2843790cef
Some checks failed
The Applications index used to render "All users" whenever an app had no allowed_groups; under default-deny that's the opposite of the truth. Replaced with a "No one" badge and, when groups are present, a "N users · M groups" cell so the access reality is visible at a glance. Added a small stats strip above the apps table: applications, users with access, and groups granting access. Backed by preloaded counts in the controller to avoid N+1. Added /admin/access — a small "Access check" tool that takes a user and an application and reports whether the user can reach it, with the granting group(s) when allowed, and the specific reason when not (inactive app/user, no allowed groups, or no shared group). Wired into the admin sidebar. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
48 lines
1.6 KiB
Ruby
48 lines
1.6 KiB
Ruby
require "test_helper"
|
|
|
|
module Admin
|
|
class AccessChecksControllerTest < ActionDispatch::IntegrationTest
|
|
setup do
|
|
@admin = users(:two)
|
|
sign_in_as(@admin)
|
|
@kavita = applications(:kavita_app)
|
|
end
|
|
|
|
test "new renders the form with users and applications" do
|
|
get admin_access_path
|
|
assert_response :success
|
|
assert_match @kavita.name, response.body
|
|
assert_match "alice@example.com", response.body
|
|
end
|
|
|
|
test "create returns 'can access' with via group when user is in an allowed group" do
|
|
post admin_access_path, params: {
|
|
user_id: users(:alice).id,
|
|
application_id: @kavita.id
|
|
}
|
|
assert_response :success
|
|
assert_match "can access", response.body
|
|
assert_match "Administrators", response.body # alice is in admin_group; kavita has admin_group
|
|
end
|
|
|
|
test "create returns 'cannot access' with reason when user shares no group with the app" do
|
|
lonely = User.create!(email_address: "lonely@example.com", password: "password123", skip_auto_assign: true)
|
|
post admin_access_path, params: {
|
|
user_id: lonely.id,
|
|
application_id: @kavita.id
|
|
}
|
|
assert_response :success
|
|
assert_match "cannot access", response.body
|
|
assert_match "shares no group", response.body
|
|
end
|
|
|
|
test "create renders form unchanged when ids are missing" do
|
|
post admin_access_path, params: {user_id: "", application_id: ""}
|
|
assert_response :success
|
|
# No result panel should render. The panel-only phrases:
|
|
refute_match "Granted via", response.body
|
|
refute_match "Reason:", response.body
|
|
end
|
|
end
|
|
end
|