admins can destroy users

I changed the permissions a little to be more consistent.

Now:
* admins can edit users
* users can destroy themselves.

There's no ui for either of them but theoretically they could. Not sure this is what we want though.

3 files changed, 69 insertions, 4 deletions

diff --git a/users/app/controllers/users_controller.rb b/users/app/controllers/users_controller.rb
index 925b584..3407191 100644
--- a/users/app/controllers/users_controller.rb
+++ b/users/app/controllers/users_controller.rb
@@ -2,7 +2,7 @@ class UsersController < ApplicationController
 
   skip_before_filter :verify_authenticity_token, :only => [:create]
 
-  before_filter :fetch_user, :only => [:edit, :update]
+  before_filter :fetch_user, :only => [:edit, :update, :destroy]
   before_filter :authorize_admin, :only => [:index]
 
   respond_to :json, :html
@@ -34,10 +34,15 @@ class UsersController < ApplicationController
     respond_with @user
   end
 
+  def destroy
+    @user.destroy
+    redirect_to users_path
+  end
+
   protected
 
   def fetch_user
     @user = User.find_by_param(params[:id])
-    access_denied unless @user == current_user
+    access_denied unless admin? or (@user == current_user)
   end
 end
diff --git a/users/test/functional/users_controller_test.rb b/users/test/functional/users_controller_test.rb
index ced8ee9..ab29845 100644
--- a/users/test/functional/users_controller_test.rb
+++ b/users/test/functional/users_controller_test.rb
@@ -47,4 +47,49 @@ class UsersControllerTest < ActionController::TestCase
     assert_equal " ", @response.body
     assert_response 204
   end
+
+  test "admin can destroy user" do
+    login :is_admin? => true
+    user = stub_record User
+    user.expects(:destroy)
+    User.expects(:find_by_param).with(user.id.to_s).returns(user)
+    delete :destroy, :id => user.id
+    assert_response :redirect
+    # assert_redirected_to users_path
+  end
+
+  test "non-admin can't destroy user" do
+    login
+    user = stub_record User
+    delete :destroy, :id => user.id
+    assert_access_denied
+  end
+
+  test "admin can list users" do
+    login :is_admin? => true
+    get :index
+    assert_response :success
+    assert assigns(:users)
+  end
+
+  test "non-admin can't list users" do
+    login
+    get :index
+    assert_access_denied
+  end
+
+  test "admin can autocomplete users" do
+    login :is_admin? => true
+    get :index, :format => :json
+    assert_response :success
+    assert assigns(:users)
+  end
+
+  test "admin can search users" do
+    login :is_admin? => true
+    get :index, :query => "a"
+    assert_response :success
+    assert assigns(:users)
+  end
+
 end
diff --git a/users/test/support/auth_test_helper.rb b/users/test/support/auth_test_helper.rb
index 0b73f5f..e0b673a 100644
--- a/users/test/support/auth_test_helper.rb
+++ b/users/test/support/auth_test_helper.rb
@@ -1,4 +1,5 @@
 module AuthTestHelper
+  include StubRecordHelper
   extend ActiveSupport::Concern
 
   # Controller will fetch current user from warden.
@@ -9,8 +10,8 @@ module AuthTestHelper
     end
   end
 
-  def login(user = nil)
-    @current_user = user || stub
+  def login(user_or_method_hash = nil)
+    @current_user = stub_user(user_or_method_hash)
     unless @current_user.respond_to? :is_admin?
       @current_user.stubs(:is_admin?).returns(false)
     end
@@ -26,6 +27,20 @@ module AuthTestHelper
       assert flash[:alert].blank?
     end
   end
+
+  protected
+
+  # Will create a stub user for logging in from either
+  # * a hash of methods to stub
+  # * a user record
+  # * nil -> create a user record stub
+  def stub_user(user_or_method_hash)
+    if user_or_method_hash.is_a?(Hash)
+      stub_record User, user_or_method_hash
+    else
+      user_or_method_hash || stub_record(User)
+    end
+  end
 end
 
 class ActionController::TestCase