admins can destroy users

I changed the permissions a little to be more consistent.

Now:
* admins can edit users
* users can destroy themselves.

There's no ui for either of them but theoretically they could. Not sure this is what we want though.

2 files changed, 62 insertions, 2 deletions

diff --git a/users/test/functional/users_controller_test.rb b/users/test/functional/users_controller_test.rb
index ced8ee9..ab29845 100644
--- a/users/test/functional/users_controller_test.rb
+++ b/users/test/functional/users_controller_test.rb
@@ -47,4 +47,49 @@ class UsersControllerTest < ActionController::TestCase
     assert_equal " ", @response.body
     assert_response 204
   end
+
+  test "admin can destroy user" do
+    login :is_admin? => true
+    user = stub_record User
+    user.expects(:destroy)
+    User.expects(:find_by_param).with(user.id.to_s).returns(user)
+    delete :destroy, :id => user.id
+    assert_response :redirect
+    # assert_redirected_to users_path
+  end
+
+  test "non-admin can't destroy user" do
+    login
+    user = stub_record User
+    delete :destroy, :id => user.id
+    assert_access_denied
+  end
+
+  test "admin can list users" do
+    login :is_admin? => true
+    get :index
+    assert_response :success
+    assert assigns(:users)
+  end
+
+  test "non-admin can't list users" do
+    login
+    get :index
+    assert_access_denied
+  end
+
+  test "admin can autocomplete users" do
+    login :is_admin? => true
+    get :index, :format => :json
+    assert_response :success
+    assert assigns(:users)
+  end
+
+  test "admin can search users" do
+    login :is_admin? => true
+    get :index, :query => "a"
+    assert_response :success
+    assert assigns(:users)
+  end
+
 end
diff --git a/users/test/support/auth_test_helper.rb b/users/test/support/auth_test_helper.rb
index 0b73f5f..e0b673a 100644
--- a/users/test/support/auth_test_helper.rb
+++ b/users/test/support/auth_test_helper.rb
@@ -1,4 +1,5 @@
 module AuthTestHelper
+  include StubRecordHelper
   extend ActiveSupport::Concern
 
   # Controller will fetch current user from warden.
@@ -9,8 +10,8 @@ module AuthTestHelper
     end
   end
 
-  def login(user = nil)
-    @current_user = user || stub
+  def login(user_or_method_hash = nil)
+    @current_user = stub_user(user_or_method_hash)
     unless @current_user.respond_to? :is_admin?
       @current_user.stubs(:is_admin?).returns(false)
     end
@@ -26,6 +27,20 @@ module AuthTestHelper
       assert flash[:alert].blank?
     end
   end
+
+  protected
+
+  # Will create a stub user for logging in from either
+  # * a hash of methods to stub
+  # * a user record
+  # * nil -> create a user record stub
+  def stub_user(user_or_method_hash)
+    if user_or_method_hash.is_a?(Hash)
+      stub_record User, user_or_method_hash
+    else
+      user_or_method_hash || stub_record(User)
+    end
+  end
 end
 
 class ActionController::TestCase