Rspec Testing

RSpec testing in Bike Index

This project uses RSpec. All business logic should be tested.

Run only the specs your change touches

AGENTS.md has the rule. When something fails outside the files you changed, re-run that spec file on its own first: failing alone means it's real and gets fixed, never excused as pre-existing; passing alone is the fixing-flaky-failures skill, whose first rule is that you can't reach for a retry, a looser matcher, or a deleted assertion to make it green.

What a spec prints doesn't reach you

rtk's rspec wrapper reports a summary in place of the run's output, which costs you two different things. A puts added to a scratch spec to inspect a value vanishes and the run reads as an ordinary pass — redirect it (bundle exec rspec spec/foo_spec.rb > tmp/probe.log 2>&1) or write to a file from inside the example, as fixing-flaky-failures does for browser-side values. A failure keeps its ExpectationNotMetError: line but loses the expected/got values under it, so re-running the one example tells you no more than the first run did; rtk proxy bundle exec rspec <file>:<line> is what shows them. --format documentation rescues neither.

What to test (and what not to)

• Tests should either: help make the code correct now, or prevent bugs in the future. Don't add tests that don't do one of those things.
• Use request specs, not controller specs — request specs go through the full middleware/routing stack, so they catch breakage controller specs can't see. Everything making the same request should be in a single test. For markup a component owns, see A component's own markup.
• Avoid testing private methods.
• Avoid mocking objects.
  • If making external requests, use VCR. Never write or edit a cassette by hand — record them by running the tests (see VCR cassettes).
• Don't use tap to bundle factory creation with follow-up setup. Create the record in let/let!, then do the follow-up work on its own line (a separate statement, or a before block). One thing per line reads better and keeps the factory call clean.

Good

let!(:bike_transferred) { FactoryBot.create(:bike, :with_ownership_claimed, user:) }
before { BikeServices::OwnershipTransferer.find_or_create(bike_transferred, updator: user, new_owner_email: "new@example.com") }

Bad

let!(:bike_transferred) do
  FactoryBot.create(:bike, :with_ownership_claimed, user:).tap do |bike|
    BikeServices::OwnershipTransferer.find_or_create(bike, updator: user, new_owner_email: "new@example.com")
  end
end

Session state in a request spec comes from a real request

A request spec reads session and assigns freely, but a write doesn't outlive the call — the next request rebuilds the session from the cookie. There is no controller spec to fall back on; spec/controllers/ is gone.

So drive the request that sets the key: /oauth/authorize?partner=…&company=… for partner/company (arrive_via_partner in :existing_doorkeeper_app), /session/new?return_to=… for return_to, a bike's recovery link for recovery_link_token, a page render as an organization member for passive_organization_id. Where a param reaches the same code — return_to is read from params too — prefer the param over a priming request. spec/requests/sessions_request_spec.rb and spec/requests/users_request_spec.rb are the patterns.

A component's own markup is tested in its component spec

What a component decides about its markup — a label, a placeholder, a class, whether a field renders at all — belongs in spec/components/**/component_spec.rb, not in the request spec for a page that happens to render it. Request specs cover the request: status, redirects, what was saved, what the page is wired to.

A component having no spec yet isn't a reason to put it in the request spec instead. spec/components/pages/register/views/step2/component_spec.rb is the pattern, including the render_x helper that reloads the record so an object updated mid-example isn't answered from the copy the previous render left behind.

No stylesheet loads here, so Capybara calls anything hidden by a class visible. have_no_field/visible: false against a tw:hidden wrapper fails with "found 1 match", which reads as the component rendering the wrong thing. Assert the wrapper instead — page.find("form div.tw\\:hidden input[name='additional']", visible: :all) — and leave real invisibility to a :js system spec.

render_in_view_context takes its subjects as method arguments

A component needing a form_builder renders inside render_in_view_context { form_for … }, which instance_execs its block in the view context — so let values aren't in scope and a bare organization raises NameError. Wrap it in a def rendered_component(organization) and call that from the let(:component); the block closes over the method's locals. spec/components/pages/admin/organizations/form/wrapper/component_spec.rb is the pattern.

display_dev_info? is false in test, so nothing it gates is verifiable

ControllerHelpers#display_dev_info? opens with !Rails.env.test?. Every only-dev-visible block it wraps is unrendered in the suite, so threading the flag through a component — a wrong default, a missed hop — passes green and is wrong only in development. Reading the call sites isn't enough either — it can't show that a UI::Table cell block is instance_exec'd, so an @ivar in one resolves against the table and is always nil. Check it in the browser signed in as dev@bikeindex.org; the flag needs developer? and MiniProfiler, so the superadmin banner button won't do it.

log_in stubs the auth lookup, so it can't answer whether a session ends — or whether a user is confirmed

spec/support/request_spec_helpers.rb's log_in (and every :request_spec_logged_in_as_* context) stubs User.from_auth to return the user, so the cookie is never read and the session outlives anything done to that user — deleting, banning, rotating their auth_token.

The stub also answers User.unconfirmed.from_auth, so unconfirmed_current_user is always present. Sessionable#skip_if_signed_in asks that before it asks whether the user is confirmed, so every request it guards — /session/new, /session/magic_link, /users/new — redirects to please_confirm_email under log_in, whatever the user is.

Either one means signing in for real: include_context :request_spec_signed_in_for_real, which posts real credentials and takes a let(:user) override. spec/requests/sessions_request_spec.rb's "deleted after signing in" and its describe "destroy" are the patterns.

VCR cassettes: never hand-edit, always re-record

Never open a cassette and change it. Not a URL, not a token, not a timestamp, not an interaction — no matter how small or how obviously right the edit looks. A cassette is a recording of what a real service actually said; an edited one asserts something no service ever returned, and the spec passes against a fiction. This has no exceptions.

The only way a cassette changes is a spec run that records it:

• Stale or wrong contents — rm the file and run the spec. VCR writes it from scratch, holding exactly the requests the spec makes now. Re-recording without deleting only writes back the requests still being made, so interactions the spec has stopped making survive forever — and because VCR times re_record_interval from the cassette's oldest interaction, one stale entry re-triggers re-recording on every run.
• Cassette missing for a resource that doesn't exist yet — leave it absent and the spec red. Don't fabricate one.
• Secrets — spec/rails_helper.rb's filter_sensitive_data and before_record handle them. Add the key there; don't scrub the file by hand.

Commit what a run re-records. A modified cassette is a re-recording, not unrelated churn — cassettes carry a re_record_interval and are meant to update. Commit it on the branch you're on, whatever that branch is about. Never git checkout it away to keep a diff focused.

git status after a spec run is the only signal; a run that re-records prints nothing.

Never write WebMock.stub_request. HTTP in a spec is a cassette, with no exceptions. A stub asserts what you imagined a service returns; a cassette records what it actually returned, which is the same reason cassettes are never hand-edited. The handful of WebMock.stub_request calls still in spec/ are legacy — existing usage is not a precedent to copy.