Merge pull request #334 from basecamp/user-admins

Add admin role and animate admin toggle

test/controllers/accounts/users_controller_test.rb

@@ -0,0 +1,41 @@
+require "test_helper"
+
+class Accounts::UsersControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    sign_in_as :kevin
+  end
+
+  test "update" do
+    assert_not users(:david).admin?
+
+    put account_user_url(users(:david)), params: { user: { role: "admin" } }
+
+    assert_redirected_to account_users_path
+    assert users(:david).reload.admin?
+  end
+
+  test "can't promote to special roles" do
+    assert_no_changes -> { users(:david).reload.role } do
+      put account_user_url(users(:david)), params: { user: { role: "system" } }
+    end
+  end
+
+  test "destroy" do
+    assert_difference -> { User.active.count }, -1 do
+      delete account_user_url(users(:david))
+    end
+
+    assert_redirected_to account_users_path
+    assert_nil User.active.find_by(id: users(:david).id)
+  end
+
+  test "non-admins cannot perform actions" do
+    sign_in_as :jz
+
+    put account_user_url(users(:david)), params: { user: { role: "admin" } }
+    assert_response :forbidden
+
+    delete account_user_url(users(:david))
+    assert_response :forbidden
+  end
+end

test/fixtures/users.yml

@@ -19,4 +19,4 @@ kevin:
   name: Kevin
   email_address: kevin@37signals.com
   password_digest: <%= digest %>
-  role: member
+  role: admin

test/models/user/role_test.rb

@@ -0,0 +1,10 @@
+require "test_helper"
+
+class User::RoleTest < ActiveSupport::TestCase
+  test "can administer others?" do
+    assert users(:kevin).can_administer?(users(:jz))
+
+    assert_not users(:kevin).can_administer?(users(:kevin))
+    assert_not users(:jz).can_administer?(users(:kevin))
+  end
+end

test/test_helpers/session_test_helper.rb

@@ -4,6 +4,7 @@ module SessionTestHelper
   end
 
   def sign_in_as(user)
+    cookies[:session_token] = nil
     user = users(user) unless user.is_a? User
     post session_url, params: { email_address: user.email_address, password: "secret123456" }
     assert cookies[:session_token].present?