Handling invalid signin

app/controllers/sessions_controller.rb

@@ -5,6 +5,15 @@ def new
   end
 
   def create
+    user = User.authenticate(params[:session][:email],
+                             params[:session][:password])
+    if user.nil?
+      flash.now[:error] = "Invalid email/password combination."
+      @title = "Sign in"
+      render 'new'
+    else
+      # Handle successful signin.
+    end
   end
 
   def destroy

spec/controllers/sessions_controller_spec.rb

@@ -14,4 +14,29 @@
       response.should have_selector('title', :content => "Sign in")
     end
   end
+
+  describe "POST 'create'" do
+
+    describe "failure" do
+
+      before(:each) do
+        @attr = { :email => "", :password => "" }
+      end
+
+      it "should re-render the new page" do
+        post :create, :session => @attr
+        response.should render_template('new')
+      end
+
+      it "should have the right title" do
+        post :create, :session => @attr
+        response.should have_selector('title', :content => "Sign in")
+      end
+
+      it "should have an error message" do
+        post :create, :session => @attr
+        flash.now[:error].should =~ /invalid/i
+      end
+    end
+  end
 end