From 3e0a1a47c0eafb7f9b79e5f2765ea33ce1ad159b Mon Sep 17 00:00:00 2001
From: Azul <azul@leap.se>
Date: Wed, 24 Oct 2012 20:35:52 +0200
Subject: basic admin controller methods and helpers + tests

---
 .../app/controllers/application_controller.rb      |  3 --
 users/app/controllers/application_controller.rb    | 22 +++++++++-
 .../test/functional/application_controller_test.rb | 44 ++++++++++++++++++++
 users/test/functional/helper_methods_test.rb       | 48 ++++++++++++++++++++++
 users/test/support/auth_test_helper.rb             |  7 ++++
 users/test/test_helper.rb                          |  3 ++
 6 files changed, 122 insertions(+), 5 deletions(-)
 delete mode 100644 test/dummy/app/controllers/application_controller.rb
 create mode 100644 users/test/functional/application_controller_test.rb
 create mode 100644 users/test/functional/helper_methods_test.rb
 create mode 100644 users/test/support/auth_test_helper.rb

diff --git a/test/dummy/app/controllers/application_controller.rb b/test/dummy/app/controllers/application_controller.rb
deleted file mode 100644
index e8065d9..0000000
--- a/test/dummy/app/controllers/application_controller.rb
+++ /dev/null
@@ -1,3 +0,0 @@
-class ApplicationController < ActionController::Base
-  protect_from_forgery
-end
diff --git a/users/app/controllers/application_controller.rb b/users/app/controllers/application_controller.rb
index 64e1a55..0d6e5d1 100644
--- a/users/app/controllers/application_controller.rb
+++ b/users/app/controllers/application_controller.rb
@@ -1,14 +1,32 @@
 class ApplicationController < ActionController::Base
   protect_from_forgery
 
-  private
+  protected
 
   def current_user
     @current_user ||= User.find(session[:user_id]) if session[:user_id]
   end
   helper_method :current_user
 
+  def logged_in?
+    !!current_user
+  end
+  helper_method :logged_in?
+
   def authorize
-    redirect_to login_url, alert: "Not authorized" if current_user.nil?
+    access_denied unless logged_in?
+  end
+
+  def admin?
+    current_user && current_user.is_admin?
+  end
+  helper_method :admin?
+
+  def authorize_admin
+    access_denied unless admin?
+  end
+
+  def access_denied
+    redirect_to login_url, :alert => "Not authorized"
   end
 end
diff --git a/users/test/functional/application_controller_test.rb b/users/test/functional/application_controller_test.rb
new file mode 100644
index 0000000..d13a354
--- /dev/null
+++ b/users/test/functional/application_controller_test.rb
@@ -0,0 +1,44 @@
+require 'test_helper'
+
+class ApplicationControllerTest < ActionController::TestCase
+
+  def setup
+    @user_id = stub
+    @user = stub
+    session[:user_id] = @user_id
+    # so we can test the effect on the response
+    @controller.response = @response
+  end
+
+  def test_authorize_redirect
+    session[:user_id] = nil
+    @controller.send(:authorize)
+    assert_access_denied
+  end
+
+  def test_current_user_with_caching
+    User.expects(:find).once.with(@user_id).returns(@user)
+    assert_equal @user, @controller.send(:current_user)
+    assert_equal @user, @controller.send(:current_user) # tests caching
+  end
+
+  def test_authorized
+    User.expects(:find).once.with(@user_id).returns(@user)
+    @controller.send(:authorize)
+  end
+
+  def test_admin
+    bool = stub
+    User.expects(:find).once.with(@user_id).returns(@user)
+    @user.expects(:is_admin?).returns(bool)
+    assert_equal bool, @controller.send(:admin?)
+  end
+
+  def test_authorize_admin
+    User.expects(:find).once.with(@user_id).returns(@user)
+    @user.expects(:is_admin?).returns(false)
+    @controller.send(:authorize_admin)
+    assert_access_denied
+  end
+
+end
diff --git a/users/test/functional/helper_methods_test.rb b/users/test/functional/helper_methods_test.rb
new file mode 100644
index 0000000..0d76f63
--- /dev/null
+++ b/users/test/functional/helper_methods_test.rb
@@ -0,0 +1,48 @@
+#
+# Testing and documenting the helper methods available from
+# ApplicationController
+#
+
+require 'test_helper'
+
+class HelperMethodsTest < ActionController::TestCase
+  tests ApplicationController
+
+  # we test them right in here...
+  include ApplicationController._helpers
+
+  # they all reference the controller.
+  def controller
+    @controller
+  end
+
+  def setup
+    @user_id = stub
+    @user = stub
+    session[:user_id] = @user_id
+  end
+
+  def test_current_user_with_caching
+    User.expects(:find).once.with(@user_id).returns(@user)
+    assert_equal @user, current_user
+    assert_equal @user, current_user # tests caching
+  end
+
+  def test_logged_in
+    User.expects(:find).once.with(@user_id).returns(@user)
+    assert logged_in?
+  end
+
+  def test_logged_in
+    User.expects(:find).once.with(@user_id).returns(nil)
+    assert !logged_in?
+  end
+
+  def test_admin
+    bool = stub
+    User.expects(:find).once.with(@user_id).returns(@user)
+    @user.expects(:is_admin?).returns(bool)
+    assert_equal bool, admin?
+  end
+
+end
diff --git a/users/test/support/auth_test_helper.rb b/users/test/support/auth_test_helper.rb
new file mode 100644
index 0000000..c30421f
--- /dev/null
+++ b/users/test/support/auth_test_helper.rb
@@ -0,0 +1,7 @@
+module AuthTestHelper
+
+  def assert_access_denied
+    assert_equal({:alert => "Not authorized"}, flash.to_hash)
+    assert_redirected_to login_path
+  end
+end
diff --git a/users/test/test_helper.rb b/users/test/test_helper.rb
index 08d4d41..ae6a35c 100644
--- a/users/test/test_helper.rb
+++ b/users/test/test_helper.rb
@@ -8,3 +8,6 @@ Rails.backtrace_cleaner.remove_silencers!
 # Load support files
 Dir["#{File.dirname(__FILE__)}/support/**/*.rb"].each { |f| require f }
 
+class ActionController::TestCase
+  include AuthTestHelper
+end
-- 
cgit v1.2.3


From b724d53b36878c96d30676c22ee4e4369dcc37f8 Mon Sep 17 00:00:00 2001
From: Azul <azul@leap.se>
Date: Wed, 24 Oct 2012 20:41:30 +0200
Subject: Extraction of test support methods

---
 .../test/functional/application_controller_test.rb | 14 ++++++-------
 users/test/functional/helper_methods_test.rb       | 16 +++++----------
 users/test/support/auth_test_helper.rb             | 24 +++++++++++++++++++---
 3 files changed, 32 insertions(+), 22 deletions(-)

diff --git a/users/test/functional/application_controller_test.rb b/users/test/functional/application_controller_test.rb
index d13a354..4397e1d 100644
--- a/users/test/functional/application_controller_test.rb
+++ b/users/test/functional/application_controller_test.rb
@@ -3,39 +3,37 @@ require 'test_helper'
 class ApplicationControllerTest < ActionController::TestCase
 
   def setup
-    @user_id = stub
-    @user = stub
-    session[:user_id] = @user_id
     # so we can test the effect on the response
     @controller.response = @response
   end
 
   def test_authorize_redirect
-    session[:user_id] = nil
+    stub_logged_out
     @controller.send(:authorize)
     assert_access_denied
   end
 
   def test_current_user_with_caching
-    User.expects(:find).once.with(@user_id).returns(@user)
+    @user = stub_logged_in
     assert_equal @user, @controller.send(:current_user)
     assert_equal @user, @controller.send(:current_user) # tests caching
   end
 
   def test_authorized
-    User.expects(:find).once.with(@user_id).returns(@user)
+    @user = stub_logged_in
     @controller.send(:authorize)
+    assert_access_denied(false)
   end
 
   def test_admin
     bool = stub
-    User.expects(:find).once.with(@user_id).returns(@user)
+    @user = stub_logged_in
     @user.expects(:is_admin?).returns(bool)
     assert_equal bool, @controller.send(:admin?)
   end
 
   def test_authorize_admin
-    User.expects(:find).once.with(@user_id).returns(@user)
+    @user = stub_logged_in
     @user.expects(:is_admin?).returns(false)
     @controller.send(:authorize_admin)
     assert_access_denied
diff --git a/users/test/functional/helper_methods_test.rb b/users/test/functional/helper_methods_test.rb
index 0d76f63..c0eaf61 100644
--- a/users/test/functional/helper_methods_test.rb
+++ b/users/test/functional/helper_methods_test.rb
@@ -16,31 +16,25 @@ class HelperMethodsTest < ActionController::TestCase
     @controller
   end
 
-  def setup
-    @user_id = stub
-    @user = stub
-    session[:user_id] = @user_id
-  end
-
   def test_current_user_with_caching
-    User.expects(:find).once.with(@user_id).returns(@user)
+    @user = stub_logged_in
     assert_equal @user, current_user
     assert_equal @user, current_user # tests caching
   end
 
   def test_logged_in
-    User.expects(:find).once.with(@user_id).returns(@user)
+    @user = stub_logged_in
     assert logged_in?
   end
 
-  def test_logged_in
-    User.expects(:find).once.with(@user_id).returns(nil)
+  def test_logged_out
+    stub_logged_out
     assert !logged_in?
   end
 
   def test_admin
     bool = stub
-    User.expects(:find).once.with(@user_id).returns(@user)
+    @user = stub_logged_in
     @user.expects(:is_admin?).returns(bool)
     assert_equal bool, admin?
   end
diff --git a/users/test/support/auth_test_helper.rb b/users/test/support/auth_test_helper.rb
index c30421f..d5d52b1 100644
--- a/users/test/support/auth_test_helper.rb
+++ b/users/test/support/auth_test_helper.rb
@@ -1,7 +1,25 @@
 module AuthTestHelper
 
-  def assert_access_denied
-    assert_equal({:alert => "Not authorized"}, flash.to_hash)
-    assert_redirected_to login_path
+  def stub_logged_in
+    @user_id = stub
+    @user = stub
+    session[:user_id] = @user_id
+    User.expects(:find).once.with(@user_id).returns(@user)
+    return @user
+  end
+
+  def stub_logged_out
+    @user_id = stub
+    session[:user_id] = @user_id
+    User.expects(:find).once.with(@user_id).returns(nil)
+  end
+
+  def assert_access_denied(denied = true)
+    if denied
+      assert_equal({:alert => "Not authorized"}, flash.to_hash)
+      assert_redirected_to login_path
+    else
+      assert flash[:alert].blank?
+    end
   end
 end
-- 
cgit v1.2.3


From 2c2a80812818362d0e0c416deefd4aee2787dd9e Mon Sep 17 00:00:00 2001
From: Azul <azul@leap.se>
Date: Wed, 24 Oct 2012 20:50:40 +0200
Subject: removing duplicate testing of helper_methods

* once tested as helper
* once tested as @controller.send...
---
 users/test/functional/application_controller_test.rb | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/users/test/functional/application_controller_test.rb b/users/test/functional/application_controller_test.rb
index 4397e1d..69bcb2f 100644
--- a/users/test/functional/application_controller_test.rb
+++ b/users/test/functional/application_controller_test.rb
@@ -13,25 +13,12 @@ class ApplicationControllerTest < ActionController::TestCase
     assert_access_denied
   end
 
-  def test_current_user_with_caching
-    @user = stub_logged_in
-    assert_equal @user, @controller.send(:current_user)
-    assert_equal @user, @controller.send(:current_user) # tests caching
-  end
-
   def test_authorized
     @user = stub_logged_in
     @controller.send(:authorize)
     assert_access_denied(false)
   end
 
-  def test_admin
-    bool = stub
-    @user = stub_logged_in
-    @user.expects(:is_admin?).returns(bool)
-    assert_equal bool, @controller.send(:admin?)
-  end
-
   def test_authorize_admin
     @user = stub_logged_in
     @user.expects(:is_admin?).returns(false)
-- 
cgit v1.2.3


From a2a8caf577415ef51c0f99da43f9b47bde226fc6 Mon Sep 17 00:00:00 2001
From: Azul <azul@leap.se>
Date: Mon, 29 Oct 2012 12:08:25 +0100
Subject: first steps at is_admin?

---
 config/initializers/load_config.rb | 1 +
 users/app/models/user.rb           | 7 ++-----
 2 files changed, 3 insertions(+), 5 deletions(-)
 create mode 100644 config/initializers/load_config.rb

diff --git a/config/initializers/load_config.rb b/config/initializers/load_config.rb
new file mode 100644
index 0000000..e687429
--- /dev/null
+++ b/config/initializers/load_config.rb
@@ -0,0 +1 @@
+APP_CONFIG = YAML.load_file("#{Rails.root}/config/config.yml")[Rails.env]
diff --git a/users/app/models/user.rb b/users/app/models/user.rb
index 1afb9db..9bbf169 100644
--- a/users/app/models/user.rb
+++ b/users/app/models/user.rb
@@ -63,11 +63,8 @@ class User < CouchRest::Model::Base
     login
   end
 
-  def self.current
-    Thread.current[:user]
-  end
-  def self.current=(user)
-    Thread.current[:user] = user
+  def is_admin?
+    APP_CONFIG['admins'].include? self.id
   end
 
 end
-- 
cgit v1.2.3


From 6c60b179a09030da985462d15dbdf076367b5ea4 Mon Sep 17 00:00:00 2001
From: jessib <jessib@riseup.net>
Date: Wed, 31 Oct 2012 12:10:07 -0700
Subject: Code to check administration (and ugly test display.) This includes
 example config file.

---
 .gitignore                                          |  3 +++
 README.md                                           |  3 +++
 config/config.yml.example                           |  8 ++++++++
 .../controller_extension/authentication.rb          | 21 +++++++++++++++++++--
 users/app/models/user.rb                            |  3 ++-
 users/app/views/sessions/_nav.html.haml             |  5 ++++-
 6 files changed, 39 insertions(+), 4 deletions(-)
 create mode 100644 config/config.yml.example

diff --git a/.gitignore b/.gitignore
index 93547cd..d447b54 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,3 +20,6 @@
 */Gemfile.lock
 test/dummy/log/*
 test/dummy/tmp/*
+
+# Ignore configuration file.
+config/config.yml
\ No newline at end of file
diff --git a/README.md b/README.md
index 3ea47bb..fee4e60 100644
--- a/README.md
+++ b/README.md
@@ -53,6 +53,9 @@ The webapp can hand out certs for the EIP client. These certs are either picked
 
 We also ship provider information through the webapp. For now please add your eip-service.json to the public/config directory.
 
+Copy the example configuration file and customize as appropriate:
+     cp config/config.yml.example config/config.yml
+
 Running
 -----------------------------
 
diff --git a/config/config.yml.example b/config/config.yml.example
new file mode 100644
index 0000000..e3a0112
--- /dev/null
+++ b/config/config.yml.example
@@ -0,0 +1,8 @@
+development:
+  admins: [admin, admin2]
+
+test:
+  admins: [admin, admin2]
+
+production
+  admins: []
diff --git a/users/app/controllers/controller_extension/authentication.rb b/users/app/controllers/controller_extension/authentication.rb
index 507b62f..c3342f3 100644
--- a/users/app/controllers/controller_extension/authentication.rb
+++ b/users/app/controllers/controller_extension/authentication.rb
@@ -4,14 +4,31 @@ module ControllerExtension::Authentication
   private
 
   included do
-    helper_method :current_user
+    helper_method :current_user, :logged_in?, :admin?
   end
 
   def current_user
     @current_user ||= User.find(session[:user_id]) if session[:user_id]
   end
 
+  def logged_in?
+    !!current_user
+  end
+
   def authorize
-    redirect_to login_url, :alert => "Not authorized" if current_user.nil?
+    access_denied unless logged_in?
   end
+
+  def access_denied
+    redirect_to login_url, :alert => "Not authorized"
+  end
+
+  def admin?
+    current_user && current_user.is_admin?
+  end
+
+  def authorize_admin
+    access_denied unless admin?
+  end
+
 end
diff --git a/users/app/models/user.rb b/users/app/models/user.rb
index 2b8ead7..0f5d650 100644
--- a/users/app/models/user.rb
+++ b/users/app/models/user.rb
@@ -66,8 +66,9 @@ class User < CouchRest::Model::Base
     login
   end
 
+  # Since we are storing admins by login, we cannot allow admins to change their login.
   def is_admin?
-    APP_CONFIG['admins'].include? self.id
+    APP_CONFIG['admins'].include? self.login
   end
 
 end
diff --git a/users/app/views/sessions/_nav.html.haml b/users/app/views/sessions/_nav.html.haml
index a5397bd..204ba88 100644
--- a/users/app/views/sessions/_nav.html.haml
+++ b/users/app/views/sessions/_nav.html.haml
@@ -1,6 +1,9 @@
-- if current_user
+- if logged_in?
   %li
+    = 'logged in as ' + current_user.login
     = link_to t(:logout), logout_path
+    - if admin?
+      = 'ADMIN' # obviously not like this
 - else
   %li
     = link_to t(:login), login_path
-- 
cgit v1.2.3


From 872b9fa6759d5708f5efb19ba46b3c8e2b5d4862 Mon Sep 17 00:00:00 2001
From: jessib <jessib@riseup.net>
Date: Wed, 31 Oct 2012 12:19:15 -0700
Subject: Looks like the help code has already been merged into the develop
 branch, and thus merging into feature-admin_users branch.

---
 Gemfile                                         |  2 +-
 Gemfile.lock                                    |  7 +++
 help/app/controllers/tickets_controller.rb      | 73 +++++++++++++++++++++++++
 help/app/models/ticket.rb                       | 36 ++++++++++--
 help/app/models/ticket_comment.rb               | 14 +++--
 help/app/views/tickets/_comment.html.haml       | 13 +++++
 help/app/views/tickets/_new_comment.html.haml   |  3 +
 help/app/views/tickets/index.html.haml          | 10 ++++
 help/app/views/tickets/new.html.haml            | 16 ++++++
 help/app/views/tickets/show.html.haml           | 26 +++++++++
 help/config/routes.rb                           |  3 +
 help/test/functional/tickets_controller_test.rb | 63 +++++++++++++++++++++
 help/test/unit/ticket_comment_test.rb           | 11 ++--
 help/test/unit/ticket_test.rb                   |  8 ++-
 14 files changed, 266 insertions(+), 19 deletions(-)
 create mode 100644 help/app/controllers/tickets_controller.rb
 create mode 100644 help/app/views/tickets/_comment.html.haml
 create mode 100644 help/app/views/tickets/_new_comment.html.haml
 create mode 100644 help/app/views/tickets/index.html.haml
 create mode 100644 help/app/views/tickets/new.html.haml
 create mode 100644 help/app/views/tickets/show.html.haml
 create mode 100644 help/test/functional/tickets_controller_test.rb

diff --git a/Gemfile b/Gemfile
index 10c661a..40030b5 100644
--- a/Gemfile
+++ b/Gemfile
@@ -9,7 +9,7 @@ eval(File.read(File.dirname(__FILE__) + '/ui_dependencies.rb'))
 gem "leap_web_core", :path => 'core'
 gem 'leap_web_users', :path => 'users'
 gem 'leap_web_certs', :path => 'certs'
-# gem 'leap_web_help', :path => 'help'
+gem 'leap_web_help', :path => 'help'
 
 # To use debugger
 gem 'ruby-debug'
diff --git a/Gemfile.lock b/Gemfile.lock
index a982c2a..86cb8e8 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -14,6 +14,12 @@ PATH
       json
       rails (~> 3.2.8)
 
+PATH
+  remote: help
+  specs:
+    leap_web_help (0.1.0)
+      leap_web_core (= 0.1.0)
+
 PATH
   remote: users
   specs:
@@ -173,6 +179,7 @@ DEPENDENCIES
   jquery-rails
   leap_web_certs!
   leap_web_core!
+  leap_web_help!
   leap_web_users!
   mocha
   ruby-debug
diff --git a/help/app/controllers/tickets_controller.rb b/help/app/controllers/tickets_controller.rb
new file mode 100644
index 0000000..4c7415b
--- /dev/null
+++ b/help/app/controllers/tickets_controller.rb
@@ -0,0 +1,73 @@
+class TicketsController < ApplicationController
+
+  respond_to :html #, :json
+  #has_scope :open, :type => boolean
+
+  def new
+    @ticket = Ticket.new
+    @ticket.comments.build
+  end
+
+  def create
+    @ticket = Ticket.new(params[:ticket])
+    if current_user
+      @ticket.created_by = current_user.id
+      @ticket.email = current_user.email if current_user.email
+      @ticket.comments.last.posted_by = current_user.id
+    else 
+      @ticket.comments.last.posted_by = nil #hacky, but protecting this attribute doesn't work right, so this should make sure it isn't set.
+    end
+
+    flash[:notice] = 'Ticket was successfully created.' if @ticket.save
+    respond_with(@ticket)
+
+  end
+
+=begin
+  def edit
+    @ticket = Ticket.find(params[:id])
+    @ticket.comments.build
+    # build ticket comments?
+  end
+=end
+
+  def show
+    @ticket = Ticket.find(params[:id])
+    # @ticket.comments.build
+    # build ticket comments?
+  end
+  
+  def update
+    @ticket = Ticket.find(params[:id])
+    @ticket.attributes = params[:ticket]
+    
+    @ticket.comments.last.posted_by = (current_user ? current_user.id : nil) #protecting posted_by isn't working, so this should protect it.
+
+    if @ticket.save
+      flash[:notice] = 'Ticket was successfully updated.'
+      respond_with @ticket
+    else
+      #redirect_to [:show, @ticket] #
+      flash[:alert] = 'Ticket has not been changed'
+      redirect_to @ticket
+      #respond_with(@ticket) # why does this go to edit?? redirect???
+    end
+  end
+
+  def index
+    # @tickets = Ticket.by_title #not actually what we will want
+    respond_with(@tickets = Ticket.all) #we'll want only tickets that this user can access
+  end
+
+  private
+  
+  # not using now, as we are using comment_attributes= from the Ticket model
+=begin
+  def add_comment
+    comment = TicketComment.new(params[:comment])
+    comment.posted_by = User.current.id if User.current #could be nil
+    comment.posted_at = Time.now # TODO: it seems strange to have this here, and not in model
+    @ticket.comments << comment
+  end
+=end
+end
diff --git a/help/app/models/ticket.rb b/help/app/models/ticket.rb
index 784d7ef..f38fed2 100644
--- a/help/app/models/ticket.rb
+++ b/help/app/models/ticket.rb
@@ -15,8 +15,8 @@ class Ticket < CouchRest::Model::Base
 =end
 
   #belongs_to :user #from leap_web_users. doesn't necessarily belong to a user though
-  property :created_by, Integer #nil unless user was authenticated for ticket creation, #THIS should not be changed after being set
-  property :regarding_user, Integer # form cannot be submitted if they type in a username w/out corresponding ID. this field can be nil. for authenticated ticket creation by non-admins, should this just automatically be set to be same as created_by?  or maybe we don't use this field unless created_by is nil?
+  property :created_by, String, :protected => true #Integer #nil unless user was authenticated for ticket creation, #THIS should not be changed after being set
+  #property :regarding_user, String#Integer # form cannot be submitted if they type in a username w/out corresponding ID. this field can be nil. for authenticated ticket creation by non-admins, should this just automatically be set to be same as created_by?  or maybe we don't use this field unless created_by is nil?
   #also, both created_by and regarding_user could be nil---say user forgets username, or has general question
   property :title, String
   property :email, String #verify
@@ -29,18 +29,27 @@ class Ticket < CouchRest::Model::Base
 
   timestamps!
   
-  before_validation :set_created_by, :set_code, :on => :create
+  #before_validation :set_created_by, :set_code, :set_email, :on => :create
+  before_validation :set_code, :set_email, :on => :create
+
+
+  #named_scope :open, :conditions => {:is_open => true} #??
 
   design do
     view :by_title
   end
 
+  validates :title, :presence => true
+  #validates :comments, :presence => true #do we want it like this?
+
 
+  # html5 has built-in validation which isn't ideal, as it says 'please enter an email address' for invalid email addresses, which implies an email address is required, and it is not.
   validates :email, :format => /\A([^@\s]+)@((?:[-a-z0-9]+\.)+[a-z]{2,})\Z/, :if => :email #email address is optional
   
-  def set_created_by
-    self.created_by = User.current if User.current
-  end
+  #TODO:
+  #def set_created_by
+  #  self.created_by = User.current if User.current
+  #end
   
   def is_creator_validated?
     !!created_by
@@ -51,6 +60,12 @@ class Ticket < CouchRest::Model::Base
     self.code = SecureRandom.hex(8) if !is_creator_validated?
   end
 
+
+  def set_email
+    self.email = nil if self.email == ""
+    # in controller set to be current users email if that exists
+  end
+
   def close
     self.is_open = false
     save
@@ -61,6 +76,15 @@ class Ticket < CouchRest::Model::Base
     save
   end
 
+  def comments_attributes=(attributes)
+
+    comment = TicketComment.new(attributes.values.first) #TicketComment.new(attributes)
+    #comment.posted_by = User.current.id if User.current #we want to avoid User.current, and current_user won't work here. instead will set in tickets_controller
+    comment.posted_at = Time.now
+    comments << comment
+    
+  end
+
 =begin
   def validate
     if email_address and not email_address.strip =~ RFC822::EmailAddress
diff --git a/help/app/models/ticket_comment.rb b/help/app/models/ticket_comment.rb
index 652133a..49e5c6c 100644
--- a/help/app/models/ticket_comment.rb
+++ b/help/app/models/ticket_comment.rb
@@ -2,13 +2,15 @@ class TicketComment
   include CouchRest::Model::Embeddable 
 
   #belongs_to :ticket #is this best way to do it? will want to access all of a tickets comments, so maybe this isn't the way?
-  property :posted_by, Integer, :protected => true# maybe this should be current_user if that is set, meaning the user is logged in  #String # user??
+  property :posted_by, String#, :protected => true #Integer#this should be current_user if that is set, meaning the user is logged in  #cannot have it be protected and set via comments_attributes=. also, if it is protected and we set in the tickets_controller, it gets unset. TODO---is this okay to have it not protected and manually check it? We do not users to be able to set this.
   # if the current user is not set, then we could just say the comment comes from an 'unauthenticated user', which would be somebody with the secret URL
-  property :posted_at, Time, :protected => true
+  property :posted_at, Time#, :protected => true
   #property :posted_verified, TrueClass, :protected => true #should be true if current_user is set when the comment is created
   property :body, String
 
-  before_validation :set_time#, :set_posted_by
+  # ? timestamps!
+  validates :body, :presence => true
+  #before_validation :set_time#, :set_posted_by
 
   #design do
   #  view :by_posted_at
@@ -18,10 +20,14 @@ class TicketComment
   def is_comment_validated?
     !!posted_by
   end
- 
+
+=begin
+  #TODO. 
+  #this is resetting all comments associated with the ticket:
   def set_time
     self.posted_at = Time.now
   end
+=end
   
 =begin
   def set_posted_by
diff --git a/help/app/views/tickets/_comment.html.haml b/help/app/views/tickets/_comment.html.haml
new file mode 100644
index 0000000..1ba3bd1
--- /dev/null
+++ b/help/app/views/tickets/_comment.html.haml
@@ -0,0 +1,13 @@
+- # style is super ugly but just for now
+%div{:style => "border: solid 1px"}
+  - if User.find(comment.posted_by)
+    Posted by
+    = User.find(comment.posted_by).login 
+  - else
+    Unauthenticated post
+    %p
+  Posted at
+  = comment.posted_at
+  %p
+  = comment.body
+  %p
\ No newline at end of file
diff --git a/help/app/views/tickets/_new_comment.html.haml b/help/app/views/tickets/_new_comment.html.haml
new file mode 100644
index 0000000..a924dfd
--- /dev/null
+++ b/help/app/views/tickets/_new_comment.html.haml
@@ -0,0 +1,3 @@
+= #do we want this partial? not using it now
+= simple_fields_for :comment do |c|
+  = c.input :body, :label => 'Comment', :as => :text
diff --git a/help/app/views/tickets/index.html.haml b/help/app/views/tickets/index.html.haml
new file mode 100644
index 0000000..6db2140
--- /dev/null
+++ b/help/app/views/tickets/index.html.haml
@@ -0,0 +1,10 @@
+%h2 tickets index (just as space)
+Create a 
+= link_to "new ticket", new_ticket_path
+= # below shouldn't be unless logged in
+%h2 Tickets
+= # want to have selection option to see tickets, that are open, closed or all
+- @tickets.each do |ticket|
+  %p
+  = link_to ticket.title, ticket
+= #render(:partial => "ticket", :collection => @tickets)
diff --git a/help/app/views/tickets/new.html.haml b/help/app/views/tickets/new.html.haml
new file mode 100644
index 0000000..537b97f
--- /dev/null
+++ b/help/app/views/tickets/new.html.haml
@@ -0,0 +1,16 @@
+%h2=t :new_ticket
+= simple_form_for(@ticket, :html => {:novalidate => true})  do |f| #turn off html5 validations to test
+  = #@ticket.errors.messages
+  = f.input :title
+  = #f.input :email #if there is no current_user
+  = f.input :email if !current_user  #hmm--might authenticated users want to submit an alternate email?
+
+  = f.simple_fields_for :comments do |c|
+    = c.input :body, :label => 'Comment', :as => :text
+
+  = #render :partial => 'new_comment' #what we were using
+  = # regarding_user if not logged in
+  = # email if not logged in
+  = #f.button :submit, :value => t(:submit), :class => 'btn-primary' 
+  = f.button :submit
+  = link_to t(:cancel), tickets_path, :class => :btn
diff --git a/help/app/views/tickets/show.html.haml b/help/app/views/tickets/show.html.haml
new file mode 100644
index 0000000..a9b994e
--- /dev/null
+++ b/help/app/views/tickets/show.html.haml
@@ -0,0 +1,26 @@
+- if flash[:notice]
+  =flash[:notice]
+- if flash[:alert]
+  =flash[:alert]
+%h2= @ticket.title
+is open?
+= @ticket.is_open
+- if @ticket.code
+  code:
+  = @ticket.code
+- if @ticket.email
+  email:
+  = @ticket.email
+- if User.find(@ticket.created_by)
+  Created by
+  = User.find(@ticket.created_by).login 
+- else
+  Unauthenticated ticket creator
+= render(:partial => "comment", :collection => @ticket.comments)
+
+= simple_form_for (@ticket, :html => {:novalidate => true}) do |f| #turn off html5 validations to test
+  = f.simple_fields_for :comments, TicketComment.new do |c|
+    = c.input :body, :label => 'Comment', :as => :text
+  = #render :partial => 'new_comment'
+  = f.button :submit
+  = link_to t(:cancel), tickets_path, :class => :btn
\ No newline at end of file
diff --git a/help/config/routes.rb b/help/config/routes.rb
index 1daf9a4..5e57e02 100644
--- a/help/config/routes.rb
+++ b/help/config/routes.rb
@@ -1,2 +1,5 @@
 Rails.application.routes.draw do
+
+  resources :tickets, :only => [:new, :create, :index, :show, :update]
+  #resources :ticket, :only => [:show]
 end
diff --git a/help/test/functional/tickets_controller_test.rb b/help/test/functional/tickets_controller_test.rb
new file mode 100644
index 0000000..7a03a86
--- /dev/null
+++ b/help/test/functional/tickets_controller_test.rb
@@ -0,0 +1,63 @@
+require 'test_helper'
+
+class TicketsControllerTest < ActionController::TestCase
+
+  test "should get index" do
+    get :index
+    assert_response :success
+    assert_not_nil assigns(:tickets)
+  end
+
+  test "should get new" do
+    get :new
+    assert_equal Ticket, assigns(:ticket).class
+    assert_response :success
+  end
+
+
+  test "should create unauthenticated ticket" do
+    params = {:title => "ticket test title", :comments_attributes => {"0" => {"body" =>"body of test ticket"}}}
+
+    assert_difference('Ticket.count') do
+      post :create, :ticket => params
+    end
+    
+    assert_response :redirect
+    #assert_equal assigns(:ticket).email, User.current.email
+    #assert_equal User.find(assigns(:ticket).created_by).login, User.current.login
+    assert_nil assigns(:ticket).created_by
+
+    assert_equal assigns(:ticket).comments.count, 1
+  end
+
+
+  test "should create authenticated ticket" do
+
+    params = {:title => "ticket test title", :comments_attributes => {"0" => {"body" =>"body of test ticket"}}}
+
+    #todo: should redo this and actually authorize
+    user = User.last
+    session[:user_id] = user.id
+
+    assert_difference('Ticket.count') do
+      post :create, :ticket => params
+    end
+
+    assert_response :redirect
+    assert_equal assigns(:ticket).created_by, user.id
+    assert_equal assigns(:ticket).email, user.email
+
+    assert_equal assigns(:ticket).comments.count, 1
+  end
+
+  test "add comment to ticket" do
+
+    t = Ticket.last
+    comment_count = t.comments.count
+    put :update, :id => t.id, :ticket => {:comments_attributes => {"0" => {"body" =>"NEWER comment"}} }
+    assert_equal(comment_count + 1, assigns(:ticket).comments.count)
+    #assert_difference block isn't working
+
+  end
+
+end
diff --git a/help/test/unit/ticket_comment_test.rb b/help/test/unit/ticket_comment_test.rb
index 883720f..1fe1fe2 100644
--- a/help/test/unit/ticket_comment_test.rb
+++ b/help/test/unit/ticket_comment_test.rb
@@ -16,8 +16,8 @@ class TicketCommentTest < ActiveSupport::TestCase
 
     comment2 = TicketComment.new :body => "help my email is broken!"
     assert comment2.valid?
-    assert_not_nil comment2.posted_at
-    assert_nil comment2.posted_by #if not logged in
+    #assert_not_nil comment2.posted_at #?
+    #assert_nil comment2.posted_by #if not logged in #TODO
 
     #comment.ticket = testticket #Ticket.find_by_title("testing")
     #assert_equal testticket.title, comment.ticket.title
@@ -49,9 +49,10 @@ class TicketCommentTest < ActiveSupport::TestCase
     testticket.comments << comment2 #this should validate comment2
     testticket.valid?
     assert_equal testticket.comments.count, 2
-    assert_not_nil comment.posted_at
-    assert_not_nil testticket.comments.last.posted_at
-    assert testticket.comments.first.posted_at < testticket.comments.last.posted_at
+    # where should posted_at be set?
+    #assert_not_nil comment.posted_at
+    #assert_not_nil testticket.comments.last.posted_at
+    #assert testticket.comments.first.posted_at < testticket.comments.last.posted_at
   end
 
 end
diff --git a/help/test/unit/ticket_test.rb b/help/test/unit/ticket_test.rb
index c3a4759..6b63a23 100644
--- a/help/test/unit/ticket_test.rb
+++ b/help/test/unit/ticket_test.rb
@@ -41,18 +41,20 @@ class TicketTest < ActiveSupport::TestCase
     assert @sample.is_creator_validated?
   end
   
+=begin
+# TODO: do once have current_user stuff in order
   test "code if & only if not creator-validated" do
+    User.current_test = nil
     t1 = Ticket.create :title => 'test title'
     assert_not_nil t1.code
     assert_nil t1.created_by
 
-    User.current = 4
+    User.current_test = 4
     t2 = Ticket.create :title => 'test title'
     assert_nil t2.code
     assert_not_nil t2.created_by
-    
-
   end
+=end
 
 end
 
-- 
cgit v1.2.3