How do I test the actions that require the user to be logged in?

I am trying to test my controllers, but some of the actions in my controller expect the user to be logged in. How will I test them? Do I mess with the session variable directly? Also, what if a开发者_开发知识库 lot of the actions expect the user to be logged in? Should I set up a before action, and log the user in there?

Another idea I had was that I could test them in an integration test, and do a post on the login form, before I actually test the desired action. Something like:

def setup
  # log the user in, this will happen before every test
end

# integration test
test "I should see my posts" do
  #setup should have happened before this, and I should be logged in
  get posts_path
  assert ...
end

Is this the way to test these actions? Am I missing something?

Depending on your authentication framework you use there are several ways. Devise for example has some TestHelpers, that make it easy to login users without having go through the actual webpage in functional tests. If thats not an option, like soundsop said, browser testing. (look at, from high to low: cucumber, capybara, selenium/...)

The Book includes some testing examples in their depot application:

test "should login" do
  dave = users(:one)
  post :create, :name => dave.name, :password => 'secret'
  assert_redirected_to admin_url
  assert_equal dave.id, session[:user_id]
end

Full details in the "Authenticating Users" section.

You can either make fake user credentials in the setup, or you can stub out the method which checks the credentials using a mocking library. I've done both and don't have a firm preference.