Display and revoke active sessions

1 files changed, 69 insertions, 0 deletions

diff --git a/spec/features/users/active_sessions_spec.rb b/spec/features/users/active_sessions_spec.rb
new file mode 100644
index 00000000000..631d7e3bced
--- /dev/null
+++ b/spec/features/users/active_sessions_spec.rb
@@ -0,0 +1,69 @@
+require 'spec_helper'
+
+feature 'Active user sessions', :clean_gitlab_redis_shared_state do
+  scenario 'Successful login adds a new active user login' do
+    now = Time.zone.parse('2018-03-12 09:06')
+    Timecop.freeze(now) do
+      user = create(:user)
+      gitlab_sign_in(user)
+      expect(current_path).to eq root_path
+
+      sessions = ActiveSession.list(user)
+      expect(sessions.count).to eq 1
+
+      # refresh the current page updates the updated_at
+      Timecop.freeze(now + 1.minute) do
+        visit current_path
+
+        sessions = ActiveSession.list(user)
+        expect(sessions.first).to have_attributes(
+          created_at: Time.zone.parse('2018-03-12 09:06'),
+          updated_at: Time.zone.parse('2018-03-12 09:07')
+        )
+      end
+    end
+  end
+
+  scenario 'Successful login cleans up obsolete entries' do
+    user = create(:user)
+
+    Gitlab::Redis::SharedState.with do |redis|
+      redis.sadd("session:lookup:user:gitlab:#{user.id}", '59822c7d9fcdfa03725eff41782ad97d')
+    end
+
+    gitlab_sign_in(user)
+
+    Gitlab::Redis::SharedState.with do |redis|
+      expect(redis.smembers("session:lookup:user:gitlab:#{user.id}")).not_to include '59822c7d9fcdfa03725eff41782ad97d'
+    end
+  end
+
+  scenario 'Sessionless login does not clean up obsolete entries' do
+    user = create(:user)
+    personal_access_token = create(:personal_access_token, user: user)
+
+    Gitlab::Redis::SharedState.with do |redis|
+      redis.sadd("session:lookup:user:gitlab:#{user.id}", '59822c7d9fcdfa03725eff41782ad97d')
+    end
+
+    visit user_path(user, :atom, private_token: personal_access_token.token)
+    expect(page.status_code).to eq 200
+
+    Gitlab::Redis::SharedState.with do |redis|
+      expect(redis.smembers("session:lookup:user:gitlab:#{user.id}")).to include '59822c7d9fcdfa03725eff41782ad97d'
+    end
+  end
+
+  scenario 'Logout deletes the active user login' do
+    user = create(:user)
+    gitlab_sign_in(user)
+    expect(current_path).to eq root_path
+
+    expect(ActiveSession.list(user).count).to eq 1
+
+    gitlab_sign_out
+    expect(current_path).to eq new_user_session_path
+
+    expect(ActiveSession.list(user)).to be_empty
+  end
+end