From 753f64b86c1b0b74e707fd3c215be351f0c8bfee Mon Sep 17 00:00:00 2001
From: Sean Doyle <sean.p.doyle24@gmail.com>
Date: Fri, 6 Oct 2023 19:34:58 -0400
Subject: [PATCH] WIP

---
 lib/turbo/broadcastable/test_helper.rb        | 34 +++++++++
 test/broadcastable/test_helper_test.rb        | 74 +++++++++++++++++++
 test/dummy/app/helpers/application_helper.rb  |  5 ++
 .../_not_turbo_broadcastable.turbo_stream.erb |  1 +
 .../_turbo_broadcastable.turbo_stream.erb     |  1 +
 5 files changed, 115 insertions(+)
 create mode 100644 test/dummy/app/views/_not_turbo_broadcastable.turbo_stream.erb
 create mode 100644 test/dummy/app/views/_turbo_broadcastable.turbo_stream.erb

diff --git a/lib/turbo/broadcastable/test_helper.rb b/lib/turbo/broadcastable/test_helper.rb
index c26d487d..7dd81fe6 100644
--- a/lib/turbo/broadcastable/test_helper.rb
+++ b/lib/turbo/broadcastable/test_helper.rb
@@ -167,6 +167,40 @@ def capture_turbo_stream_broadcasts(stream_name_or_object, &block)
           document.at("body").element_children
         end
       end
+
+      def assert_broadcastable_render(&render)
+        test_case = self
+        job_class = Class.new(ActiveJob::Base)
+
+        forbidden_controller_methods = %i[session turbo_native_app?]
+        forbidden_view_methods = %i[cookies request]
+
+        forbidden_controller_methods.each do |method_name|
+          controller.singleton_class.define_method method_name do
+            test_case.flunk "Cannot access ##{method_name} during broadcasts"
+          end
+        end
+
+        forbidden_view_methods.each do |method_name|
+          view.singleton_class.define_method method_name do
+            test_case.flunk "Cannot access ##{method_name} during broadcasts"
+          end
+        end
+
+        test_case.singleton_class.define_method :render do |*args, **options, &block|
+          raise ArgumentError, <<~ERROR if args.any?
+            Do not call render with positional arguments. Instead, call render with `partial:`
+          ERROR
+
+          super(*args, **options, &block)
+        end
+
+        job_class.define_method :perform do
+          test_case.with_options(formats: [:turbo_stream], &render)
+        end
+
+        job_class.perform_now
+      end
     end
   end
 end
diff --git a/test/broadcastable/test_helper_test.rb b/test/broadcastable/test_helper_test.rb
index aa3f792c..e95c11cf 100644
--- a/test/broadcastable/test_helper_test.rb
+++ b/test/broadcastable/test_helper_test.rb
@@ -262,3 +262,77 @@ class Turbo::Broadcastable::TestHelper::AssertNoTurboStreamBroadcastsTest < Acti
     end
   end
 end
+
+class Turbo::Broadcastable::TestHelper::ViewTest < ActionView::TestCase
+  include Turbo::Broadcastable::TestHelper
+
+  test "#assert_broadcastable_render raises when render called with positional arguments" do
+    error = assert_raises ArgumentError do
+      assert_broadcastable_render do |broadcastable|
+        broadcastable.render "turbo_broadcastable"
+      end
+    end
+
+    assert_includes error.message, <<~ERROR
+      Do not call render with positional arguments. Instead, call render with `partial:`
+    ERROR
+  end
+
+  test "#assert_broadcastable_render does not leak positional argument change across tests" do
+    render "turbo_broadcastable"
+
+    assert_includes rendered, "Broadcastable"
+  end
+
+  test "#assert_broadcastable_render passes for a view partial" do
+    assert_broadcastable_render do |broadcastable|
+      broadcastable.render partial: "turbo_broadcastable", locals: { text: "text" }
+    end
+
+    assert_includes rendered, "Broadcastable text"
+  end
+
+  test "#assert_broadcastable_render flunks for a view partial with #current_user" do
+    assert_raises_forbidden_method_error :session do
+      assert_broadcastable_render do |broadcastable|
+        broadcastable.render partial: "not_turbo_broadcastable"
+      end
+    end
+  end
+
+  test "#assert_broadcastable_render flunks for a view partial with #session" do
+    assert_raises_forbidden_method_error :request do
+      assert_broadcastable_render do |broadcastable|
+        broadcastable.render inline: <<~ERB
+          <%= request.path %>
+        ERB
+      end
+    end
+  end
+
+  test "#assert_broadcastable_render flunks for a view partial with #turbo_native_app?" do
+    assert_raises_forbidden_method_error :turbo_native_app? do
+      assert_broadcastable_render do |broadcastable|
+        broadcastable.render inline: <<~ERB
+          <%= turbo_native_app? %>
+        ERB
+      end
+    end
+  end
+
+  test "#assert_broadcastable_render flunks for a view partial with #cookies" do
+    assert_raises_forbidden_method_error :cookies do
+      assert_broadcastable_render do |broadcastable|
+        broadcastable.render inline: <<~ERB
+          <%= cookies %>
+        ERB
+      end
+    end
+  end
+
+  def assert_raises_forbidden_method_error(method_name, &block)
+    error = assert_raises(Minitest::Assertion, &block)
+
+    assert_includes error.message, "Cannot access ##{method_name} during broadcasts"
+  end
+end
diff --git a/test/dummy/app/helpers/application_helper.rb b/test/dummy/app/helpers/application_helper.rb
index de6be794..6735af4f 100644
--- a/test/dummy/app/helpers/application_helper.rb
+++ b/test/dummy/app/helpers/application_helper.rb
@@ -1,2 +1,7 @@
 module ApplicationHelper
+  def current_user
+    if session.present?
+      "user@example.com"
+    end
+  end
 end
diff --git a/test/dummy/app/views/_not_turbo_broadcastable.turbo_stream.erb b/test/dummy/app/views/_not_turbo_broadcastable.turbo_stream.erb
new file mode 100644
index 00000000..9899d304
--- /dev/null
+++ b/test/dummy/app/views/_not_turbo_broadcastable.turbo_stream.erb
@@ -0,0 +1 @@
+<%= current_user %>
diff --git a/test/dummy/app/views/_turbo_broadcastable.turbo_stream.erb b/test/dummy/app/views/_turbo_broadcastable.turbo_stream.erb
new file mode 100644
index 00000000..0263e27d
--- /dev/null
+++ b/test/dummy/app/views/_turbo_broadcastable.turbo_stream.erb
@@ -0,0 +1 @@
+Broadcastable <%= local_assigns[:text] %>