diff --git a/app/controllers/admin/users_controller.rb b/app/controllers/admin/users_controller.rb index 21b1ffb5..5f562236 100644 --- a/app/controllers/admin/users_controller.rb +++ b/app/controllers/admin/users_controller.rb @@ -32,9 +32,12 @@ module Admin # for more information def authenticate_admin - super # apply the generic rules for authentication in the admin panel... - - # ...plus this one + unless user_signed_in? + flash[:alert] = "You must be logged in to access this page." + redirect_to new_user_session_path + return + end + unless current_user.admin? flash[:alert] = "You do not have the privilegies to access this page." redirect_to root_path diff --git a/app/models/user.rb b/app/models/user.rb index f1ea4246..71e90fa7 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -6,7 +6,7 @@ class User < ApplicationRecord enum role: [:user, :moderator, :admin] after_initialize :set_default_role, if: :new_record? - validates :full_name, presence: true + validates :full_name, presence: true, length: { in: 2..32 } def set_default_role self.role ||= :user diff --git a/spec/factories/users.rb b/spec/factories/users.rb index aca14d20..f1dde099 100644 --- a/spec/factories/users.rb +++ b/spec/factories/users.rb @@ -5,4 +5,20 @@ FactoryBot.define do full_name { "First Last" } password { "password" } end + + factory :moderator, class: User do + sequence(:email) { |n| "mod#{n}@example.com" } + + full_name { "First Last" } + password { "password" } + role { "moderator" } + end + + factory :admin, class: User do + sequence(:email) { |n| "admin#{n}@example.com" } + + full_name { "First Last" } + password { "password" } + role { "admin" } + end end diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb index 8c6b3403..ce4b7597 100644 --- a/spec/models/user_spec.rb +++ b/spec/models/user_spec.rb @@ -2,10 +2,38 @@ require 'rails_helper' RSpec.describe User, type: :model do - let(:user) { User.new(email: 'example@example.com', password: 'password') } + let(:user) { FactoryBot.build(:user) } + let(:nilname_user) { FactoryBot.build(:user, full_name: nil) } + let(:emptyname_user) { FactoryBot.build(:user, full_name: "") } + let(:short_user) { FactoryBot.build(:user, full_name: "a") } + let(:long_user) { FactoryBot.build(:user, full_name: "a" * 33) } it 'creates a user with role "user" by default' do expect(user.role).to eq('user') end + it 'has a non-nil and non-empty full name' do + expect(nilname_user.valid?).to be_falsy + expect(emptyname_user.valid?).to be_falsy + end + + it 'has a full name between 2 and 32 characters' do + expect(short_user.valid?).to be_falsy + expect(long_user.valid?).to be_falsy + + + short_user.full_name = "a" * 2; + long_user.full_name = "a" * 32; + + expect(short_user.valid?).to be_truthy + expect(long_user.valid?).to be_truthy + end + + it 'has an email that must contain a @' do + invalid_email_user = User.new(full_name: "Valid name", email: "invalid email", password: "password") + + expect(invalid_email_user.valid?).to be_falsy + expect(user.valid?).to be_truthy + end + end diff --git a/spec/rails_helper.rb b/spec/rails_helper.rb index d73d80bd..f80b2481 100644 --- a/spec/rails_helper.rb +++ b/spec/rails_helper.rb @@ -20,7 +20,7 @@ require 'rspec/rails' # directory. Alternatively, in the individual `*_spec.rb` files, manually # require only the support files necessary. # -# Dir[Rails.root.join('spec', 'support', '**', '*.rb')].each { |f| require f } +Dir[Rails.root.join('spec', 'support', '**', '*.rb')].each { |f| require f } # Checks for pending migrations and applies them before tests are run. # If you are not using ActiveRecord, you can remove these lines. diff --git a/spec/requests/admin_panel_spec.rb b/spec/requests/admin_panel_spec.rb new file mode 100644 index 00000000..6c913fc4 --- /dev/null +++ b/spec/requests/admin_panel_spec.rb @@ -0,0 +1,47 @@ +require 'rails_helper' + +RSpec.describe 'Requests to the admin panel', type: :request do + let(:user) { FactoryBot.create(:user) } + let(:moderator) { FactoryBot.create(:moderator) } + let(:admin) { FactoryBot.create(:admin) } + + before(:each) do + user.confirm + moderator.confirm + admin.confirm + end + + it 'requires a logged-in admin to administrate Users' do + get admin_users_path + expect(response).to redirect_to(new_user_session_path) + + sign_in user + get admin_users_path + expect(response).to redirect_to(root_path) + + sign_in moderator + get admin_users_path + expect(response).to redirect_to(root_path) + + sign_in admin + get admin_users_path + expect(response).to have_http_status(:success) + end + + it 'requires at least a logged-in moderator to administrate Boards' do + get admin_boards_path + expect(response).to redirect_to(new_user_session_path) + + sign_in user + get admin_boards_path + expect(response).to redirect_to(root_path) + + sign_in moderator + get admin_boards_path + expect(response).to have_http_status(:success) + + sign_in admin + get admin_boards_path + expect(response).to have_http_status(:success) + end +end \ No newline at end of file