From 47e0185409174b0b6d0336c3a039cc3e1d49d075 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Juan=20Jos=C3=A9=20Mata?= <juanjo.mata@gmail.com>
Date: Sat, 17 Jan 2026 17:59:10 +0100
Subject: [PATCH] fix: Allow locale preview on onboarding preferences page
 (#682)

* fix: Allow locale preview on onboarding preferences page

When a user selects a different language on /onboarding/preferences,
the page now immediately displays in the selected language. This is
achieved by checking for a valid locale URL parameter before falling
back to the family's saved locale setting.

* fix: Harden locale param handling and restore locale in tests

- Add type check to ensure params[:locale] is a String before calling
  .to_sym, preventing 500 errors from array/hash injection attacks
- Add teardown to tests to restore original locale, preventing test
  pollution

* fix: Reload family in teardown to handle update_column

* fix: Remove edge case test that used update_column with nil locale

* fix: Simplify localize tests - rely on fixture defaults and transactional isolation

* fix: Update system test to expect Spanish button text after locale preview

* refactor: Use I18n.t for button text in system test instead of hardcoded string

---------

Co-authored-by: Claude <noreply@anthropic.com>
---
 app/controllers/concerns/localize.rb       |  8 ++++++-
 test/controllers/concerns/localize_test.rb | 25 ++++++++++++++++++++++
 test/system/onboardings_test.rb            |  3 ++-
 3 files changed, 34 insertions(+), 2 deletions(-)
 create mode 100644 test/controllers/concerns/localize_test.rb

diff --git a/app/controllers/concerns/localize.rb b/app/controllers/concerns/localize.rb
index f3b558c1b..2c5a19646 100644
--- a/app/controllers/concerns/localize.rb
+++ b/app/controllers/concerns/localize.rb
@@ -8,10 +8,16 @@ module Localize
 
   private
     def switch_locale(&action)
-      locale = Current.family.try(:locale) || I18n.default_locale
+      locale = locale_from_param || Current.family.try(:locale) || I18n.default_locale
       I18n.with_locale(locale, &action)
     end
 
+    def locale_from_param
+      return unless params[:locale].is_a?(String) && params[:locale].present?
+      locale = params[:locale].to_sym
+      locale if I18n.available_locales.include?(locale)
+    end
+
     def switch_timezone(&action)
       timezone = Current.family.try(:timezone) || Time.zone
       Time.use_zone(timezone, &action)
diff --git a/test/controllers/concerns/localize_test.rb b/test/controllers/concerns/localize_test.rb
new file mode 100644
index 000000000..29610d6b4
--- /dev/null
+++ b/test/controllers/concerns/localize_test.rb
@@ -0,0 +1,25 @@
+require "test_helper"
+
+class LocalizeTest < ActionDispatch::IntegrationTest
+  setup do
+    sign_in users(:family_admin)
+  end
+
+  test "uses family locale by default" do
+    get preferences_onboarding_url
+    assert_response :success
+    assert_select "h1", text: /Configure your preferences/i
+  end
+
+  test "switches locale when locale param is provided" do
+    get preferences_onboarding_url(locale: "fr")
+    assert_response :success
+    assert_select "h1", text: /Configurez vos préférences/i
+  end
+
+  test "ignores invalid locale param and uses family locale" do
+    get preferences_onboarding_url(locale: "invalid_locale")
+    assert_response :success
+    assert_select "h1", text: /Configure your preferences/i
+  end
+end
diff --git a/test/system/onboardings_test.rb b/test/system/onboardings_test.rb
index 9258c2c13..8b06f1174 100644
--- a/test/system/onboardings_test.rb
+++ b/test/system/onboardings_test.rb
@@ -115,7 +115,8 @@ class OnboardingsTest < ApplicationSystemTestCase
     select "DD/MM/YYYY", from: "user_family_attributes_date_format"
     select "Dark", from: "user_theme"
 
-    click_button "Complete"
+    # Button text is in Spanish due to locale preview
+    click_button I18n.t("onboardings.preferences.submit", locale: :es)
 
     # Wait for redirect to goals page to ensure form was submitted
     assert_current_path goals_onboarding_path