spec/requests/omniauth_callbacks_spec.rb

@@ -39,6 +39,13 @@ describe 'OmniAuth callbacks' do
           Fabricate(:user, email: 'user@host.example')
         end
 
+        context 'when ALLOW_UNSAFE_AUTH_PROVIDER_REATTACH is set to true' do
+          around do |example|
+            ClimateControl.modify ALLOW_UNSAFE_AUTH_PROVIDER_REATTACH: 'true' do
+              example.run
+            end
+          end
+
           it 'matches the existing user, creates an identity, and redirects to root path' do
             expect { subject }
               .to not_change(User, :count)
@@ -52,6 +59,16 @@ describe 'OmniAuth callbacks' do
           end
         end
 
+        context 'when ALLOW_UNSAFE_AUTH_PROVIDER_REATTACH is not set to true' do
+          it 'does not match the existing user or create an identity' do
+            expect { subject }
+              .to not_change(User, :count)
+              .and not_change(Identity, :count)
+              .and not_change(LoginActivity, :count)
+          end
+        end
+      end
+
       context 'with a matching user and a matching identity' do
         before do
           user = Fabricate(:user, email: 'user@host.example')