From 0b2bd5c2d723d617d1943eb88caa9a9b6a00aaf9 Mon Sep 17 00:00:00 2001 From: Morgan Roderick Date: Thu, 3 Sep 2026 08:03:36 +0200 Subject: [PATCH] spec: add canary for forgery protection shared context All no-CSRF regression specs depend on the shared context's before hook enabling ActionController::Base.allow_forgery_protection. If that hook stops applying, tokenless requests succeed trivially (test environment defaults the flag to false) and every regression spec still passes, so the suite would no longer guard the production skip_forgery_protection lines. One canary example pins the toggle. --- spec/shared_contexts/forgery_protection_spec.rb | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 spec/shared_contexts/forgery_protection_spec.rb diff --git a/spec/shared_contexts/forgery_protection_spec.rb b/spec/shared_contexts/forgery_protection_spec.rb new file mode 100644 index 000000000..0f9380c9a --- /dev/null +++ b/spec/shared_contexts/forgery_protection_spec.rb @@ -0,0 +1,15 @@ +require 'rails_helper' + +# Canary for the 'with forgery protection enforced' shared context. All +# no-CSRF regression specs depend on its before hook actually enabling +# protection; if that hook stops applying, they pass vacuously. This +# example fails loudly if the toggle breaks. +# rubocop:disable RSpec/DescribeClass -- the subject is a shared context, not a class +RSpec.describe 'with forgery protection enforced' do + include_context 'with forgery protection enforced' + + it 'enables forgery protection for examples that include it' do + expect(ActionController::Base.allow_forgery_protection).to be true + end +end +# rubocop:enable RSpec/DescribeClass