feature: Allows directors to reset passwords through admin portal (#524)

Co-authored-by: JeremyRudman <[email protected]>
Co-authored-by: Peter Kos <[email protected]>

Author: 3 people

app/controllers/manage/users_controller.rb

@@ -1,6 +1,6 @@
 class Manage::UsersController < Manage::ApplicationController
   before_action :require_director
-  before_action :find_user, only: [:show, :edit, :update, :destroy]
+  before_action :find_user, only: [:show, :edit, :update, :reset_password, :destroy]
 
   respond_to :html, :json
 
@@ -16,6 +16,14 @@ def staff_datatable
     render json: StaffDatatable.new(params, view_context: view_context)
   end
 
+  def reset_password
+    new_password = Devise.friendly_token(50)
+    @user.reset_password(new_password, new_password)
+    @user.send_reset_password_instructions
+    flash[:notice] = t(:reset_password_success, scope: 'pages.manage.users.edit', full_name: @user.full_name)
+    respond_with(:manage, @user, location: manage_users_path)
+  end
+
   def show
     respond_with(:manage, @user)
   end

app/views/manage/users/edit.html.haml

@@ -2,6 +2,7 @@
 
   .btn-group
     = link_to t(:cancel, scope: "pages.manage.users.edit"), manage_user_path(@user), class: 'btn btn-sm btn-outline-secondary'
+    = link_to t(:reset_password, scope: "pages.manage.users.edit"), reset_password_manage_user_path(@user), method: :patch, data: { confirm: t(:confirm_reset_password, scope: "pages.manage.users.edit", full_name: @user.full_name, first_name: @user.first_name)}, class: 'btn btn-sm btn-outline-secondary'
     = link_to t(:delete, scope: "pages.manage.users.edit"), manage_user_path(@user), method: :delete, data: { confirm: "Are you sure? #{@user.email} will be permanently deleted. This action is irreversible." }, class: 'btn btn-sm btn-outline-secondary'
 
 = render 'form'

config/locales/en.yml

@@ -206,6 +206,9 @@ en:
           subtitle: Edit User
           cancel: Cancel
           delete: Delete
+          reset_password: Reset Password
+          confirm_reset_password: "Are you sure? %{full_name}'s password will be reset and %{first_name} will receive a recovery email."
+          reset_password_success: "Successfully reset password and sent recovery instructions to %{full_name}."
           form:
             active: Active
             inactive: Inactive

test/controllers/manage/users_controller_test.rb

@@ -1,6 +1,8 @@
 require 'test_helper'
 
 class Manage::UsersControllerTest < ActionController::TestCase
+  include ActiveJob::TestHelper
+
   setup do
     @user = create(:user)
   end
@@ -12,6 +14,16 @@ class Manage::UsersControllerTest < ActionController::TestCase
       assert_redirected_to new_user_session_path
     end
 
+    should "not allow access to user_datatable" do
+      get :user_datatable
+      assert_redirected_to new_user_session_path
+    end
+
+    should "not allow access to staff_datatable" do
+      get :staff_datatable
+      assert_redirected_to new_user_session_path
+    end
+
     should "not allow access to manage_users user datatables api" do
       post :user_datatable, format: :json, params: { "columns[0][data]" => "" }
       assert_response 401
@@ -59,6 +71,16 @@ class Manage::UsersControllerTest < ActionController::TestCase
       assert_redirected_to root_path
     end
 
+    should "not allow access to user_datatable" do
+      get :user_datatable
+      assert_redirected_to root_path
+    end
+
+    should "not allow access to staff_datatable" do
+      get :staff_datatable
+      assert_redirected_to root_path
+    end
+
     should "not allow access to manage_users users datatables api" do
       post :user_datatable, format: :json, params: { "columns[0][data]" => "" }
       assert_response :redirect
@@ -108,6 +130,16 @@ class Manage::UsersControllerTest < ActionController::TestCase
       assert_redirected_to manage_checkins_path
     end
 
+    should "not allow access to user_datatable" do
+      get :user_datatable
+      assert_redirected_to manage_checkins_path
+    end
+
+    should "not allow access to staff_datatable" do
+      get :staff_datatable
+      assert_redirected_to manage_checkins_path
+    end
+
     should "not allow access to manage_users users datatables api" do
       post :user_datatable, format: :json, params: { "columns[0][data]" => "" }
       assert_redirected_to manage_checkins_path
@@ -154,6 +186,16 @@ class Manage::UsersControllerTest < ActionController::TestCase
       assert_redirected_to manage_root_path
     end
 
+    should "not allow access to user_datatable" do
+      get :user_datatable
+      assert_redirected_to manage_root_path
+    end
+
+    should "not allow access to staff_datatable" do
+      get :staff_datatable
+      assert_redirected_to manage_root_path
+    end
+
     should "not allow access to manage_users users datatables api" do
       post :user_datatable, format: :json, params: { "columns[0][data]" => "" }
       assert_redirected_to manage_root_path
@@ -200,55 +242,51 @@ class Manage::UsersControllerTest < ActionController::TestCase
       assert_response :success
     end
 
-    # TODO: Tests appear to be stalling Travis CI
-
-    # should "create a new admin" do
-    #   post :create, params: { user: { email: "[email protected]", role: 'admin' } }
-    #   assert_response :redirect
-    #   assert_redirected_to manage_users_path
-    #   assert assigns(:user).admin?, "new user should be an admin"
-    # end
-
-    # should "create a new limited access admin" do
-    #   post :create, params: { user: { email: "[email protected]", role: 'admin_limited_access' } }
-    #   assert_response :redirect
-    #   assert_redirected_to manage_users_path
-    #   assert !assigns(:user).admin?, "new user should not be an admin"
-    #   assert assigns(:user).admin_limited_access?, "new user should be a limited access admin"
-    # end
-
-    # should "not create an admin with duplicate emails" do
-    #   create(:user, email: "[email protected]")
-    #   assert_difference('User.count', 0) do
-    #     post :create, params: { user: { email: "[email protected]", role: 'admin' } }
-    #   end
-    # end
-
-    # should "allow access to manage_admins#new" do
-    #   get :new, params: { id: @user }
-    #   assert_response :success
-    # end
-
-    # should "allow access to manage_admins#show" do
-    #   get :show, params: { id: @user }
-    #   assert_response :success
-    # end
-
-    # should "allow access to manage_admins#edit" do
-    #   get :edit, params: { id: @user }
-    #   assert_response :success
-    # end
-
-    # should "update user" do
-    #   patch :update, params: { id: @user, user: { email: "[email protected]" } }
-    #   assert_redirected_to manage_users_path
-    # end
-
-    # should "destroy user" do
-    #   assert_difference('User.count', -1) do
-    #     patch :destroy, params: { id: @user }
-    #   end
-    #   assert_redirected_to manage_users_path
-    # end
+    should "allow access to user_datatable" do
+      get :user_datatable
+      assert_response :success
+    end
+
+    should "allow access to staff_datatable" do
+      get :staff_datatable
+      assert_response :success
+    end
+
+    should "be able to reset a user's password" do
+      assert_difference "enqueued_jobs.size", 1 do
+        patch :reset_password, params: { id: @user }
+      end
+      assert_redirected_to manage_users_path
+    end
+
+    should "allow access to manage_users#show" do
+      get :show, params: { id: @user }
+      assert_response :success
+    end
+
+    should "allow access to manage_users#edit" do
+      get :edit, params: { id: @user }
+      assert_response :success
+    end
+
+    should "update user" do
+      patch :update, params: { id: @user, user: { email: "[email protected]" } }
+      assert_redirected_to manage_users_path
+    end
+
+    should "destroy user" do
+      assert_difference('User.count', -1) do
+        patch :destroy, params: { id: @user }
+      end
+      assert_redirected_to manage_users_path
+    end
+
+    should "destroy user and user's questionnaire" do
+      @questionnaire = create(:questionnaire, user_id: @user.id)
+      assert_difference('Questionnaire.count', -1) do
+        patch :destroy, params: { id: @user }
+      end
+      assert_redirected_to manage_users_path
+    end
   end
 end