11 files changed, 553 insertions, 17 deletions

diff --git a/test/controllers/content_controller_test.rb b/test/controllers/content_controller_test.rb
index e8bc55f..9731d08 100644
--- a/test/controllers/content_controller_test.rb
+++ b/test/controllers/content_controller_test.rb
@@ -73,8 +73,7 @@ class ContentControllerTest < ActionController::TestCase
   def test_nonexistant_custom_template_defaults_to_standard_template
     new_node = create_node_under_root "fnord"
     draft = find_or_create_draft(new_node, @user1)
-    draft.template_name = "huchibu"
-    draft.save
+    draft.update_column(:template_name, "huchibu")
     new_node.publish_draft!
     
     get :render_page, params: { :locale => 'de', :page_path => ["fnord"] }
@@ -105,6 +104,16 @@ class ContentControllerTest < ActionController::TestCase
     assert_response :success
     File.write("/tmp/no_fill_response.html", @response.body)
   end
+
+  test "render_gallery renders for a published page" do
+    node = Node.root.children.create!(:slug => "gallery_render_test")
+    Globalize.with_locale(I18n.default_locale) { node.draft.update!(:title => "Galerie") }
+    node.publish_draft!
+
+    get :render_gallery, params: { :page_path => "gallery_render_test", :locale => "de" }
+
+    assert_response :success
+  end
   
   protected
   
diff --git a/test/controllers/csp_reports_controller_test.rb b/test/controllers/csp_reports_controller_test.rb
new file mode 100644
index 0000000..7dd8c9e
--- /dev/null
+++ b/test/controllers/csp_reports_controller_test.rb
@@ -0,0 +1,8 @@
+require 'test_helper'
+
+class CspReportsControllerTest < ActionController::TestCase
+  test "accepts anonymous reports without CSRF" do
+    post :create, body: '{"csp-report":{"violated-directive":"script-src"}}'
+    assert_response :no_content
+  end
+end
diff --git a/test/controllers/nodes_controller_test.rb b/test/controllers/nodes_controller_test.rb
index 5b66bd3..ddc4565 100644
--- a/test/controllers/nodes_controller_test.rb
+++ b/test/controllers/nodes_controller_test.rb
@@ -140,7 +140,7 @@ class NodesControllerTest < ActionController::TestCase
       :page => {
         :title => "Hello",
         :body => "There",
-        :template_name => "Foobar"
+        :template_name => "title_only"
       }
     }
 
@@ -148,7 +148,17 @@ class NodesControllerTest < ActionController::TestCase
     test_node.reload
     assert_equal "Hello", test_node.head.title
     assert_equal "There", test_node.head.body
-    assert_equal "Foobar", test_node.head.template_name
+    assert_equal "title_only", test_node.head.template_name
+  end
+
+  def test_update_rejects_a_template_name_not_on_disk
+    test_node = Node.root.children.create! :slug => "test_node"
+    login_as :quentin
+    put :update, params: { :id => test_node.id,
+                           :page => { :title => "Hello", :template_name => "Foobar" } }
+
+    test_node.reload
+    assert_not_equal "Foobar", test_node.draft&.template_name
   end
 
   test "publish draft with staged_slug unqueal slug" do
@@ -417,11 +427,11 @@ class NodesControllerTest < ActionController::TestCase
   test "show never renders a destroy link for events" do
     login_as :quentin
     node = create_node_with_published_page
-    Event.create!(node_id: node.id, start_time: Time.now, end_time: Time.now + 1.hour)
+    event = Event.create!(node_id: node.id, start_time: Time.now, end_time: Time.now + 1.hour)
 
     get :show, params: { id: node.id }
     assert_response :success
-    assert_select "form.button_to.destructive", count: 0
+    assert_select "form[action=?]", event_path(event), count: 0
   end
 
   test "reverting from nodes#show returns to the show page, not the editor, even if a draft remains" do
@@ -469,7 +479,8 @@ class NodesControllerTest < ActionController::TestCase
     login_as :quentin
     get :show, params: { :id => node.id }
     assert_response :success
-    assert_select "form.destructive", :count => 0
+    assert_select "form[action=?]", revert_node_path(node), count: 0
+    assert_select "form[action=?]", trash_node_path(node), count: 1
   end
 
   test "drafts includes a never-published node with only a draft" do
@@ -662,4 +673,88 @@ class NodesControllerTest < ActionController::TestCase
     assert_equal "Brand New",            action.metadata["title"]
     assert_equal Node.last.unique_name,  action.metadata["path"]
   end
+
+  test "trash moves the node and redirects to the Trash" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "trash_me")
+
+    put :trash, params: { :id => node.id }
+
+    assert_redirected_to trashed_nodes_path
+    assert node.reload.in_trash?
+  end
+
+  test "trashing the Trash node itself is refused" do
+    login_as :quentin
+
+    put :trash, params: { :id => Node.trash.id }
+
+    assert_redirected_to node_path(Node.trash)
+    assert flash[:error].present?
+  end
+
+  test "restore_from_trash reparents to the given parent" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "restore_me")
+    node.trash!(users(:quentin))
+    target = Node.root.children.create!(:slug => "restore_home")
+
+    put :restore_from_trash, params: { :id => node.id, :parent_id => target.id }
+
+    assert_redirected_to node_path(node)
+    assert_equal target, node.reload.parent
+  end
+
+  test "destroy refuses a node outside the Trash" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "not_deletable_here")
+
+    delete :destroy, params: { :id => node.id }
+
+    assert Node.exists?(node.id)
+    assert flash[:error].present?
+  end
+
+  test "destroy deletes a trashed node and redirects to the Trash" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "deletable")
+    node.trash!(users(:quentin))
+
+    delete :destroy, params: { :id => node.id }
+
+    assert_not Node.exists?(node.id)
+    assert_redirected_to trashed_nodes_path
+  end
+
+  test "trash lists trashed subtree roots" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "listed_in_trash")
+    node.trash!(users(:quentin))
+
+    get :trashed
+    assert_response :success
+    assert_select "a[href=?]", node_path(node)
+  end
+
+  test "trashed rows carry provenance and a delete for childless roots" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "provenance_test")
+    node.trash!(users(:quentin))
+
+    get :trashed
+    assert_select "td", /quentin/
+    assert_select "form[action=?]", node_path(node), count: 1
+  end
+
+test "show annotates history rows with their lifecycle" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "history_annotation_test")
+    Globalize.with_locale(I18n.default_locale) { node.draft.update!(:title => "Annotated") }
+    node.publish_draft!(users(:quentin))
+
+    get :show, params: { :id => node.id }
+
+    assert_response :success
+    assert_select "span.revision_lifecycle", /quentin/
+  end
 end
diff --git a/test/fixtures/nodes.yml b/test/fixtures/nodes.yml
index 9ca325e..e94f10f 100644
--- a/test/fixtures/nodes.yml
+++ b/test/fixtures/nodes.yml
@@ -2,8 +2,6 @@
 
 root:
   id: 1
-  lft: 1
-  rgt: 10
   parent_id:
   slug:
   unique_name:
@@ -11,8 +9,6 @@ root:
 
 first_child:
   id: 2
-  lft: 2
-  rgt: 3
   parent_id: 1
   draft_id: 100
   slug: first_child
@@ -20,8 +16,6 @@ first_child:
 
 second_child:
   id: 3
-  lft: 4
-  rgt: 5
   parent_id: 1
   draft_id: 101
   slug: second_child
@@ -29,8 +23,6 @@ second_child:
   
 third_child:
   id: 4
-  lft: 6
-  rgt: 7
   parent_id: 1
   draft_id: 102
   slug: third_child
@@ -38,8 +30,6 @@ third_child:
   
 fourth_child:
   id: 5
-  lft: 8
-  rgt: 9
   parent_id: 1
   slug: fourth_child
   unique_name: fourth_child
diff --git a/test/integration/csp_header_test.rb b/test/integration/csp_header_test.rb
new file mode 100644
index 0000000..73707ed
--- /dev/null
+++ b/test/integration/csp_header_test.rb
@@ -0,0 +1,12 @@
+require 'test_helper'
+
+class CspHeaderTest < ActionDispatch::IntegrationTest
+  test "public responses carry the report-only CSP header with a nonce" do
+    get "/"
+
+    header = response.headers["Content-Security-Policy-Report-Only"]
+    assert header.present?
+    assert_includes header, "script-src"
+    assert_includes header, "nonce-"
+  end
+end
diff --git a/test/models/concerns/rrule_humanizer_test.rb b/test/models/concerns/rrule_humanizer_test.rb
index 54c4c22..d747171 100644
--- a/test/models/concerns/rrule_humanizer_test.rb
+++ b/test/models/concerns/rrule_humanizer_test.rb
@@ -114,4 +114,11 @@ class RruleHumanizerTest < ActiveSupport::TestCase
   test "wday_abbr falls back to :de for an unrecognized locale" do
     assert_equal "Mo", RruleHumanizer.wday_abbr(Time.parse("2026-07-06"), :fr)
   end
+
+  test "monthly two selected weeks" do
+    assert_equal "Jeden ersten und dritten Dienstag im Monat",
+      humanize("FREQ=MONTHLY;BYDAY=1TU,3TU")
+    assert_equal "Every first and third Tuesday of the month",
+      humanize("FREQ=MONTHLY;BYDAY=1TU,3TU", :en)
+  end
 end
diff --git a/test/models/helpers/node_actions_helper_test.rb b/test/models/helpers/node_actions_helper_test.rb
index 5244c19..1b72ec9 100644
--- a/test/models/helpers/node_actions_helper_test.rb
+++ b/test/models/helpers/node_actions_helper_test.rb
@@ -10,6 +10,10 @@ class NodeActionsHelperTest < ActionView::TestCase
     { :locale => nil }
   end
 
+  def icon(_name, **)
+    '<svg class="stub-icon"></svg>'.html_safe
+  end
+
   def teardown
     I18n.locale = @original_locale
   end
@@ -104,4 +108,39 @@ class NodeActionsHelperTest < ActionView::TestCase
     assert_includes action_summary(e), "a/b"
     assert_not action_details?(e)
   end
+
+  test "trash, restore, and destroy render their paths" do
+    trash   = entry("trash",   { "path" => { "from" => "club/old", "to" => "trash/old" } })
+    restore = entry("restore_from_trash", { "path" => { "from" => "trash/old", "to" => "club/new" } })
+    doomed  = entry("destroy", { "path" => "trash/old" })
+
+    assert_includes action_summary(trash),   "club/old"
+    assert_includes action_summary(restore), "club/new"
+    assert_includes action_summary(doomed),  "trash/old"
+  end
+
+  test "revision lifecycle badges cover create, publish, rollback, and inference" do
+    created   = entry("create",  { "title" => "x", "path" => "a/b" })
+    published = entry("publish", { "via" => "draft",    "title" => { "from" => nil, "to" => "x" } })
+    restored  = entry("publish", { "via" => "revision", "title" => { "from" => "y", "to" => "x" } })
+    restored.update!(:inferred_from => "from_page_revision")
+
+    out = revision_lifecycle_badges([created, published, restored])
+
+    assert_includes out, "created"
+    assert_includes out, "published"
+    assert_includes out, "restored"
+    assert_includes out, "quentin"
+    assert_includes out, "node_action_inferred"
+    assert_includes out, "<span"
+    assert_not_includes out, "&lt;span"
+
+    assert_equal "", revision_lifecycle_badges(nil)
+  end
+
+  test "verb icons map known verbs, distinguish rollbacks, and fall back" do
+    assert_includes verb_icon(entry("trash", { "path" => { "from" => "a", "to" => "t/a" } })), "node_action_icon--trash"
+    assert_includes verb_icon(entry("publish", { "via" => "revision" })), "node_action_icon--history"
+    assert_includes verb_icon(entry("frobnicate")), "node_action_icon--circle-dashed"
+  end
 end
diff --git a/test/models/node_test.rb b/test/models/node_test.rb
index c8e49e5..ab66f81 100644
--- a/test/models/node_test.rb
+++ b/test/models/node_test.rb
@@ -761,4 +761,105 @@ class NodeTest < ActiveSupport::TestCase
     assert_equal "Second",    action.metadata.dig("title", "from")
     assert_equal "First",     action.metadata.dig("title", "to")
   end
+
+  test "default_template_name rejects values not present in the template directory" do
+    node = Node.root.children.build(:slug => "template_guard_test",
+                                     :default_template_name => "../../layouts/admin")
+    assert_not node.valid?
+
+    node.default_template_name = "standard_template"
+    assert node.valid?
+  end
+
+  test "destroying a node with children is refused" do
+    parent = Node.root.children.create!(:slug => "destroy_guard_parent")
+    parent.children.create!(:slug => "destroy_guard_child")
+
+    assert_no_difference "Node.count" do
+      assert_not parent.destroy
+    end
+    assert parent.errors[:base].any?
+  end
+
+  test "destroying a childless node leaves no orphaned pages or asset links" do
+    node = create_node_with_published_page
+    page_ids = node.pages.pluck(:id)
+    asset = Asset.create!(:name => "destroy cascade probe",
+                          :upload_file_name    => "test_image.png",
+                          :upload_content_type => "image/png",
+                          :upload_file_size    => 49854,
+                          :upload_updated_at   => Time.current)
+    node.head.related_assets.create!(:asset_id => asset.id, :position => 1)
+
+    node.destroy
+
+    assert_equal 0, Page.where(:id => page_ids).count
+    assert_equal 0, RelatedAsset.where(:page_id => page_ids).count
+  end
+
+  test "destroying a node also removes its autosave page" do
+    node = create_node_with_published_page
+    node.lock_for_editing!(@user1)
+    node.autosave!({:title => "in flight"}, @user1)
+    autosave_id = node.autosave_id
+
+    node.destroy
+
+    assert_equal 0, Page.where(:id => autosave_id).count
+  end
+
+  test "Node.trash lazily creates the container exactly once" do
+    assert_difference "Node.count", 1 do
+      Node.trash
+    end
+    assert_no_difference "Node.count" do
+      assert_equal Node.trash, Node.trash
+    end
+    assert Node.trash.trash_node?
+    assert_not Node.trash.in_trash?
+    assert_equal "Trash", Globalize.with_locale(I18n.default_locale) { Node.trash.draft.title }
+  end
+
+  test "in_trash? walks the whole parent chain" do
+    child = Node.trash.children.create!(:slug => "trashed_thing")
+    grandchild = child.children.create!(:slug => "trashed_deeper")
+
+    assert child.in_trash?
+    assert grandchild.in_trash?
+    assert_not Node.root.children.create!(:slug => "living_thing").in_trash?
+  end
+
+  test "the reserved slug is refused for other root children, live and staged" do
+    Node.trash
+
+    assert_not Node.root.children.build(:slug => CccConventions::TRASH_SLUG).valid?
+    assert_not Node.root.children.build(:slug => "fine", :staged_slug => CccConventions::TRASH_SLUG).valid?
+    assert Node.trash.children.create!(:slug => "sub").children.build(:slug => CccConventions::TRASH_SLUG).valid?
+  end
+
+  test "the Trash node refuses rename, move, and destroy" do
+    trash = Node.trash
+    other = Node.root.children.create!(:slug => "not_the_trash")
+
+    trash.slug = "recycling"
+    assert_not trash.valid?
+
+    trash.reload.parent_id = other.id
+    assert_not trash.valid?
+
+    assert_no_difference "Node.count" do
+      assert_not trash.reload.destroy
+    end
+  end
+
+  test "a head cannot exist inside the Trash, and publishing there is refused" do
+    node = Node.trash.children.create!(:slug => "no_publish_here")
+    page = node.pages.create!
+
+    node.head = page
+    assert_not node.valid?
+
+    node.reload
+    assert_raises(ActiveRecord::RecordInvalid) { node.publish_draft! }
+  end
 end
diff --git a/test/models/node_trash_test.rb b/test/models/node_trash_test.rb
new file mode 100644
index 0000000..52069d7
--- /dev/null
+++ b/test/models/node_trash_test.rb
@@ -0,0 +1,168 @@
+require "test_helper"
+
+class NodeTrashTest < ActiveSupport::TestCase
+
+  def setup
+    @user1 = User.create!(:login => "trasher", :email => "t@example.com",
+                           :password => "foobar", :password_confirmation => "foobar")
+  end
+
+  test "trash! demotes the head into the draft slot when no draft exists" do
+    node = create_node_with_published_page
+    former_head = node.head
+
+    node.trash!(@user1)
+    node.reload
+
+    assert_nil node.head_id
+    assert_equal former_head, node.draft
+    assert node.in_trash?
+  end
+
+  test "trash! keeps an existing draft; the former head stays a plain revision" do
+    node = create_node_with_published_page
+    draft = find_or_create_draft(node, @user1)
+    former_head = node.head
+
+    node.trash!(@user1)
+    node.reload
+
+    assert_nil node.head_id
+    assert_equal draft, node.draft
+    assert_includes node.pages, former_head
+  end
+
+  test "trash! demotes descendant heads and counts them in the log entry" do
+    parent = create_node_with_published_page
+    child  = parent.children.create!(:slug => "trashed_child")
+    child.draft.update!(:title => "Child")
+    child.publish_draft!(@user1)
+
+    parent.trash!(@user1)
+
+    action = NodeAction.where(:action => "trash").last
+    assert_equal parent, action.node
+    assert_equal 2, action.metadata["demoted_heads"]
+    assert action.metadata["was_published"]
+    assert_nil child.reload.head_id
+    assert child.in_trash?
+  end
+
+  test "trash! logs one entry with the path pair and updates unique names" do
+    node = create_node_with_published_page
+    path_before = node.unique_name
+
+    assert_difference "NodeAction.count", 1 do
+      node.trash!(@user1)
+    end
+
+    action = NodeAction.last
+    assert_equal path_before, action.metadata.dig("path", "from")
+    assert_equal node.reload.unique_name, action.metadata.dig("path", "to")
+    assert action.metadata.dig("path", "to").start_with?(CccConventions::TRASH_SLUG)
+  end
+
+  test "trash! on an already trashed node is a logged-nothing no-op" do
+    node = create_node_with_published_page
+    node.trash!(@user1)
+
+    assert_no_difference "NodeAction.count" do
+      assert_nil node.reload.trash!(@user1)
+    end
+  end
+
+  test "restore_from_trash! reparents as drafts without republishing" do
+    node = create_node_with_published_page
+    node.trash!(@user1)
+    target = Node.root.children.create!(:slug => "restore_target")
+
+    node.reload.restore_from_trash!(target, @user1)
+    node.reload
+
+    assert_equal target, node.parent
+    assert_not node.in_trash?
+    assert_nil node.head_id
+    assert_not_nil node.draft_id
+    assert_equal "restore_from_trash", NodeAction.last.action
+  end
+
+  test "restore_from_trash! refuses targets inside the Trash and the Trash itself" do
+    node = create_node_with_published_page
+    node.trash!(@user1)
+    other_trashed = Node.trash.children.create!(:slug => "also_trashed")
+
+    assert_raises(ActiveRecord::RecordInvalid) { node.reload.restore_from_trash!(Node.trash, @user1) }
+    assert_raises(ActiveRecord::RecordInvalid) { node.reload.restore_from_trash!(other_trashed, @user1) }
+  end
+
+  test "destroy_from_trash! refuses nodes outside the Trash" do
+    node = create_node_with_published_page
+
+    assert_raises(ActiveRecord::RecordInvalid) { node.destroy_from_trash!(@user1) }
+    assert Node.exists?(node.id)
+  end
+
+  test "destroy_from_trash! removes the whole subtree bottom-up with one entry" do
+    parent = create_node_with_published_page
+    child = parent.children.create!(:slug => "doomed_child")
+    grandchild = child.children.create!(:slug => "doomed_grandchild")
+    page_ids = [parent, child, grandchild].flat_map { |n| n.pages.pluck(:id) }
+    parent.trash!(@user1)
+
+    assert_difference "NodeAction.count", 1 do
+      parent.reload.destroy_from_trash!(@user1)
+    end
+
+    assert_not Node.exists?(parent.id)
+    assert_not Node.exists?(child.id)
+    assert_not Node.exists?(grandchild.id)
+    assert_equal 0, Page.where(:id => page_ids).count
+
+    action = NodeAction.where(:action => "destroy").last
+    assert_equal 2, action.metadata["destroyed_descendants"]
+    assert_nil action.node_id
+  end
+
+  test "destroy_from_trash! logs an entry that survives the node" do
+    node = create_node_with_published_page
+    Globalize.with_locale(I18n.default_locale) { node.head.update!(:title => "Doomed") }
+    node.trash!(@user1)
+    final_path = node.reload.unique_name
+
+    node.destroy_from_trash!(@user1)
+
+    action = NodeAction.where(:action => "destroy").last
+    assert_nil action.node_id
+    assert_equal final_path, action.metadata["path"]
+    assert_equal "Doomed", action.subject_name
+    assert_equal @user1, action.user
+  end
+
+  test "suggested_restore_parent finds the old parent while it lives" do
+    parent = Node.root.children.create!(:slug => "old_home")
+    node = parent.children.create!(:slug => "comes_back")
+    node.trash!(@user1)
+
+    assert_equal parent, node.reload.suggested_restore_parent
+
+    parent.trash!(@user1)
+    assert_nil node.reload.suggested_restore_parent
+  end
+
+  test "suggested_restore_parent is root for trashed top-level nodes" do
+    node = Node.root.children.create!(:slug => "was_top_level")
+    node.trash!(@user1)
+
+    assert_equal Node.root, node.reload.suggested_restore_parent
+  end
+
+  test "trashed nodes and the Trash itself stay out of the drafts surfaces" do
+    Node.trash
+    node = create_node_with_published_page
+    node.trash!(@user1)
+
+    ids = Node.drafts_and_autosaves.pluck(:id)
+    assert_not_includes ids, Node.trash.id
+    assert_not_includes ids, node.id
+  end
+end
diff --git a/test/models/page_test.rb b/test/models/page_test.rb
index edb7c37..1f924f9 100644
--- a/test/models/page_test.rb
+++ b/test/models/page_test.rb
@@ -370,4 +370,39 @@ class PageTest < ActiveSupport::TestCase
     assert en_entry[:changed]
     refute en_entry[:exists_there]
   end
+
+  test "aggregate ignores order_by values outside the allowlist" do
+    sql = Page.aggregate(:order_by => "pages.id; DROP TABLE pages--").to_sql
+
+    assert_not_includes sql, "DROP"
+    assert_includes sql, "pages.id ASC"
+  end
+
+  test "aggregate accepts allowlisted order columns, bare or prefixed" do
+    assert_includes Page.aggregate(:order_by => "published_at").to_sql,
+                    "pages.published_at ASC"
+    assert_includes Page.aggregate(:order_by => "pages.published_at").to_sql,
+                    "pages.published_at ASC"
+  end
+
+  test "template_name rejects values not present in the template directory" do
+    page = Page.create!(:title => "Template guard")
+
+    page.template_name = "../../partials/_article"
+    assert_not page.valid?
+
+    page.template_name = "standard_template"
+    assert page.valid?
+
+    page.template_name = ""
+    assert page.valid?
+  end
+
+  test "a stale legacy template_name does not block unrelated saves" do
+    page = Page.create!(:title => "Stale template")
+    page.update_column(:template_name, "long_deleted_template")
+
+    page.reload
+    assert page.update(:abstract => "still saveable")
+  end
 end
diff --git a/test/models/user_test.rb b/test/models/user_test.rb
index 6e4d2d7..feccce2 100644
--- a/test/models/user_test.rb
+++ b/test/models/user_test.rb
@@ -54,6 +54,78 @@ class UserTest < ActiveSupport::TestCase
   def test_should_authenticate_user
     assert_equal users(:quentin), User.authenticate('quentin', 'monkey')
   end
+
+  def test_should_not_authenticate_wrong_password
+    assert_nil User.authenticate("quentin", "wrong password")
+  end
+
+  def test_should_not_authenticate_unknown_user
+    assert_nil User.authenticate("nosuchuser", "monkey")
+  end
+
+  def test_user_with_crypted_password_is_migrated_on_login
+    user = users(:quentin)
+
+    assert_nil user.password_digest
+
+    assert User.authenticate("quentin", "monkey")
+
+    user.reload
+
+    assert_not_nil user.password_digest
+    assert_nil user.crypted_password
+    assert_nil user.salt
+  end
+
+  def test_new_user_uses_password_digest
+    user = create_user
+
+    assert_not_nil user.password_digest
+    assert_nil user.crypted_password
+    assert_nil user.salt
+
+    assert_equal user, User.authenticate("quire", "quire69")
+  end
+
+  def test_legacy_user_is_migrated_on_login
+    user = users(:quentin)
+
+    assert_nil user.password_digest
+    assert_not_nil user.crypted_password
+    assert_not_nil user.salt
+
+    assert_equal user, User.authenticate("quentin", "monkey")
+
+    user.reload
+
+    assert_not_nil user.password_digest
+    assert_nil user.crypted_password
+    assert_nil user.salt
+  end
+
+  def test_migrated_user_authenticates_using_password_digest
+    user = users(:quentin)
+
+    # Trigger automatic migration.
+    assert_equal user, User.authenticate("quentin", "monkey")
+
+    user.reload
+
+    assert_not_nil user.password_digest
+    assert_nil user.crypted_password
+    assert_nil user.salt
+
+    # Second login should now use password_digest.
+    assert_equal user, User.authenticate("quentin", "monkey")
+  end
+
+  def test_migrated_user_can_be_updated_without_password
+    user = users(:quentin)
+    assert_equal user, User.authenticate("quentin", "monkey")
+    user.reload
+
+    assert user.update(:email => "quentin@example.org")
+  end
   
 protected
   def create_user(options = {})