I saw a question on the rspec list recently asking about how you test an SSL required page within cucumber, and I realized that I’ve had that, and even more cert-related chaos, figured out at $WORK, and that I should probably talk a little bit about it.

Simple scenario is that you’ve got some controller on your site that is supposed to only be accessible via https, and you want to make sure it behaves correctly in cucumber. In your standard deployment scenario, mongrel never really sees anything about SSL; that’s all handled by Apache. Apache will set some headers for you, which rails can check to determine if you’re using SSL. Since you’re not testing with Apache at this testing level, you just need to set the relevant HTTP headers.

Given I am using HTTPS
When I visit /payments
Then I should see the payments page

Given I am not using HTTPS
When I visit /payments
Then I should see an SSL error page

If I’m using webrat (which is highly recommended here) this becomes as simple as setting a header value. In recent versions of webrat, that boils down to:

Given /I am using HTTPS/ do
  header("HTTPS", "on")
end
Given /I am not using HTTPS/ do
  # this space left intentionally blank
end

If you’re NOT using webrat, but still at the rails integration test level, the call is a bit uglier

  get :show, { :id => 1234 }, { :https => 'on' }

The get method at the integration test level actually takes a third argument, which is the HTTP headers set on that request. At the functional / controller example level, the same method might work — I don’t know, I havn’t actually tested this at that level, instead I’ve just stubbed the https? method as needed.

Now, for bonus points. At $WORK, I exist in one of those ideal closed environments where x509 authentication actually stands a chance of working. That is, everyone gets a client certificate, which they send to us with the HTTPS request. We check against an external service, see that the cert is good, and viola, we can pre-populate with all sorts of juicy user information. Pipe dream on the internet, but it works well on an intranet. (having worked with this stuff, it’s no surprise to me at all that x509 client certs havn’t even managed to catch on with banks much less the general public …)

Apache takes care of checking the certificate, making sure it’s valid and well formed, and that it’s not in any CRL, and that it’s trusted. Makes my life easier, at the Rails level, we just have to check against the external service and we’re off to the races. And, happily, apache will pass things on in the headers.

Given I use the client certificate for “Joe”
Then when I visit /administration
I should be let in

Given /I use the client certificate for "(.*)"/ do |cert_user|
  #lookup or generate stub certificate information
  header("X_CLIENT_CERT", certificate.certificate)
  header("X_CLIENT_DN", certificate.dn)
  header("HTTPS", "on")
 
  DirectoryService.instance.stub!(:lookup).with(certificate.dn).and_return certificate.remote_xml
end

I’m hand-waving around some of the stubbing that would have to go on here, as far as generating dummy information goes, but the basic idea should be sound. In this case, I’m stubbing the entire DiectoryService.lookup method for a particular DN, which I set in the headers, and returning “remote_xml” which is a stand in for the XML document that the remote system returns. This lets me cut out the remote system, which wouldn’t appreciate being hit for all sorts of trash data every time the tests run, while still exercising most of the relevant internal code.

The general idea of an integration test is to see all of the pieces of the system working together. At this point, Cucumber is exercising everything in the stack below Apache. Since certificates and x509 client certificates are largely dealt with by apache, we have to stub those ins and outs to work through the rest of the system. The system is otherwise left unstubbed, and we check those integration points during manual testing.

This is a form builder we use in a couple of heavily used forms on the site, so we “know” this works, aside from the new code I want to add. But in moving in to backfill some specs, I discovered that, like many things relating to form builders in rails, it’s not the easiest thing to do, nor is it exactly well documented …

After a bit of digging, I finally managed to work out the right setup to get this going. Documented below for posterity

# spec/helper/random_form_builder_spec.rb
  describe RandomFormBuilder do
    attr_reader :builder, :helper
    before do
      @helper = Object.extend(ActionView::Helpers::FormHelper)
      @object = stub_model(Random)
      @builder = RandomFormBuilder.new(:random, @object, @helper, {}, nil)
    end
  end

You can then spec as normal, calling methods on builder and verifying the result.

The tricky part is the constructor.

:random

This is the name of the object, by analog, the first argument of a #form_for

@object

The object you run with; where the form pulls field values from

@helper

this is the tricky one. A form builder is really just a pass-through, decorating calls down to methods that live in FormHelper. If you don’t have a template that defines the FormHelper methods, failures abound.

{}

Options for the FormBuilder. Here, unused

nil

A proc

So, I’m gonna jump into the migrations and patch the existing add_index calls to specify a :name => value for all of the existing indexes, so that migrations will actually work and leave me with a database that matches the one in production ….

Figuring out why I suddenly couldn’t build my test database was not exactly the way I meant to spend the last hour ….

Update

Changeset 4768 is responsible for all this. Apparently, to allow reverse parsing of the indexes from the index name. Not alltogether a bad goal, but it still breaks down migrations … (thanks to Devin for find this one)

And, I discovered another problem last night. Seems that all of my text fields have a default value of “empy_clob()” … not the function, but that actual string. Sort of trashes one’s assumptions about unset fields. Apparently (thanks Roy) this has been worked out in ticket 7344 and already applied to Edge. Some sort of thing that only applies to Oracle, because, of course, nobody tests Rails on Oracle, it’s all MySQL. And I can’t really look into the patch attached to the ticket, because I keep getting Trac errors. Shaping up to have been a lovely adventure …

update
Finally got through to the site, and worked out a monkey patch to fix this. For those of you who might be running with oracle, and can’t upgrade to Edge (gee, wonder why not) the patch is below. This is a temporary thing, given that the ticket is closed, and will hopefully be fixed in 1.2.2 …
[ruby]
class ActiveRecord::ConnectionAdapters::OracleColumn
attr_writer :default
end if defined? ActiveRecord::ConnectionAdapters::OracleColumn

class ActiveRecord::ConnectionAdapters::OracleAdapter
def quote(value, column = nil) #:nodoc:
if value && column && [:text, :binary].include?(column.type)
%Q{empty_#{ column.sql_type.downcase rescue ‘blob’ }()}
else
super
end
end

alias columns_orig columns
def columns(*a)
columns_orig(*a).each do |col|
col.default = nil if col.default =~ /^(null|empty_[bc]lob())$/i
end
end
end if defined? ActiveRecord::ConnectionAdapters::OracleAdapter
[/ruby]

This appears to do the trick … a dump of the test schema no longer defaults all of our text columns to “empty_clob()” and tests are again passing …