Question

The wiki page for Devise suggests using the following to test if the user is not logged in:

   Given /^I am not authenticated$/ do
     visit('/users/sign_out') # ensure that at least
   end

Which works, but feels wrong as it’s only testing that a certain route is visitable and not really testing that the user isn’t logged in.

Are there other, better ways that can be used to test if the user is logged in with Devise?

Answer 1

The Given statement is setting up a known state before executing the test scenario, see GWT. In this case, it signs the user out before running the scenario.

You can use the following scenario to confirm that a resource is really protected by authentication:

Scenario: Anonymous denied access
  Given I am not authenticated
  When I go to protected_resource
  Then I should see "You need to sign in or sign up before continuing"

The protected_resource needs to be defined in features/support/paths.rb