Migliora sessioni admin e rende robusto il logout web.

Aggiunge filtri/colonne (società, orari) e dettaglio leggibile; evita 422 CSRF su logout e non cancella le cover slate custom in sync prod.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/spec/requests/admin/sessions_spec.rb

@@ -0,0 +1,63 @@
+require "rails_helper"
+
+RSpec.describe "Admin sessions index", type: :request do
+  let!(:admin) { AdminAccount.create!(username: "ops-sessions", password: "Password123") }
+  let!(:coach) do
+    User.create!(email: "sessions-coach@test.it", name: "Coach", password: "Password123", role: "coach")
+  end
+  let!(:club_a) { Club.create!(name: "Tigers Club", sport: "volleyball") }
+  let!(:club_b) { Club.create!(name: "Other Club", sport: "volleyball") }
+  let!(:team_a) { club_a.teams.create!(name: "Tigers U16", sport_key: "pallavolo") }
+  let!(:team_b) { club_b.teams.create!(name: "Other U14", sport_key: "pallavolo") }
+  let!(:match_a) { team_a.matches.create!(opponent_name: "Rival A", sport_key: "pallavolo") }
+  let!(:match_b) { team_b.matches.create!(opponent_name: "Rival B", sport_key: "pallavolo") }
+  let!(:session_a) do
+    StreamSession.create!(
+      match: match_a,
+      user: coach,
+      platform: "matchlivetv",
+      status: "ended",
+      started_at: 2.hours.ago,
+      ended_at: 1.hour.ago,
+      total_duration_secs: 3600
+    )
+  end
+  let!(:session_b) do
+    StreamSession.create!(
+      match: match_b,
+      user: coach,
+      platform: "youtube",
+      status: "live",
+      started_at: 30.minutes.ago
+    )
+  end
+
+  def login!
+    post admin_login_path, params: { username: admin.username, password: "Password123" }
+  end
+
+  before { login! }
+
+  it "mostra società, orari e filtra per testo" do
+    get admin_sessions_path, params: { q: "Tigers" }
+    expect(response).to have_http_status(:ok)
+    expect(response.body).to include("Tigers Club")
+    expect(response.body).to include("Tigers U16 vs Rival A")
+    expect(response.body).not_to include("Other U14 vs Rival B")
+  end
+
+  it "filtra per stato" do
+    get admin_sessions_path, params: { status: "live" }
+    expect(response).to have_http_status(:ok)
+    expect(response.body).to include("Other U14 vs Rival B")
+    expect(response.body).not_to include("Tigers U16 vs Rival A")
+  end
+
+  it "mostra il dettaglio formattato" do
+    get admin_session_path(session_a)
+    expect(response).to have_http_status(:ok)
+    expect(response.body).to include("Tigers Club")
+    expect(response.body).to include("Dettaglio sessione").or include("Session details")
+    expect(response.body).to include(session_a.id)
+  end
+end

backend/spec/requests/public/sessions_logout_spec.rb

@@ -0,0 +1,37 @@
+require "rails_helper"
+
+RSpec.describe "Public logout", type: :request do
+  let!(:user) do
+    User.create!(email: "logout-user@test.it", name: "Logout", password: "Password123", role: "coach")
+  end
+
+  def login!
+    ActionController::Base.allow_forgery_protection = false
+    post public_login_path, params: { email: user.email, password: "Password123" }
+    ActionController::Base.allow_forgery_protection = true
+  end
+
+  around do |example|
+    was = ActionController::Base.allow_forgery_protection
+    example.run
+  ensure
+    ActionController::Base.allow_forgery_protection = was
+  end
+
+  it "disconnette anche senza authenticity_token (CSRF stale)" do
+    login!
+    expect(session[:user_id]).to eq(user.id)
+
+    delete "/logout"
+    expect(response).to redirect_to(public_pricing_path)
+    follow_redirect!
+    expect(session[:user_id]).to be_nil
+  end
+
+  it "accetta anche GET /logout come fallback" do
+    login!
+    get "/logout"
+    expect(response).to redirect_to(public_pricing_path)
+    expect(session[:user_id]).to be_nil
+  end
+end