summaryrefslogtreecommitdiff
path: root/test/functional/users_controller_test.rb
blob: 70f483eec7a38d773a161342a58542044c1f4b3e (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
require 'test_helper'

class UsersControllerTest < ActionController::TestCase

  test "should get new" do
    get :new
    assert_equal User, assigns(:user).class
    assert_response :success
  end

  test "new should redirect logged in users" do
    login
    get :new
    assert_response :redirect
    assert_redirected_to home_path
  end

  test "failed show without login" do
    user = find_record :user
    get :show, :id => user.id
    assert_response :redirect
    assert_redirected_to login_path
  end

  test "user can see user" do
    user = find_record :user,
      :most_recent_tickets => []
    login user
    get :show, :id => user.id
    assert_response :success
  end

  test "admin can see other user" do
    user = find_record :user,
      :most_recent_tickets => []
    login :is_admin? => true
    get :show, :id => user.id
    assert_response :success

  end

  test "user cannot see other user" do
    user = find_record :user,
      :most_recent_tickets => []
    login
    get :show, :id => user.id
    assert_response :redirect
    assert_access_denied
  end

  test "may not show non-existing user without auth" do
    nonid = 'thisisnotanexistinguserid'

    get :show, :id => nonid
    assert_login_required
  end

  test "may not show non-existing user without admin" do
    nonid = 'thisisnotanexistinguserid'
    login

    get :show, :id => nonid
    assert_access_denied
  end

  test "redirect admin to user list for non-existing user" do
    nonid = 'thisisnotanexistinguserid'
    login :is_admin? => true
    get :show, :id => nonid
    assert_response :redirect
    assert_equal({:alert => "No such user."}, flash.to_hash)
    assert_redirected_to users_path
  end

  test "should get edit view" do
    user = find_record :user

    login user
    get :edit, :id => user.id

    assert_equal user, assigns[:user]
  end

  test "admin can destroy user" do
    user = find_record :user

    # we destroy the user record and the associated data...
    user.expects(:destroy)
    Identity.expects(:disable_all_for).with(user)
    Ticket.expects(:destroy_all_from).with(user)

    login :is_admin? => true
    delete :destroy, :id => user.id

    assert_response :redirect
    assert_redirected_to users_path
  end

  test "user can cancel account" do
    user = find_record :user

    # we destroy the user record and the associated data...
    user.expects(:destroy)
    Identity.expects(:disable_all_for).with(user)
    Ticket.expects(:destroy_all_from).with(user)

    login user
    expect_logout
    delete :destroy, :id => @current_user.id

    assert_response :redirect
    assert_redirected_to bye_url
  end

  test "non-admin can't destroy user" do
    user = find_record :user

    login
    delete :destroy, :id => user.id

    assert_access_denied
  end

  test "admin can list users" do
    login :is_admin? => true
    get :index

    assert_response :success
    assert assigns(:users)
  end

  test "non-admin can't list users" do
    login
    get :index

    assert_access_denied
  end

  test "admin can search users" do
    login :is_admin? => true
    get :index, :query => "a"

    assert_response :success
    assert assigns(:users)
  end

  test "user cannot enable own account" do
    user = find_record :user
    login
    post :enable, :id => user.id
    assert_access_denied
  end

  test "admin can deactivate user" do
    user = find_record :user
    assert user.enabled?
    user.expects(:save).returns(true)

    login :is_admin? => true

    @request.env['HTTP_REFERER'] = 'http://test.com/sessions/new'
    post :deactivate, :id => user.id
    assert !assigns(:user).enabled?
  end

  test "new redirects if registration is closed" do
    with_config(allow_registration: false) do
      get :new
      assert_response :redirect
      assert_redirected_to home_path
    end
  end
end