summaryrefslogtreecommitdiff
path: root/users/test
diff options
context:
space:
mode:
authorAzul <azul@leap.se>2012-11-28 15:13:47 +0100
committerAzul <azul@leap.se>2012-11-28 15:22:09 +0100
commit277b9f98bfbe2ef0217dfd17c8d9d6597369b903 (patch)
tree95f3ad2867708e825a6635eb57b94a17b83ae2fe /users/test
parent1d7ea661ca0cc03ffb10026e306d4e451e085cfa (diff)
admins can destroy users
I changed the permissions a little to be more consistent. Now: * admins can edit users * users can destroy themselves. There's no ui for either of them but theoretically they could. Not sure this is what we want though.
Diffstat (limited to 'users/test')
-rw-r--r--users/test/functional/users_controller_test.rb45
-rw-r--r--users/test/support/auth_test_helper.rb19
2 files changed, 62 insertions, 2 deletions
diff --git a/users/test/functional/users_controller_test.rb b/users/test/functional/users_controller_test.rb
index ced8ee9..ab29845 100644
--- a/users/test/functional/users_controller_test.rb
+++ b/users/test/functional/users_controller_test.rb
@@ -47,4 +47,49 @@ class UsersControllerTest < ActionController::TestCase
assert_equal " ", @response.body
assert_response 204
end
+
+ test "admin can destroy user" do
+ login :is_admin? => true
+ user = stub_record User
+ user.expects(:destroy)
+ User.expects(:find_by_param).with(user.id.to_s).returns(user)
+ delete :destroy, :id => user.id
+ assert_response :redirect
+ # assert_redirected_to users_path
+ end
+
+ test "non-admin can't destroy user" do
+ login
+ user = stub_record User
+ delete :destroy, :id => user.id
+ assert_access_denied
+ end
+
+ test "admin can list users" do
+ login :is_admin? => true
+ get :index
+ assert_response :success
+ assert assigns(:users)
+ end
+
+ test "non-admin can't list users" do
+ login
+ get :index
+ assert_access_denied
+ end
+
+ test "admin can autocomplete users" do
+ login :is_admin? => true
+ get :index, :format => :json
+ assert_response :success
+ assert assigns(:users)
+ end
+
+ test "admin can search users" do
+ login :is_admin? => true
+ get :index, :query => "a"
+ assert_response :success
+ assert assigns(:users)
+ end
+
end
diff --git a/users/test/support/auth_test_helper.rb b/users/test/support/auth_test_helper.rb
index 0b73f5f..e0b673a 100644
--- a/users/test/support/auth_test_helper.rb
+++ b/users/test/support/auth_test_helper.rb
@@ -1,4 +1,5 @@
module AuthTestHelper
+ include StubRecordHelper
extend ActiveSupport::Concern
# Controller will fetch current user from warden.
@@ -9,8 +10,8 @@ module AuthTestHelper
end
end
- def login(user = nil)
- @current_user = user || stub
+ def login(user_or_method_hash = nil)
+ @current_user = stub_user(user_or_method_hash)
unless @current_user.respond_to? :is_admin?
@current_user.stubs(:is_admin?).returns(false)
end
@@ -26,6 +27,20 @@ module AuthTestHelper
assert flash[:alert].blank?
end
end
+
+ protected
+
+ # Will create a stub user for logging in from either
+ # * a hash of methods to stub
+ # * a user record
+ # * nil -> create a user record stub
+ def stub_user(user_or_method_hash)
+ if user_or_method_hash.is_a?(Hash)
+ stub_record User, user_or_method_hash
+ else
+ user_or_method_hash || stub_record(User)
+ end
+ end
end
class ActionController::TestCase