eminuxCRM/test/controllers/users_controller_test.rb

require "test_helper"

class UsersControllerTest < ActionDispatch::IntegrationTest
  test "non admin cannot list or create users" do
    login_as users(:marco)
    follow_redirect! if response.redirect?

    get users_path
    assert_redirected_to root_path

    post users_path, params: {
      user: { email: "x@example.com", first_name: "X", last_name: "Y", role: "user", password: "password123", password_confirmation: "password123" }
    }
    assert_redirected_to root_path
  end

  test "admin can create a user" do
    login_as users(:admin)
    follow_redirect! if response.redirect?

    assert_difference "User.count", 1 do
      post users_path, params: {
        user: {
          email: "nuovo@example.com",
          first_name: "Nuovo",
          last_name: "Utente",
          role: "user",
          password: "password123",
          password_confirmation: "password123"
        },
        project_ids: [ projects(:matchlivetv).id ]
      }
    end
    assert_redirected_to users_path
    user = User.find_by!(email: "nuovo@example.com")
    assert user.project_enabled?(projects(:matchlivetv))
    assert_not user.project_enabled?(projects(:riskmeter))
  end

  test "admin can disable another admin when a second admin exists" do
    login_as users(:admin)
    follow_redirect! if response.redirect?

    other = User.create!(
      email: "emiliano@example.com",
      first_name: "Emiliano",
      last_name: "Admin",
      role: "admin",
      password: "password123",
      password_confirmation: "password123"
    )

    patch user_path(other), params: {
      user: { first_name: other.first_name, last_name: other.last_name, email: other.email, role: "admin", active: "0" }
    }
    assert_redirected_to users_path
    assert_not other.reload.active?
  end

  test "admin cannot disable last active admin" do
    login_as users(:admin)
    follow_redirect! if response.redirect?
    admin = users(:admin)

    patch user_path(admin), params: {
      user: { first_name: admin.first_name, last_name: admin.last_name, email: admin.email, role: "admin", active: "0" }
    }
    assert_response :unprocessable_entity
    assert admin.reload.active?
    assert_match(/almeno un amministratore attivo/i, response.body)
  end

  test "admin cannot delete self" do
    login_as users(:admin)
    follow_redirect! if response.redirect?

    assert_no_difference "User.count" do
      delete user_path(users(:admin))
    end
    assert_redirected_to users_path
    follow_redirect!
    assert_match(/Non puoi eliminare il tuo account/i, response.body)
  end

  test "admin can delete another admin when a second remains" do
    login_as users(:admin)
    follow_redirect! if response.redirect?

    other = User.create!(
      email: "other-admin@example.com",
      first_name: "Other",
      last_name: "Admin",
      role: "admin",
      password: "password123",
      password_confirmation: "password123"
    )

    assert_difference "User.count", -1 do
      delete user_path(other)
    end
    assert_redirected_to users_path
  end

  test "admin can delete another user and nullify activities" do
    login_as users(:admin)
    follow_redirect! if response.redirect?
    marco = users(:marco)
    activity = activities(:note)
    assert_equal marco.id, activity.user_id

    assert_difference "User.count", -1 do
      delete user_path(marco)
    end
    assert_redirected_to users_path
    assert_nil activity.reload.user_id
  end
end