Making authenticated requests with ember-simple-auth-ephemeral store in testing

Question

I have a rails backend and ember cli project that are using ember-simple-auth devise and I am trying to get a Qunit test to cover an authenticated post to rails. I am not mocking out any backend calls.

My test is setup like this:

test('successfully POSTing', function(){
  // helper to signin through ember
  signIn();

  andThen(function(){
    // fill out a form and submit it  
    equal(find('li').text(), 'aodsfiu');

  })
});

I am using simple-auth-session-store:ephemeral in my test ENV.

The signIn() helper works fine: I can see from both the ember and rails logs that it submits the form and gets back status 201, however the following request returns status 401 like the authentication info is never saved / not used in the following request.

If I test this manually, everything is okay, which leads me to think it's an issue with the test env, BUT when I remove the store:ephemeral I still get back status 401 from my server.

How can I make authenticated requests to my server with ember-simple-auth in a test environment? Is there a way to access the test session data directly and set the user-token and email so that rails will think I am authenticated?

env:

if (environment === 'test') {
    // simple auth local storage stuff
    ENV['simple-auth'] = {
      authorizer: 'simple-auth-authorizer:devise',
      crossOriginWhitelist: ['*'],
      store: 'simple-auth-session-store:ephemeral',

    }
    // Testem prefers this...
    ENV.baseURL = '/';
    ENV.locationType = 'auto';

    // keep test console output quieter
    ENV.APP.LOG_ACTIVE_GENERATION = false;
    ENV.APP.LOG_VIEW_LOOKUPS = false;

    ENV.APP.rootElement = '#ember-testing';
  }

Answer 1

The ephemeral store only makes sure that the session isn't actually persisted so that tests don't influence each other. What you see might be caused by Ember Simple Auth's cross origin authorization policy - as long as you don't whitelist an origin requests going to it will not be authorized so that your token doesn't get exposed to arbitrary sites. See the API docs.