From abd7ee1fc2ecc15b50944db30c59bedc26ec41b6 Mon Sep 17 00:00:00 2001 From: erdgeist Date: Sat, 1 Aug 2026 04:14:00 +0200 Subject: Let Redaktion grant and revoke its own role Any holder may add or remove another account, witnessed as redaktion_grant/revoke so the vouching is legible. Not behind elevation: onboarding must not wait for a keyholder, and a compromised Redaktion account can already publish. --- test/controllers/users_controller_test.rb | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) (limited to 'test/controllers/users_controller_test.rb') diff --git a/test/controllers/users_controller_test.rb b/test/controllers/users_controller_test.rb index b6f0970d..d7d8b9a6 100644 --- a/test/controllers/users_controller_test.rb +++ b/test/controllers/users_controller_test.rb @@ -6,7 +6,7 @@ class UsersControllerTest < ActionController::TestCase login_as :quentin get :index assert_redirected_to admin_path - assert_equal I18n.t("flash.common.admin_required"), flash[:error] + assert_equal I18n.t("flash.common.redaktion_required"), flash[:error] end test "get index as admin shows every group with per-row actions" do @@ -53,7 +53,7 @@ class UsersControllerTest < ActionController::TestCase assert !User.last.admin end - test "creating new admin users being logged in as admin" do + test "creating a Redaktion account" do login_as :aaron elevate_session! assert_difference "User.count", +1 do @@ -63,13 +63,14 @@ class UsersControllerTest < ActionController::TestCase :email => "foo@bar.com", :password => "xxxzzz", :password_confirmation => "xxxzzz", - :roles => ["admin", "redaktion"] + :roles => ["redaktion"] } } end assert_redirected_to user_path(User.last) - assert User.last.admin + assert User.last.redaktion? + assert_not User.last.is_admin? end test "creating new users not being logged as regular user wont work" do @@ -196,6 +197,7 @@ class UsersControllerTest < ActionController::TestCase login_as :aaron elevate_session! user = users(:quentin) + user.update_column(:otp_secret, ROTP::Base32.random) put :update, params: { :id => user.id, :user => {:roles => ["admin", "redaktion"]} } assert_equal true, user.reload.is_admin? @@ -261,4 +263,14 @@ class UsersControllerTest < ActionController::TestCase assert_not user.reload.is_admin? end + + test "an account without a second factor cannot be promoted to admin" do + login_as :aaron + elevate_session! + user = users(:quentin) + + put :update, params: { :id => user.id, :user => { :roles => ["admin"] } } + + assert_not user.reload.is_admin? + end end -- cgit v1.3