Testing password length validation with RSpec

Question

I'm writing some unit tests to ensure a User model cannot have a password < 8 characters long.

I started with a User model:

class User < ActiveRecord::Base
  ...
  validates :password, :length =>{
    :minimum => 90,
    :too_short => "password is too short, must be at least %{count} characters"
  }, :on => :create

end

And a user_spec.rb test:

describe User do
  subject { FactoryGirl.build :user }

 its(:password) { should have_at_least(8).items }
end

However I realised that this doesn't actually test my validation, it just tests that my factory had a password >= 8 characters.

Is there a nice way to do this other than testing the valid? method for 0-7 character passwords?

My theory is that if I only test for 7 characters and someone accidentally hard codes that 4 characters passwords are OK this would pass validation but isn't really what was intended. There could be some code else where that depends on a password being more than 8 characters (not likely but in other situations could be true) and so allowing a password of 4 is incorrect.

In this case the person who changed the password validation in the model won't know that that they've done anything wrong.

I'd just like to know how to properly test situations like this nicely with TDD.

I don't understand your problem..

apneadiving
– apneadiving

2012-10-28 17:53:28 +00:00
Commented Oct 28, 2012 at 17:53 — apneadiving
– apneadiving, Commented Oct 28, 2012 at 17:53

Community · Accepted Answer · 2017-05-23 10:30:19Z

20

Using the ensure_length_of matcher in thoughtbot's shoulda matchers, you can do this:

describe User do
  it { should validate_length_of(:password).is_at_least(8)
                                         .with_message(/password is too short/) }
end

See also: How can I test :inclusion validation in Rails using RSpec

edited May 23, 2017 at 10:30

CommunityBot

11 silver badge

answered Oct 28, 2012 at 22:07

Chris Salzberg

27.4k4 gold badges79 silver badges84 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

stephen.hanson Over a year ago

ensure_length_of is now deprecated. Use validate_length_of instead.

Derek Hill · Accepted Answer · 2012-10-28 18:43:06Z

2

I don't know if this answers your question but I think you are safe with something like this:

class User < ActiveRecord::Base
  validates :password, :length => {:minimum => 8 }
end

describe User do
  it "validates password length" do
    FactoryGirl.build(:user, password: "1234567").should_not be_valid
    FactoryGirl.build(:user, password: "12345678").should be_valid
  end
end

The reason is that for this test to let through a 4 character password somebody would have to have set a validation rule that says 4 characters is ok, 7 isn't ok, but 8 is ok. Not something that is likely to happen by accident.

edited Oct 28, 2012 at 18:43

answered Oct 28, 2012 at 18:30

Derek Hill

6,5045 gold badges59 silver badges80 bronze badges

1 Comment

Pete Hamilton Over a year ago

This is effectively what we already have. "Not something likely" mean it's still possible and is what were trying to work out how to avoid. Thanks though!

Collectives™ on Stack Overflow

Testing password length validation with RSpec

2 Answers 2

1 Comment

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related