Merge remote-tracking branch 'origin/master' into feature/fixed-email-address

Conflicts:
	users/app/views/emails/_email.html.haml

1 files changed, 72 insertions, 0 deletions

diff --git a/users/test/functional/users_controller_test.rb b/users/test/functional/users_controller_test.rb
index 8f1ee15..9fb06c9 100644
--- a/users/test/functional/users_controller_test.rb
+++ b/users/test/functional/users_controller_test.rb
@@ -9,13 +9,85 @@ class UsersControllerTest < ActionController::TestCase
     assert_response :success
   end
 
+  test "failed show without login" do
+    user = FactoryGirl.build(:user)
+    user.save
+    get :show, :id => user.id
+    assert_response :redirect
+    assert_redirected_to login_path
+    user.destroy
+  end
+
+  test "user can see user" do
+    user = find_record :user,
+      :email => nil,
+      :email_forward => nil,
+      :email_aliases => [],
+      :created_at => Time.now,
+      :updated_at => Time.now,
+      :most_recent_tickets => []
+    login user
+    get :show, :id => user.id
+    assert_response :success
+  end
+
+  test "admin can see other user" do
+    user = find_record :user,
+      :email => nil,
+      :email_forward => nil,
+      :email_aliases => [],
+      :created_at => Time.now,
+      :updated_at => Time.now,
+      :most_recent_tickets => []
+    login :is_admin? => true
+    get :show, :id => user.id
+    assert_response :success
+
+  end
+
+  test "user cannot see other user" do
+    user = find_record :user,
+      :email => nil,
+      :email_forward => nil,
+      :email_aliases => [],
+      :created_at => Time.now,
+      :updated_at => Time.now,
+      :most_recent_tickets => []
+    login
+    get :show, :id => user.id
+    assert_response :redirect
+    assert_access_denied
+  end
+
+  test "show for non-existing user" do
+    nonid = 'thisisnotanexistinguserid'
+
+    # when unauthenticated:
+    get :show, :id => nonid
+    assert_access_denied(true, false)
+
+    # when authenticated but not admin:
+    login
+    get :show, :id => nonid
+    assert_access_denied
+
+    # when authenticated as admin:
+    login :is_admin? => true
+    get :show, :id => nonid
+    assert_response :redirect
+    assert_equal({:alert => "No such user."}, flash.to_hash)
+    assert_redirected_to users_path
+  end
+
   test "should create new user" do
     user_attribs = record_attributes_for :user
     user = User.new(user_attribs)
     User.expects(:create).with(user_attribs).returns(user)
 
+
     post :create, :user => user_attribs, :format => :json
 
+
     assert_nil session[:user_id]
     assert_json_response user
     assert_response :success