changePasswordLoggedSpecs :: YesodSpec MyApp
changePasswordLoggedSpecs =
    ydescribe "Change Password while logged in tests" $ do
        yit "changes a password while logged in" $ do
            get' "/auth/page/account/newaccount"
            statusIs 200

            post'"/auth/page/account/newaccount" $ do
                addNonce
                byLabel "Username" "aaa"
                byLabel "Email" "tst@example.com"
                byLabel "Password" "xxx"
                byLabel "Confirm" "xxx"

            statusIs 302
            get' "/"
            statusIs 200
            bodyContains "A confirmation e-mail has been sent to tst@example.com"

            (username, email, verify) <- lastVerifyEmail
            assertEqual "username" username "aaa"
            assertEqual "email" email "tst@example.com"

            -- valid login
            get' "/auth/login"
            post'"/auth/page/account/login" $ do
                byLabel "Username" "aaa"
                byLabel "Password" "xxx"
            statusIs 200
            bodyContains "Your email has not yet been verified"

            -- resend verify email
            post'"/auth/page/account/resendverifyemail" $ do
                addNonce
                addPostParam f1 "aaa" -- username is also a hidden field
            statusIs 302
            get' "/"
            bodyContains "A confirmation e-mail has been sent to tst@example.com"

            (username', email', verify') <- lastVerifyEmail
            assertEqual "username" username' "aaa"
            assertEqual "email" email' "tst@example.com"
            assertEqual "verify" True (verify /= verify')

            -- verify email
            get' verify'
            statusIs 302
            get' "/"
            statusIs 200
            bodyContains "You are logged in as aaa"

            post $ AuthR LogoutR
            statusIs 302
            get' "/"
            statusIs 200
            bodyContains "Please visit the <a href=\"/auth/login\">Login page"

            -- valid login
            get' "/auth/login"
            post'"/auth/page/account/login" $ do
                byLabel "Username" "aaa"
                byLabel "Password" "xxx"
            statusIs 302
            get' "/"
            bodyContains "You are logged in as aaa"

            -- change password while logged in
            -- good key
            get' "/auth/page/account/newpasswordlgd"
            post'"/auth/page/account/setpassword" $ do
                addNonce
                byLabel "Please fill in your current password" "xxx"
                byLabel "New password" "www"
                byLabel "Confirm" "www"
                addPostParam f1 "aaa"
            statusIs 302
            get' "/"
            statusIs 200
            bodyContains "Password updated"
            bodyContains "You are logged in as aaa"

            post $ AuthR LogoutR

            -- check new password
            get' "/auth/login"
            post'"/auth/page/account/login" $ do
                byLabel "Username" "aaa"
                byLabel "Password" "www"
            statusIs 302
            get' "/"
            statusIs 200
            bodyContains "You are logged in as aaa"

            -- logout
            post $ AuthR LogoutR


        yit "cannot change password while logged out" $ do
            get' "/auth/page/account/newpasswordlgd"
            statusIs 403
changePasswordLoggedSpecs :: YesodSpec MyApp
changePasswordLoggedSpecs =
    ydescribe "Change Password while logged in tests" $ do
        yit "changes a password while logged in" $ do
            get' "/auth/page/account/newaccount"
            statusIs 200

            post'"/auth/page/account/newaccount" $ do
                addNonce
                byLabel "Username" "aaa"
                byLabel "Email" "tst@example.com"
                byLabel "Password" "xxx"
                byLabel "Confirm" "xxx"

            statusIs 302
            get' "/"
            statusIs 200
            bodyContains "A confirmation e-mail has been sent to tst@example.com"

            (username, email, verify) <- lastVerifyEmail
            assertEqual "username" username "aaa"
            assertEqual "email" email "tst@example.com"

            -- valid login
            get' "/auth/login"
            post'"/auth/page/account/login" $ do
                byLabel "Username" "aaa"
                byLabel "Password" "xxx"
            statusIs 200
            bodyContains "Your email has not yet been verified"

            -- resend verify email
            post'"/auth/page/account/resendverifyemail" $ do
                addNonce
                addPostParam f1 "aaa" -- username is also a hidden field
            statusIs 302
            get' "/"
            bodyContains "A confirmation e-mail has been sent to tst@example.com"

            (username', email', verify') <- lastVerifyEmail
            assertEqual "username" username' "aaa"
            assertEqual "email" email' "tst@example.com"
            assertEqual "verify" True (verify /= verify')

            -- verify email
            get' verify'
            statusIs 302
            get' "/"
            statusIs 200
            bodyContains "You are logged in as aaa"

            post $ AuthR LogoutR
            statusIs 302
            get' "/"
            statusIs 200
            bodyContains "Please visit the <a href=\"/auth/login\">Login page"

            -- valid login
            get' "/auth/login"
            post'"/auth/page/account/login" $ do
                byLabel "Username" "aaa"
                byLabel "Password" "xxx"
            statusIs 302
            get' "/"
            bodyContains "You are logged in as aaa"

            -- change password while logged in
            -- good key
            get' "/auth/page/account/newpasswordlgd"
            post'"/auth/page/account/setpassword" $ do
                addNonce
                byLabel "Please fill in your current password" "xxx"
                byLabel "New password" "www"
                byLabel "Confirm" "www"
                addPostParam f1 "aaa"
            statusIs 302
            get' "/"
            statusIs 200
            bodyContains "Password updated"
            bodyContains "You are logged in as aaa"

            post $ AuthR LogoutR

            -- check new password
            get' "/auth/login"
            post'"/auth/page/account/login" $ do
                byLabel "Username" "aaa"
                byLabel "Password" "www"
            statusIs 302
            get' "/"
            statusIs 200
            bodyContains "You are logged in as aaa"

            -- logout
            post $ AuthR LogoutR


        yit "cannot change password while logged out" $ do
            get' "/auth/page/account/newpasswordlgd"
            statusIs 403
changePasswordLoggedSpecs =
    ydescribe "Change Password while logged in tests" $ do
        yit "changes a password while logged in" $ do
            get' "/auth/page/account/newaccount"
            statusIs 200

            post'"/auth/page/account/newaccount" $ do
                addNonce
                byLabel "Username" "aaa"
                byLabel "Email" "tst@example.com"
                byLabel "Password" "xxx"
                byLabel "Confirm" "xxx"

            statusIs 302
            get' "/"
            statusIs 200
            bodyContains "A confirmation e-mail has been sent to tst@example.com"

            (username, email, verify) <- lastVerifyEmail
            assertEqual "username" username "aaa"
            assertEqual "email" email "tst@example.com"

            -- valid login
            get' "/auth/login"
            post'"/auth/page/account/login" $ do
                byLabel "Username" "aaa"
                byLabel "Password" "xxx"
            statusIs 200
            bodyContains "Your email has not yet been verified"

            -- resend verify email
            post'"/auth/page/account/resendverifyemail" $ do
                addNonce
                addPostParam f1 "aaa" -- username is also a hidden field
            statusIs 302
            get' "/"
            bodyContains "A confirmation e-mail has been sent to tst@example.com"

            (username', email', verify') <- lastVerifyEmail
            assertEqual "username" username' "aaa"
            assertEqual "email" email' "tst@example.com"
            assertEqual "verify" True (verify /= verify')

            -- verify email
            get' verify'
            statusIs 302
            get' "/"
            statusIs 200
            bodyContains "You are logged in as aaa"

            post $ AuthR LogoutR
            statusIs 302
            get' "/"
            statusIs 200
            bodyContains "Please visit the <a href=\"/auth/login\">Login page"

            -- valid login
            get' "/auth/login"
            post'"/auth/page/account/login" $ do
                byLabel "Username" "aaa"
                byLabel "Password" "xxx"
            statusIs 302
            get' "/"
            bodyContains "You are logged in as aaa"

            -- change password while logged in
            -- good key
            get' "/auth/page/account/newpasswordlgd"
            post'"/auth/page/account/setpassword" $ do
                addNonce
                byLabel "Please fill in your current password" "xxx"
                byLabel "New password" "www"
                byLabel "Confirm" "www"
                addPostParam f1 "aaa"
            statusIs 302
            get' "/"
            statusIs 200
            bodyContains "Password updated"
            bodyContains "You are logged in as aaa"

            post $ AuthR LogoutR

            -- check new password
            get' "/auth/login"
            post'"/auth/page/account/login" $ do
                byLabel "Username" "aaa"
                byLabel "Password" "www"
            statusIs 302
            get' "/"
            statusIs 200
            bodyContains "You are logged in as aaa"

            -- logout
            post $ AuthR LogoutR


        yit "cannot change password while logged out" $ do
            get' "/auth/page/account/newpasswordlgd"
            statusIs 403