implemented complete restful user management interface including functional tests. this enables basic user operation. note that only admins are allowed to create, edit, destroy other users

17 files changed, 292 insertions, 26 deletions

diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index 19f6b2d..b15f83b 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -3,29 +3,57 @@ class UsersController < ApplicationController
   # Private
   
   before_filter :login_required
+  before_filter :verify_admin_status, :except => [:index, :show]
   
   layout 'admin'
   
   def index
-    @users = User.all
+    @users = User.all(:order => "login ASC")
   end
 
   def new
+    @user = User.new( params[:user] )
   end
 
   def create
+    @user = User.new params[:user]
+    
+    if @user.save
+      redirect_to user_path(@user)
+    else
+      render :new
+    end
   end
 
   def edit
+    @user = User.find(params[:id])
   end
 
   def update
+    @user = User.find(params[:id])
+    
+    if @user.update_attributes(params[:user])
+      redirect_to user_path(@user)
+    else
+      render :edit
+    end
   end
 
   def show
+    @user = User.find(params[:id])
   end
 
   def destroy
+    user = User.find(params[:id])
+    user.destroy if user
+    redirect_to users_path
   end
 
+  private
+    def verify_admin_status
+      unless current_user.admin
+        flash[:notice] = "Sorry, you need to be an admin for this action"
+        redirect_to users_path
+      end
+    end
 end
diff --git a/app/helpers/users_helper.rb b/app/helpers/users_helper.rb
index 2310a24..ff03138 100644
--- a/app/helpers/users_helper.rb
+++ b/app/helpers/users_helper.rb
@@ -1,2 +1,9 @@
 module UsersHelper
+  def user_list_by_admin_status
+    if current_user && current_user.admin
+      render :partial => 'admin_user_item', :collection => @users
+    else
+      render :partial => 'user_item', :collection => @users
+    end
+  end
 end
diff --git a/app/models/user.rb b/app/models/user.rb
index 26ebf45..035a145 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -21,7 +21,7 @@ class User < ActiveRecord::Base
   validates_format_of       :email, :with => Authentication.email_regex,
                             :message => Authentication.bad_email_message
 
-  attr_accessible :login, :email, :password, :password_confirmation
+  attr_accessible :login, :email, :password, :password_confirmation, :admin
 
   # Authenticates a user by their login name and unencrypted password. Returns the user or nil.
   def self.authenticate(login, password)
diff --git a/app/views/users/_admin_user_item.html.erb b/app/views/users/_admin_user_item.html.erb
new file mode 100644
index 0000000..d882dc4
--- /dev/null
+++ b/app/views/users/_admin_user_item.html.erb
@@ -0,0 +1,12 @@
+<tr>
+  <td><%= admin_user_item.login %></td>
+  <td>
+    <%= link_to "Show", user_path(admin_user_item) %>
+    <%= link_to(
+          "Destroy", 
+          user_path(admin_user_item), 
+          :method => "delete",
+          :confirm => "Are you sure to delete user: #{admin_user_item.login}?"
+        ) %>
+  </td>
+</tr>
\ No newline at end of file
diff --git a/app/views/users/_user_item.html.erb b/app/views/users/_user_item.html.erb
new file mode 100644
index 0000000..c3389ba
--- /dev/null
+++ b/app/views/users/_user_item.html.erb
@@ -0,0 +1,4 @@
+<tr>
+  <td><%= user_item.login %></td>
+  <td></td>
+</tr>
\ No newline at end of file
diff --git a/app/views/users/create.html.erb b/app/views/users/create.html.erb
deleted file mode 100644
index 48ea02e..0000000
--- a/app/views/users/create.html.erb
+++ /dev/null
@@ -1,2 +0,0 @@
-<h1>Users#create</h1>
-<p>Find me in app/views/users/create.html.erb</p>
diff --git a/app/views/users/destroy.html.erb b/app/views/users/destroy.html.erb
deleted file mode 100644
index de4bd26..0000000
--- a/app/views/users/destroy.html.erb
+++ /dev/null
@@ -1,2 +0,0 @@
-<h1>Users#destroy</h1>
-<p>Find me in app/views/users/destroy.html.erb</p>
diff --git a/app/views/users/edit.html.erb b/app/views/users/edit.html.erb
index 1881fbd..5b73242 100644
--- a/app/views/users/edit.html.erb
+++ b/app/views/users/edit.html.erb
@@ -1,2 +1,30 @@
-<h1>Users#edit</h1>
-<p>Find me in app/views/users/edit.html.erb</p>
+<h1>Edit existing user</h1>
+
+<% form_for @user do |f| %>
+<table id="new_node">
+  <tr>
+    <td class="description">Login</td>
+    <td><%= f.text_field :login %></td>
+  </tr>
+  <tr>
+    <td class="description">E-Mail</td>
+    <td><%= f.text_field :email %></td>
+  </tr>
+  <tr>
+    <td class="description">Password</td>
+    <td><%= f.text_field :password %></td>
+  </tr>
+  <tr>
+    <td class="description">Confirm</td>
+    <td><%= f.text_field :password_confirmation %></td>
+  </tr>
+  <tr>
+    <td class="description">Admin?</td>
+    <td><%= f.check_box :admin %></td>
+  </tr>
+  <tr>
+    <td class="description"></td>
+    <td class="right"><%= f.submit "Create" %></td>
+  </tr>
+</table>
+<% end %>
\ No newline at end of file
diff --git a/app/views/users/index.html.erb b/app/views/users/index.html.erb
index f0b5b28..8526d84 100644
--- a/app/views/users/index.html.erb
+++ b/app/views/users/index.html.erb
@@ -1,12 +1,13 @@
 <h1>Users</h1>
 
-<table>
+<table id="user_list">
   <tr>
     <td>login</td>
   </tr>
-  <% @users.each do |user| %>
-  <tr>
-    <td><%= user.login %></td>
-  </tr>
-  <% end %>
-</table>
\ No newline at end of file
+  <%= user_list_by_admin_status %>
+</table>
+
+
+<% content_for :subnavigation do %>
+  <%= link_to "create", new_user_path %>
+<% end %>
\ No newline at end of file
diff --git a/app/views/users/new.html.erb b/app/views/users/new.html.erb
index c21a1ad..0629641 100644
--- a/app/views/users/new.html.erb
+++ b/app/views/users/new.html.erb
@@ -1,2 +1,30 @@
-<h1>Users#new</h1>
-<p>Find me in app/views/users/new.html.erb</p>
+<h1>Create new user</h1>
+
+<% form_for @user do |f| %>
+<table id="new_node">
+  <tr>
+    <td class="description">Login</td>
+    <td><%= f.text_field :login %></td>
+  </tr>
+  <tr>
+    <td class="description">E-Mail</td>
+    <td><%= f.text_field :email %></td>
+  </tr>
+  <tr>
+    <td class="description">Password</td>
+    <td><%= f.text_field :password %></td>
+  </tr>
+  <tr>
+    <td class="description">Confirm</td>
+    <td><%= f.text_field :password_confirmation %></td>
+  </tr>
+  <tr>
+    <td class="description">Admin?</td>
+    <td><%= f.check_box :admin %></td>
+  </tr>
+  <tr>
+    <td class="description"></td>
+    <td class="right"><%= f.submit "Create" %></td>
+  </tr>
+</table>
+<% end %>
\ No newline at end of file
diff --git a/app/views/users/show.html.erb b/app/views/users/show.html.erb
index e5fa3ad..3055d24 100644
--- a/app/views/users/show.html.erb
+++ b/app/views/users/show.html.erb
@@ -1,2 +1,20 @@
-<h1>Users#show</h1>
-<p>Find me in app/views/users/show.html.erb</p>
+<h1>User: <%= @user.login %></h1>
+
+<table id="new_node">
+  <tr>
+    <td class="description">Login</td>
+    <td><%= @user.login %></td>
+  </tr>
+  <tr>
+    <td class="description">E-Mail</td>
+    <td><%= @user.email %></td>
+  </tr>
+  <tr>
+    <td class="description">Admin?</td>
+    <td><%= @user.admin ? "yes" : "no" %></td>
+  </tr>
+</table>
+
+<% content_for :subnavigation do %>
+  <%= link_to 'Edit', edit_user_path(@user) %>
+<% end %>
diff --git a/app/views/users/update.html.erb b/app/views/users/update.html.erb
deleted file mode 100644
index cabbde1..0000000
--- a/app/views/users/update.html.erb
+++ /dev/null
@@ -1,2 +0,0 @@
-<h1>Users#update</h1>
-<p>Find me in app/views/users/update.html.erb</p>
diff --git a/public/stylesheets/admin.css b/public/stylesheets/admin.css
index d74632b..1822ed1 100644
--- a/public/stylesheets/admin.css
+++ b/public/stylesheets/admin.css
@@ -439,3 +439,7 @@ input#move_to_search_term, input#node_staged_slug {
   width: 680px;
 }
 
+table#user_list td {
+  padding-right: 30px;
+}
+
diff --git a/test/fixtures/users.yml b/test/fixtures/users.yml
index 5b32afc..a62b350 100644
--- a/test/fixtures/users.yml
+++ b/test/fixtures/users.yml
@@ -13,4 +13,5 @@ aaron:
   salt:                      5be6f9cdd04fd7ab3c91cd32a5334ba2339b8005
   crypted_password:          740a48caf7dd5ff11318d812d57c0a0928cfbc12 # 'monkey'
   created_at:                <%= 1.days.ago.to_s :db %>
+  admin:                     true
 
diff --git a/test/functional/nodes_controller_test.rb b/test/functional/nodes_controller_test.rb
index 3293f42..3dae9db 100644
--- a/test/functional/nodes_controller_test.rb
+++ b/test/functional/nodes_controller_test.rb
@@ -2,8 +2,6 @@ require 'test_helper'
 
 class NodesControllerTest < ActionController::TestCase
 
-  include AuthenticatedTestHelper
-
   def test_get_index
     Node.root.descendants.delete_all
     test_node = Node.create :slug => "foo"
diff --git a/test/functional/users_controller_test.rb b/test/functional/users_controller_test.rb
index c3db123..a8333fe 100644
--- a/test/functional/users_controller_test.rb
+++ b/test/functional/users_controller_test.rb
@@ -1,8 +1,148 @@
 require 'test_helper'
 
 class UsersControllerTest < ActionController::TestCase
-  # Replace this with your real tests.
-  test "the truth" do
-    assert true
+  
+  test "get index as regular user renders stripped partial" do
+    login_as :quentin
+    get :index
+    assert_response :success
+    assert_select "a", { :count => 0, :text => "Destroy" }
   end
+  
+  test "get index as admin user renders admin partial" do
+    login_as :aaron
+    get :index
+    assert_response :success
+    assert_select "a", "Destroy"
+    assert_select "a", "Show", "Edit Link is missing"
+  end
+  
+  test "get new when logged in as admin" do
+    login_as :aaron
+    get :new
+    assert_response :success
+  end
+  
+  test "get new without being logged in as admin redirects back to index" do
+    login_as :quentin
+    get :new
+    assert_response :redirect
+    assert_redirected_to users_path
+    assert_equal(
+      "Sorry, you need to be an admin for this action", 
+      @response.flash[:notice]
+    )
+  end
+  
+  test "creating new users being logged in as admin" do
+    login_as :aaron
+    assert_difference "User.count", +1 do
+      post :create, :user => {
+        :login                  => "peter",
+        :email                  => "foo@bar.com",
+        :password               => "xxxzzz",
+        :password_confirmation  => "xxxzzz"
+      }
+    end
+    
+    assert_redirected_to user_path(User.last)
+    assert !User.last.admin
+  end
+  
+  test "creating new admin users being logged in as admin" do
+    login_as :aaron
+    assert_difference "User.count", +1 do
+      post :create, :user => {
+        :login                  => "peter",
+        :email                  => "foo@bar.com",
+        :password               => "xxxzzz",
+        :password_confirmation  => "xxxzzz",
+        :admin                  => true
+      }
+    end
+    
+    assert_redirected_to user_path(User.last)
+    assert User.last.admin
+  end
+  
+  test "creating new users not being logged as regular user wont work" do
+    login_as :quentin
+    assert_no_difference "User.count" do
+      post :create, :user => {
+        :login                  => "peter",
+        :email                  => "foo@bar.com",
+        :password               => "xxxzzz",
+        :password_confirmation  => "xxxzzz"
+      }
+    end
+    
+    assert_redirected_to users_path
+    assert_equal(
+      "Sorry, you need to be an admin for this action", 
+      @response.flash[:notice]
+    )
+  end
+  
+  test "get edit of another user being logged in as regular user wont work" do
+    login_as :quentin
+    get :edit, :id => User.find_by_login("aaron").id
+    assert_redirected_to users_path
+    assert_equal(
+      "Sorry, you need to be an admin for this action", 
+      @response.flash[:notice]
+    )
+  end
+  
+  test "get edit of another user being logged in as admin user" do
+    login_as :aaron
+    get :edit, :id => User.find_by_login("quentin").id
+    assert_response :success
+  end
+  
+  test "updating an user when being logged in as regular user wont work" do
+    user = User.find_by_login("aaron")
+    login_as :quentin
+    put :update, :id => user.id, :user => {:login => "random"}
+    assert_redirected_to users_path
+    assert_equal(
+      "Sorry, you need to be an admin for this action", 
+      @response.flash[:notice]
+    )
+  end
+  
+  test "updating an user when being login in as admin user" do
+    user = User.find_by_login("quentin")
+    login_as :aaron
+    put :update, :id => user.id, :user => {:login => "random"}
+    assert_redirected_to user_path(user)
+    assert_equal "random", user.reload.login
+  end
+  
+  test "showing a user" do
+    login_as :quentin
+    get :show, :id => User.find_by_login("aaron").id
+    assert_response :success
+  end
+  
+  test "destroying an user being logged in as regular user wont work" do
+    login_as :quentin
+    assert_no_difference "User.count" do
+      delete :destroy, :id => User.find_by_login("aaron").id
+    end
+    assert_redirected_to users_path
+    assert_equal(
+      "Sorry, you need to be an admin for this action", 
+      @response.flash[:notice]
+    )
+  end
+  
+  test "destroying an user being logged in as admin user" do
+    login_as :aaron
+    assert_difference "User.count", -1 do
+      delete :destroy, :id => User.find_by_login("quentin").id
+    end
+    assert_redirected_to users_path
+  end
+  
+  
 end
diff --git a/test/test_helper.rb b/test/test_helper.rb
index b9fe251..21d4604 100644
--- a/test/test_helper.rb
+++ b/test/test_helper.rb
@@ -3,6 +3,9 @@ require File.expand_path(File.dirname(__FILE__) + "/../config/environment")
 require 'test_help'
 
 class ActiveSupport::TestCase
+  
+  include AuthenticatedTestHelper
+  
   # Transactional fixtures accelerate your tests by wrapping each test method
   # in a transaction that's rolled back on completion.  This ensures that the
   # test database remains unchanged so your fixtures don't have to be reloaded