified': true,
+  #           'iss': 'https://domain.name/',
+  #           'sub': 'google-oauth2|100484476630231723',
+  #           'aud': 'test audience',
+  #           'iat': Time.now.to_i,
+  #           'exp': (Time.now + 5.minutes).to_i
+  #         }.with_indifferent_access,
+  #         {
+  #           'alg': 'RS256',
+  #           'typ': 'JWT',
+  #           'kid': 'ptd2123vE-G12GoDvJ8MQ'
+  #         }
+  #       ]
+  #     end
+  #
+  #     before do
+  #       allow(Barong::Auth0::JWT).to receive(:verify).and_return(payload)
+  #     end
+  #
+  #     let!(:user) { create(:user, email: 'example@barong.io')}
+  #
+  #     it 'returns existing user with session' do
+  #       expect(User.find_by(email: 'example@barong.io')).not_to eq nil
+  #       post uri, params: { id_token: 'TestToken' }
+  #
+  #       expect(response.status).to eq(201)
+  #       result = JSON.parse(response.body)
+  #       expect(result['email']).to eq user.email
+  #       expect(result.keys).to match_array(['email','uid','role','level','otp','state','referral_uid','csrf_token','data','labels','phones','profiles','data_storages', 'created_at', 'updated_at'])
+  #     end
+  #   end
+  #
+  #   context 'invalid params' do
+  #     it 'without params' do
+  #       post uri
+  #       expect_body.to eq(errors: ['identity.session.missing_id_token', 'identity.session.empty_id_token'])
+  #       expect(response.status).to eq(422)
+  #     end
+  #
+  #     it 'with empty param' do
+  #       post uri, params: { id_token: '' }
+  #       expect_body.to eq(errors: ['identity.session.empty_id_token'])
+  #       expect(response.status).to eq(422)
+  #     end
+  #
+  #     context 'jwt expired' do
+  #       before do
+  #         allow(Barong::Auth0::JWT).to receive(:verify).and_raise(JWT::ExpiredSignature)
+  #       end
+  #
+  #       it 'raise an error' do
+  #         post uri, params: { id_token: 'TestToken' }
+  #         expect_body.to eq(errors: ['identity.session.auth0.invalid_params'])
+  #         expect(response.status).to eq(422)
+  #       end
+  #     end
+  #
+  #     context 'email is not verified' do
+  #       let(:payload) do
+  #         [
+  #           {
+  #           'email': 'example@barong.io',
+  #           'email_verified': false,
+  #           'iss': 'https://domain.name/',
+  #           'sub': 'google-oauth2|100484476630231723',
+  #           'aud': 'test audience',
+  #           'iat': Time.now.to_i,
+  #           'exp': (Time.now + 5.minutes).to_i
+  #           }.with_indifferent_access,
+  #           {
+  #             'alg': 'RS256',
+  #             'typ': 'JWT',
+  #             'kid': 'ptd2123vE-G12GoDvJ8MQ'
+  #           }
+  #         ]
+  #       end
+  #
+  #       before do
+  #         allow(Barong::Auth0::JWT).to receive(:verify).and_return(payload)
+  #       end
+  #
+  #       it 'doesnt create user and label' do
+  #         expect(User.find_by(email: 'example@barong.io')).to eq nil
+  #         post uri, params: { id_token: 'TestToken' }
+  #
+  #         expect(User.find_by(email: 'example@barong.io')).to eq nil
+  #         expect_body.to eq(errors: ['identity.session.auth0.invalid_params'])
+  #         expect(response.status).to eq(401)
+  #       end
+  #     end
+  #   end
+  # end
+end

spec/api/v2/identity/users_spec.rb

@@ -0,0 +1,717 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+include ActiveSupport::Testing::TimeHelpers
+
+describe API::V2::Identity::Users do
+  include_context 'geoip mock'
+
+  before do
+    allow(Barong::App.config).to receive_messages(first_registration_superadmin: false)
+  end
+
+  let!(:create_member_permission) do
+    create :permission,
+           role: 'member',
+           verb: 'all'
+    create :permission,
+           role: 'superadmin',
+           verb: 'all'
+    create :permission,
+           role: 'member',
+           verb: 'all',
+           path: 'tasty_endpoint'
+  end
+
+  describe 'POST /api/v2/identity/users/access' do
+    context 'success' do
+      before do
+        allow_any_instance_of(ActionDispatch::Request).to receive(:remote_ip).and_return('192.168.0.2')
+        allow(Rails.cache).to receive(:read).and_return('active')
+      end
+
+      it 'creates a restriction in database with my ip' do
+        expect {
+          post '/api/v2/identity/users/access', params: { whitelink_token: 'testtoken' }
+        }.to change { Restriction.count }.by(1)
+
+        expect(response.status).to eq(201)
+      end
+
+      it 'works only first time' do
+        expect {
+          post '/api/v2/identity/users/access', params: { whitelink_token: 'testtoken' }
+        }.to change { Restriction.count }.by(1)
+        expect(response.status).to eq(201)
+
+        post '/api/v2/identity/users/access', params: { whitelink_token: 'testtoken' }
+
+        expect(response.status).to eq(422)
+        expect(json_body[:errors]).to include "value.taken"
+      end
+    end
+
+    context 'returns error' do
+      it 'if token is missing' do
+        post '/api/v2/identity/users/access'
+
+        expect(response.status).to eq(422)
+        expect(json_body[:errors]).to include  "identity.user.missing_whitelink_token"
+      end
+
+      it 'if incorrect whitelink_token' do
+        post '/api/v2/identity/users/access', params: { whitelink_token: 'testtoken' }
+
+        expect(response.status).to eq(422)
+        expect(json_body[:errors]).to include "identity.user.access.invalid_token"
+      end
+    end
+  end
+
+  describe 'POST /api/v2/identity/users with default Barong::App.config.captcha' do
+    let(:do_request) { post '/api/v2/identity/users', params: params }
+
+    context 'when email is invalid' do
+      let(:params) { { email: 'bad_format', password: 'Password1' } }
+
+      it 'renders an error' do
+        do_request
+        expect_status_to_eq 422
+        expect_body.to eq(errors: ["email.invalid", "password.weak"])
+      end
+    end
+
+    context 'when referral is unexist' do
+      let(:params) { { email: 'valid.email@gmail.com', password: 'Password1', refid: 'ID1231231231' } }
+
+      it 'renders an error' do
+        do_request
+        expect_status_to_eq 422
+        expect_body.to eq(errors: ["identity.user.referral_doesnt_exist"])
+      end
+    end
+
+    context 'when referral id is invalid' do
+      let(:params) { { email: 'valid.email@gmail.com', password: 'Password1', refid: 'UID123' } }
+
+      it 'renders an error' do
+        do_request
+        expect_status_to_eq 422
+        expect_body.to eq(errors: ["identity.user.invalid_referral_format"])
+      end
+    end
+
+    context 'when Password is invalid' do
+      let(:params) { { email: 'vadid.email@gmail.com', password: 'password' } }
+
+      it 'renders an error' do
+        do_request
+        expect_status_to_eq 422
+        expect_body.to eq(errors: ["password.requirements"])
+      end
+    end
+
+    context 'when email and password are absent' do
+      let(:params) {}
+
+      it 'renders an error' do
+        do_request
+        expect_status_to_eq 422
+        expect_body.to eq(errors: ["identity.user.missing_email", "identity.user.empty_email", "identity.user.missing_password", "identity.user.empty_password"])
+      end
+    end
+
+    context 'when email is blank' do
+      let(:params) { { email: '', password: 'zieV0Kai' } }
+
+      it 'renders an error' do
+        do_request
+        expect_status_to_eq 422
+        expect_body.to eq(errors: ["identity.user.empty_email"])
+      end
+    end
+
+    context 'when email is valid' do
+      let(:params) { { email: 'valid.email@gmail.com', password: 'eeC2BiCucxWEQ' } }
+
+      it 'creates an account' do
+        do_request
+        expect_status_to_eq 201
+      end
+
+      context 'first user registration' do
+        before do
+          allow(Barong::App.config).to receive_messages(first_registration_superadmin: true)
+        end
+
+        it 'creates superadmin user' do
+          post '/api/v2/identity/users', params: params
+
+          expect(response.status).to eq(201)
+
+          expect(json_body.keys).to match_array %i[email uid role level otp state referral_uid csrf_token data created_at updated_at labels phones profiles data_storages]
+          expect(json_body[:email]).to eq 'valid.email@gmail.com'
+          expect(json_body[:level]).to eq 1
+          expect(json_body[:role]).to eq 'superadmin'
+          expect(json_body[:state]).to eq 'active'
+          expect(json_body[:labels].count).to eq 1
+          expect(json_body[:labels][0][:key]).to eq 'email'
+          expect(json_body[:labels][0][:value]).to eq 'verified'
+          expect(json_body[:labels][0][:scope]).to eq 'private'
+        end
+      end
+    end
+  end
+
+  describe 'POST /api/v2/identity/users with reCAPTCHA Barong::App.config.captcha' do
+    before { allow(Barong::App.config).to receive_messages(captcha: 'recaptcha') }
+
+
+    let(:do_request_with_captcha) { post '/api/v2/identity/users', params: params_with_captcha }
+    let(:params_with_captcha) { { email: 'vadid.email@gmail.com', password: 'eeC2BiCucxWEQ', captcha_response: 'response' } }
+    let(:do_request) { post '/api/v2/identity/users', params: params }
+    let(:params) { { email: 'vadid.email@gmail.com', password: 'eeC2BiCucxWEQ' } }
+
+    context 'when reCAPTCHA is valid' do
+
+      it 'creates an account' do
+        allow_any_instance_of(CaptchaService::RecaptchaVerifier).to receive(:verify_recaptcha) { true }
+
+        do_request_with_captcha
+        expect_status_to_eq 201
+      end
+
+      it 'doesnt require captcha if endpoint is not in the protection list' do
+        allow(BarongConfig).to receive(:list).and_return({"captcha_protected_endpoints"=>["session_create"]})
+
+        do_request
+        expect_status_to_eq 201
+      end
+
+      it 'doesnt require captcha if protection list is empty' do
+        allow(BarongConfig).to receive(:list).and_return({})
+
+        do_request
+        expect_status_to_eq 201
+      end
+
+      it 'require captcha if endpoint is in the protection list' do
+        allow(BarongConfig).to receive(:list).and_return({"captcha_protected_endpoints"=>["user_create", "session_create"]})
+
+        do_request
+        expect_status_to_eq 400
+        expect_body.to eq(errors: ["identity.captcha.required"])
+      end
+    end
+
+    context 'when reCAPTCHA is invalid' do
+      before { allow_any_instance_of(CaptchaService::RecaptchaVerifier).to receive(:verify_recaptcha) { false } }
+
+      it 'renders an error' do
+        do_request_with_captcha
+        expect_status_to_eq 422
+        expect_body.to eq(errors: ["identity.captcha.verification_failed"])
+      end
+    end
+
+    context 'when captcha_response is blank but Barong::App.config.captcha requires reCAPTCHA response' do
+      let(:params) { { email: 'vadid.email@gmail.com', password: 'eeC2BiCucxWEQ' } }
+
+      it 'renders an error' do
+        do_request
+        expect_status_to_eq 400
+        expect_body.to eq(errors: ["identity.captcha.required"])
+      end
+    end
+  end
+
+  describe 'POST /api/v2/identity/users with GeeTest Barong::App.config.captcha' do
+    before { allow(Barong::App.config).to receive_messages(captcha: 'geetest') }
+
+    let(:do_request) { post '/api/v2/identity/users', params: params }
+    let(:params) do
+      { email: 'vadid.email@gmail.com', password: 'eeC2BiCucxWEQ',
+        captcha_response: { geetest_challenge: 'challenge',
+                            geetest_validate: 'validate',
+                            geetest_seccode: 'seccode' } }
+    end
+
+    context 'when GeeTest is valid' do
+      before { allow_any_instance_of(CaptchaService::GeetestVerifier).to receive(:validate) { true } }
+
+      it 'creates an account' do
+        do_request
+        expect_status_to_eq 201
+      end
+    end
+
+    context 'when GeeTest is invalid' do
+      before { allow_any_instance_of(CaptchaService::GeetestVerifier).to receive(:validate) { false } }
+
+      it 'renders an error' do
+        do_request
+        expect_status_to_eq 422
+        expect_body.to eq(errors: ["identity.captcha.verification_failed"])
+      end
+    end
+
+    context 'when captcha_response is blank but Barong::App.config.captcha requires Geetest response' do
+      let(:params) { { email: 'vadid.email@gmail.com', password: 'eeC2BiCucxWEQ' } }
+
+      it 'renders an error' do
+        do_request
+        expect_status_to_eq 400
+        expect_body.to eq(errors: ["identity.captcha.required"])
+      end
+    end
+
+    context 'when captcha_response has incorrect format' do
+      let(:params) do
+        { email: 'vadid.email@gmail.com', password: 'eeC2BiCucxWEQ',
+          captcha_response: { empty: 'string' } }
+      end
+
+      it 'renders an error' do
+        do_request
+        expect_status_to_eq 400
+        expect_body.to eq(errors: ["identity.captcha.mandatory_fields"])
+      end
+    end
+  end
+
+  describe 'POST /api/v2/identity/users with data field' do
+    let(:do_request) { post '/api/v2/identity/users', params: params }
+    let(:params) do
+      { email: 'vadid.email@gmail.com', password: 'eeC2BiCucxWEQ',
+        data: data }
+    end
+
+    context 'when data is not json compatible' do
+      let(:data) { 'phone_number: 380969999999' }
+
+      it 'renders an error' do
+        do_request
+        expect_status_to_eq 422
+        expect_body.to eq(errors: ["data.invalid_format"])
+      end
+    end
+
+    context 'valid data' do
+      let(:data) { "{\"phone_number\":\"380969999999\"}" }
+
+      it 'creates user' do
+        do_request
+        expect_status_to_eq 201
+      end
+    end
+  end
+
+  describe 'session opening on  /api/v2/identity/users' do
+    before do
+      Rails.cache.delete('permissions')
+    end
+
+    let(:email) { 'valid@email.com' }
+    let(:do_request) { post '/api/v2/identity/users', params: params }
+    let(:params) { { email: email, password: 'Tecohvi0' } }
+    let(:session_expire_time) do
+      Barong::App.config.session_expire_time
+    end
+    let(:check_session) do
+      get '/api/v2/auth/tasty_endpoint'
+    end
+
+    it 'Check current credentials and returns session' do
+      do_request
+      user = User.find_by(email: email)
+
+      expect(user).not_to be(nil)
+      expect(session.instance_variable_get(:@delegate)[:uid]).to eq(user.uid)
+      expect_status.to eq(201)
+
+      check_session
+      expect(response.status).to eq(200)
+    end
+  end
+
+  describe 'POST /api/v2/identity/users/email/generate_code' do
+    before { allow(BarongConfig).to receive(:list).and_return({"captcha_protected_endpoints"=>["user_create", "session_create"]}) }
+    let(:params) { { email: 'invalid@email.com' } }
+    let(:do_request) { post '/api/v2/identity/users/email/generate_code', params: params }
+
+    context 'when user is invalid' do
+      it 'doesnt render an error to prevent user enumeration' do
+        do_request
+        expect_status_to_eq 201
+      end
+    end
+
+    let(:params) { { email: 'valid-confirmed@email.com' } }
+    context 'when user is valid, email confirmed' do
+      it 'doesnt render an error to prevent user enumeration' do
+        create(:user, email: 'valid-confirmed@email.com', state: 'active')
+        do_request
+        expect_status_to_eq 201
+      end
+    end
+
+    context 'when user is valid' do
+      let(:user) { create(:user, state: 'pending') }
+      let(:params) { { email: user.email } }
+      it 'returns a success' do
+        do_request
+        expect_status_to_eq 201
+      end
+    end
+
+    context 'captcha behaviour when captcha policy is recaptcha' do
+      let(:user) { create(:user, state: 'pending') }
+      let(:params) { { email: user.email } }
+      before { allow(Barong::App.config).to receive_messages(captcha: 'recaptcha') }
+
+      it 'doesnt require captcha if endpoint is not in the protection list' do
+        allow(BarongConfig).to receive(:list).and_return({"captcha_protected_endpoints"=>["user_create", "session_create"]})
+
+        do_request
+        expect_status_to_eq 201
+      end
+
+      it 'require captcha if endpoint is in the protection list' do
+        allow(BarongConfig).to receive(:list).and_return({"captcha_protected_endpoints"=>["user_create", "session_create", "email_confirmation"]})
+
+        do_request
+        expect_status_to_eq 400
+        expect_body.to eq(errors: ["identity.captcha.required"])
+      end
+    end
+  end
+
+  describe 'session opening on  /api/v2/identity/users/email/confirm_code' do
+    before do
+      Rails.cache.delete('permissions')
+    end
+
+    let(:user) { create(:user, state: 'pending', email: 'valid_email@email.com') }
+    let(:do_request) { post '/api/v2/identity/users/email/confirm_code', params: params }
+    let(:params) { { token: codec.encode(sub: 'confirmation', email: user.email, uid: user.uid) } }
+    let(:session_expire_time) do
+      Barong::App.config.session_expire_time
+    end
+    let(:check_session) do
+      get '/api/v2/auth/tasty_endpoint'
+    end
+
+    it 'Gives label email verified and opens a session' do
+      do_request
+
+      expect(user).not_to be(nil)
+      expect(session.instance_variable_get(:@delegate)[:uid]).to eq(user.uid)
+      expect_status.to eq(201)
+
+      check_session
+      expect(response.status).to eq(200)
+    end
+  end
+
+  describe 'POST /api/v2/identity/users/email/confirm_code' do
+    let(:do_request) { post '/api/v2/identity/users/email/confirm_code', params: params }
+    let(:params) { {} }
+
+    context 'when token is missing' do
+      it 'returns an error' do
+        do_request
+        expect_status_to_eq 422
+        expect_body.to eq(errors: ["identity.user.missing_token", "identity.user.empty_token"])
+      end
+    end
+
+    context 'when token is invalid' do
+      let(:params) { { token: 'invalid token' } }
+
+      it 'returns an error' do
+        do_request
+        expect_status_to_eq 422
+        expect_body.to eq(errors: ["jwt.decode_and_verify.segments"])
+      end
+    end
+
+    context 'when token is valid' do
+      let(:user) { create(:user, :with_profile, state: 'pending', email: 'valid_email@email.com') }
+      let(:params) { { token: codec.encode(sub: 'confirmation', email: user.email, uid: user.uid) } }
+      it 'updates state to active' do
+        do_request
+        expect_status_to_eq 201
+
+        result = JSON.parse(response.body)
+        expect(result['profiles'][0]['last_name']).to eq user.profiles.first.sub_masked_last_name
+        expect(result['profiles'][0]['dob']).to eq user.profiles.first.sub_masked_dob
+      end
+
+      it 'returns utilized on the second attempt' do
+        token_params = params
+        post '/api/v2/identity/users/email/confirm_code', params: token_params
+        expect_status_to_eq 201
+
+        result = JSON.parse(response.body)
+        expect(result['profiles'][0]['last_name']).to eq user.profiles.first.sub_masked_last_name
+        expect(result['profiles'][0]['dob']).to eq user.profiles.first.sub_masked_dob
+
+        user.reload.update(state: 'pending')
+        post '/api/v2/identity/users/email/confirm_code', params: token_params
+        expect_status_to_eq 422
+        expect_body.to eq(errors: ["identity.user.utilized_token"])
+      end
+
+      it 'returns expired error on second attempt after lifetime' do
+        token_params = params
+        post '/api/v2/identity/users/email/confirm_code', params: token_params
+        expect_status_to_eq 201
+
+        result = JSON.parse(response.body)
+        expect(result['profiles'][0]['last_name']).to eq user.profiles.first.sub_masked_last_name
+        expect(result['profiles'][0]['dob']).to eq user.profiles.first.sub_masked_dob
+
+        user.reload.update(state: 'pending')
+        travel Barong::App.config.jwt_expire_time + 10.seconds
+
+        post '/api/v2/identity/users/email/confirm_code', params: token_params
+        expect_status_to_eq 422
+        expect_body.to eq(errors: ["jwt.decode_and_verify.expired"])
+      end
+    end
+  end
+
+  describe 'POST /api/v2/identity/users/password/generate_code' do
+    let(:do_request) do
+      post '/api/v2/identity/users/password/generate_code', params: params
+    end
+    let(:params) { { email: email } }
+
+    context 'when email is unknown' do
+      let(:email) { 'unknown@gmail.com' }
+
+      it 'renders 201' do
+        do_request
+        expect_status_to_eq 201
+        expect_body.not_to eq(errors: ["identity.password.user_doesnt_exist"])
+      end
+    end
+
+    context 'when user is found by email' do
+      let!(:user) { create(:user, email: email) }
+      let(:email) { 'email@gmail.com' }
+
+      it 'sends reset password instructions' do
+        do_request
+        expect_status_to_eq 201
+      end
+    end
+
+    context 'multiple password reset requests' do
+      let!(:user) { create(:user, email: email) }
+      let(:email) { 'email@gmail.com' }
+      let(:password) { 'ZahSh8ei' }
+      let(:confirm_password) { 'ZahSh8ei' }
+
+      let(:log_in) { post '/api/v2/identity/sessions', params: { email: user.email, password: password } }
+
+      it 'works with last email' do
+        post '/api/v2/identity/users/password/generate_code', params: params
+        expect_status_to_eq 201
+
+        post '/api/v2/identity/users/password/generate_code', params: params
+        expect_status_to_eq 201
+
+        reset_token = Rails.cache.read("reset_password_#{user.email}")
+        reset_password_token = codec.encode(sub: 'reset', email: user.email, uid: user.uid, reset_token: reset_token)
+        post '/api/v2/identity/users/password/confirm_code', params: {
+                                                                       reset_password_token: reset_password_token,
+                                                                       password: password,
+                                                                       confirm_password: confirm_password
+                                                                     }
+        expect_status_to_eq 201
+        log_in
+        expect_status_to_eq 200
+      end
+
+      it 'returns error if prev link (non-utilized) is used' do
+        post '/api/v2/identity/users/password/generate_code', params: params
+        reset_token = Rails.cache.read("reset_password_#{user.email}")
+        expect_status_to_eq 201
+
+        post '/api/v2/identity/users/password/generate_code', params: params
+        expect_status_to_eq 201
+
+        reset_password_token = codec.encode(sub: 'reset', email: user.email, uid: user.uid, reset_token: reset_token)
+        post '/api/v2/identity/users/password/confirm_code', params: {
+                                                                       reset_password_token: reset_password_token,
+                                                                       password: password,
+                                                                       confirm_password: confirm_password
+                                                                     }
+        expect_status_to_eq 422
+        expect(response.body).to eq("{\"errors\":[\"identity.user.utilized_token\"]}")
+      end
+
+      it 'expires utilized token after lifetime but still returns error' do
+        post '/api/v2/identity/users/password/generate_code', params: params
+        reset_token = Rails.cache.read("reset_password_#{user.email}")
+        expect_status_to_eq 201
+
+        post '/api/v2/identity/users/password/generate_code', params: params
+        expect_status_to_eq 201
+
+        reset_password_token = codec.encode(sub: 'reset', email: user.email, uid: user.uid, reset_token: reset_token)
+        travel Barong::App.config.jwt_expire_time + 10.seconds
+        post '/api/v2/identity/users/password/confirm_code', params: {
+                                                                       reset_password_token: reset_password_token,
+                                                                       password: password,
+                                                                       confirm_password: confirm_password
+                                                                     }
+
+        expect_status_to_eq 422
+        expect(response.body).to eq("{\"errors\":[\"jwt.decode_and_verify.expired\"]}")
+      end
+    end
+
+    context 'captcha behaviour when captcha policy is recaptcha' do
+      let!(:user) { create(:user, email: email) }
+      let(:email) { 'email@gmail.com' }
+      before { allow(Barong::App.config).to receive_messages(captcha: 'recaptcha') }
+
+      it 'doesnt require captcha if endpoint is not in the protection list' do
+        allow(BarongConfig).to receive(:list).and_return({"captcha_protected_endpoints"=>["user_create", "session_create"]})
+
+        do_request
+        expect_status_to_eq 201
+      end
+
+      it 'require captcha if endpoint is in the protection list' do
+        allow(BarongConfig).to receive(:list).and_return({"captcha_protected_endpoints"=>["user_create", "session_create", "password_reset"]})
+
+        do_request
+        expect_status_to_eq 400
+        expect_body.to eq(errors: ["identity.captcha.required"])
+      end
+    end
+  end
+
+  describe 'PUT /api/v2/identity/users/password/confirm_code' do
+    let(:do_request) do
+      post '/api/v2/identity/users/password/confirm_code', params: params
+    end
+    let(:params) do
+      {
+        reset_password_token: reset_password_token,
+        password: password,
+        confirm_password: confirm_password
+      }
+    end
+    let(:reset_password_token) { '' }
+    let(:password) { '' }
+    let(:confirm_password) { '' }
+
+    context 'when params are blank' do
+      it 'renders 422 error' do
+        do_request
+        expect_status_to_eq 422
+        expect_body.to eq(errors: ["identity.user.empty_reset_password_token", "identity.user.empty_password", "identity.user.empty_confirm_password"])
+      end
+    end
+
+    context 'when Reset Password Token is invalid' do
+      let(:reset_password_token) { 'invalid' }
+      let(:password) { 'Gol4aid2' }
+      let(:confirm_password) { 'Gol4aid2' }
+
+      it 'renders 422 error' do
+        do_request
+        expect_status_to_eq 422
+        expect_body.to eq(errors: ["jwt.decode_and_verify.segments"])
+      end
+    end
+
+    context 'when Reset Password Token and Password are valid ' do
+      let!(:user) { create(:user) }
+      let(:reset_password_token) { codec.encode(sub: 'reset', email: user.email, uid: user.uid) }
+      let(:password) { 'ZahSh8ei' }
+      let(:confirm_password) { 'ZahSh8ei' }
+      let(:log_in) { post '/api/v2/identity/sessions', params: { email: user.email, password: password } }
+
+      it 'resets a password' do
+        do_request
+        expect_status_to_eq 201
+        log_in
+        expect_status_to_eq 200
+      end
+    end
+
+    context 'When Reset Password Token is valid, passwords are weak' do
+      let!(:user) { create(:user) }
+      let(:reset_password_token) { codec.encode(sub:'reset', email: user.email, uid: user.uid) }
+      let(:password) { 'Simple' }
+      let(:confirm_password) { 'Simple' }
+
+      it 'returns weak password error' do
+        do_request
+        expect_status_to_eq 422
+        expect_body.to eq(errors: ["password.requirements"])
+      end
+    end
+
+    context 'When Reset Password Token is valid, passwords don\'t match' do
+      let!(:user) { create(:user) }
+      let(:reset_password_token) { codec.encode(sub: 'reset', email: user.email, uid: user.uid) }
+      let(:password) { 'ZahSh8exwdi' }
+      let(:confirm_password) { 'ZahSh8ei' }
+
+      it 'returns 422 error' do
+        do_request
+        expect_status_to_eq 422
+        expect_body.to eq(errors: ["identity.user.passwords_doesnt_match"])
+      end
+    end
+  end
+  describe 'POST /api/v2/identity/users/email/confirm_email' do
+    let(:test_user) { create(:user, state: 'pending', email: 'valid.email@gmail.com') }
+    let(:do_request) { post '/api/v2/identity/users/email/confirm_email', params: params }
+    let(:params) { {} }
+    let(:valid_otp_code) { '1357' }
+    let(:invalid_otp_code) { '1234' }
+
+    before do
+      allow(TOTPService).to receive(:validate?)
+                              .with(test_user.uid, valid_otp_code) { true }
+      allow(TOTPService).to receive(:validate?)
+                              .with(test_user.uid, invalid_otp_code) { false }
+    end
+
+    context 'when token is missing' do
+      it 'returns an error' do
+        do_request
+        expect_status_to_eq 422
+        expect_body.to eq(errors: ["identity.user.missing_code", "identity.user.empty_code",
+                                   "identity.user.missing_email", "identity.user.empty_email"])
+      end
+    end
+    context 'when code is invalid' do
+      let(:params) { { email: test_user.email, code: invalid_otp_code } }
+
+      it 'returns an error' do
+        do_request
+        expect_status_to_eq 422
+        expect_body.to eq(errors: ["identity.user.active_or_doesnt_exist"])
+      end
+    end
+    context 'when code is valid' do
+      let(:params) { { email: test_user.email, code: valid_otp_code } }
+
+      it 'returns an error' do
+        do_request
+        expect_status_to_eq 201
+        expect(json_body.keys).to match_array %i[email uid role level otp state referral_uid csrf_token data created_at updated_at labels phones profiles data_storages]
+        expect(json_body[:email]).to eq 'valid.email@gmail.com'
+        expect(json_body[:state]).to eq 'active'
+      end
+    end
+  end
+end