mirror of
https://github.com/we-promise/sure.git
synced 2026-09-09 08:34:26 +00:00
bb835b9793
* Add admin family management features and tests
- Implement FamiliesController with destroy action to delete unused families.
- Add localization for success and error messages related to family deletion.
- Create FamiliesControllerTest to ensure proper functionality of family deletion.
- Update UserPolicyTest to include permissions for super admins to delete users.
- Enhance UsersControllerTest with tests for user family management, including moving users between families and creating new families.
* feat(users): enhance user management with family transfer validation and improved delete warnings
* Simplify user management actions column and combine family options
Move heavy user edit forms from table rows into a DS::Popover action
menu, add role badges to the user column, combine family migration and
creation inputs with a Stimulus controller, enable self-family
transfer for super admins, and add safety guards against demoting the
last super admin in the system.
* feat: add authentication type pills to admin user index to display SSO and local login status
* Add set password feature for local users in admin user management
- Add password field in action popover for users with local password login
- Enforce all registration password criteria (min 8 chars, mixed case, digit, special char)
- Block simultaneous family and password updates with clear error
- Show descriptive success notifications (role, password, both, family)
- Ignore password param for SSO-only users
- Add comprehensive tests for all password validation paths
* Resolve DS Drift Patrol findings and CI scan failures
- Wrap auth-type pills in DS::Tooltip instead of native title= attribute
- Add actions.manage_user key to locale and drop redundant default: fallbacks
- Fix RuboCop style offenses in Admin::UsersController
- Update Brakeman ignore entry fingerprint for Admin::UsersController#user_params
* fix: update badge query to target DS::Pill structure
* Fix DS::Tooltip misuse hiding SSO auth-type pill in admin users view
The SSO pill was passed as a block to DS::Tooltip, which caused it to
render inside the hidden div[role="tooltip"] instead of being visible.
The text: option ("SSO Provider: ...") was also silently ignored because
tooltip_content returns content (the block) over @text when a block is
given.
Fix: render the SSO/Local+SSO pill directly as visible content and pass
DS::Tooltip with no block so text: is used as the tooltip popup. An info
icon now appears next to the pill and shows the provider name on hover.
Fixes test: Admin::UsersControllerTest#test_index_renders_auth_type_pills_for_local_and_sso_users
* Remove redundant default: fallback from role pill i18n lookup
All admin.users.index.roles.{guest,member,admin,super_admin} keys are
defined in the locale file and used elsewhere in the same view without
a default:. The fallback was redundant for every valid role and would
silently mask a missing or renamed key instead of raising in
development.
Drop the default: user.role.humanize argument so that any future
missing key surfaces immediately as I18n::MissingTranslationData.
* Revert unrelated JS/schema/split churn; fix transfer_to_family! default role
- Revert 62 JS files (Biome formatter and unrelated controller changes)
- Revert db/schema.rb dump churn (no new migrations in this branch)
- Revert unrelated split transaction view changes (edit/new.html.erb)
- Fix User#transfer_to_family! role default: role: role evaluates to nil
when omitted; use explicit self.role to read model attribute
Keeps the PR focused on user/family management (~18-20 files).
* Fix last login and session count in admin user management
Store last_login_at and sessions_count directly on the users table
so they remain accurate after a user logs out.
- Add migration to add last_login_at (datetime) and sessions_count
(integer, default 0) columns to users, with backfill from sessions
- Add counter_cache: :sessions_count to Session#belongs_to :user so
the count auto-increments/decrements on session create/destroy
- Add after_create callback on Session to stamp user.last_login_at
- Update Admin::UsersController to read both values from users table
instead of aggregating Session rows (which disappear on logout)
* Fix user management PR pending CI items
* Keep test current session after sign in
* Address PR review comments for user transfers
* refactor: update user removal label to "Delete User" and standardize component attribute naming
* Address PR Review Feedback for User Management
* test: Fix families and users controller tests for user management PR
* Limit PR 2868 schema diff
* Fix PR 2868 user management CI failures
---------
Signed-off-by: Juan José Mata <juanjo.mata@gmail.com>
Co-authored-by: sure-admin <sure-admin@splashblot.com>
Co-authored-by: Juan José Mata <juanjo.mata@gmail.com>
84 lines
2.3 KiB
Ruby
84 lines
2.3 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
require "test_helper"
|
|
|
|
class UserPolicyTest < ActiveSupport::TestCase
|
|
def setup
|
|
@super_admin = users(:family_admin)
|
|
@super_admin.update!(role: :super_admin)
|
|
|
|
@regular_user = users(:family_member)
|
|
@regular_user.update!(role: :member)
|
|
|
|
@other_user = users(:sure_support_staff)
|
|
@other_user.update!(role: :member)
|
|
end
|
|
|
|
test "super admin can view index" do
|
|
assert UserPolicy.new(@super_admin, User).index?
|
|
end
|
|
|
|
test "regular user cannot view index" do
|
|
assert_not UserPolicy.new(@regular_user, User).index?
|
|
end
|
|
|
|
test "nil user cannot view index" do
|
|
assert_not UserPolicy.new(nil, User).index?
|
|
end
|
|
|
|
test "super admin can update another user" do
|
|
assert UserPolicy.new(@super_admin, @regular_user).update?
|
|
end
|
|
|
|
test "super admin can update themselves" do
|
|
assert UserPolicy.new(@super_admin, @super_admin).update?
|
|
end
|
|
|
|
test "super admin can delete another user" do
|
|
assert UserPolicy.new(@super_admin, @regular_user).destroy?
|
|
end
|
|
|
|
test "super admin cannot delete themselves" do
|
|
assert_not UserPolicy.new(@super_admin, @super_admin).destroy?
|
|
end
|
|
|
|
test "regular user cannot update anyone" do
|
|
assert_not UserPolicy.new(@regular_user, @other_user).update?
|
|
end
|
|
|
|
test "nil user cannot update anyone" do
|
|
assert_not UserPolicy.new(nil, @regular_user).update?
|
|
end
|
|
|
|
test "super admin can destroy another user" do
|
|
assert UserPolicy.new(@super_admin, @regular_user).destroy?
|
|
end
|
|
|
|
test "super admin cannot destroy themselves" do
|
|
assert_not UserPolicy.new(@super_admin, @super_admin).destroy?
|
|
end
|
|
|
|
test "regular user cannot destroy anyone" do
|
|
assert_not UserPolicy.new(@regular_user, @other_user).destroy?
|
|
end
|
|
|
|
test "nil user cannot destroy anyone" do
|
|
assert_not UserPolicy.new(nil, @regular_user).destroy?
|
|
end
|
|
|
|
test "scope returns all users for super admin" do
|
|
scope = UserPolicy::Scope.new(@super_admin, User).resolve
|
|
assert_equal User.count, scope.count
|
|
end
|
|
|
|
test "scope returns no users for regular user" do
|
|
scope = UserPolicy::Scope.new(@regular_user, User).resolve
|
|
assert_equal 0, scope.count
|
|
end
|
|
|
|
test "scope returns no users for nil user" do
|
|
scope = UserPolicy::Scope.new(nil, User).resolve
|
|
assert_equal 0, scope.count
|
|
end
|
|
end
|