Only admins can manage join codes

2025-11-12 11:30:29 +01:00
parent dba3b2d65d
commit e67cdd986f
2 changed files with 15 additions and 0 deletions
@@ -23,4 +23,18 @@ class Account::JoinCodesControllerTest < ActionDispatch::IntegrationTest
    assert_equal 5, Account::JoinCode.sole.usage_limit
    assert_redirected_to account_join_code_path
  end
+
+  test "update requires admin" do
+    logout_and_sign_in_as :david
+
+    put account_join_code_path, params: { account_join_code: { usage_limit: 5 } }
+    assert_response :forbidden
+  end
+
+  test "destroy requires admin" do
+    logout_and_sign_in_as :david
+
+    delete account_join_code_path
+    assert_response :forbidden
+  end
 end