add controller tests

test/controllers/admin/dashboard_controller_test.rb

@@ -0,0 +1,36 @@
+require "test_helper"
+
+class Admin::DashboardControllerTest < ActionDispatch::IntegrationTest
+  test "should redirect to login when not authenticated" do
+    get admin_root_path
+    assert_redirected_to login_path
+    follow_redirect!
+    assert_select ".bg-red-50", /You must be logged in/
+  end
+
+  test "should redirect to root when logged in as non-admin" do
+    login_as(users(:contributor_user))
+    get admin_root_path
+    assert_redirected_to root_path
+    assert_equal "You must be an administrator to access this page.", flash[:alert]
+  end
+
+  test "should redirect to root when logged in as reviewer" do
+    login_as(users(:reviewer_user))
+    get admin_root_path
+    assert_redirected_to root_path
+    assert_equal "You must be an administrator to access this page.", flash[:alert]
+  end
+
+  test "should show dashboard when logged in as admin" do
+    login_as(users(:admin_user))
+    get admin_root_path
+    assert_response :success
+  end
+
+  test "should show admin dashboard path" do
+    login_as(users(:admin_user))
+    get admin_dashboard_path
+    assert_response :success
+  end
+end

test/controllers/admin/invitations_controller_test.rb

@@ -0,0 +1,116 @@
+require "test_helper"
+
+class Admin::InvitationsControllerTest < ActionDispatch::IntegrationTest
+  test "should redirect to login when not authenticated" do
+    get admin_invitations_path
+    assert_redirected_to login_path
+  end
+
+  test "should redirect to root when logged in as non-admin" do
+    login_as(users(:contributor_user))
+    get admin_invitations_path
+    assert_redirected_to root_path
+  end
+
+  test "should show invitations index when logged in as admin" do
+    login_as(users(:admin_user))
+    get admin_invitations_path
+    assert_response :success
+  end
+
+  test "should get new invitation page when logged in as admin" do
+    login_as(users(:admin_user))
+    get new_admin_invitation_path
+    assert_response :success
+  end
+
+  test "should create invitation when logged in as admin" do
+    login_as(users(:admin_user))
+
+    assert_difference("User.count", 1) do
+      post admin_invitations_path, params: {
+        user: {
+          email: "newuser@example.com",
+          name: "New User",
+          role: "contributor",
+          primary_language: "en"
+        }
+      }
+    end
+
+    assert_redirected_to admin_invitations_path
+
+    new_user = User.find_by(email: "newuser@example.com")
+    assert_not_nil new_user
+    assert_not_nil new_user.invitation_token
+    assert_not_nil new_user.invitation_sent_at
+    assert_nil new_user.invitation_accepted_at
+    assert_equal users(:admin_user).id, new_user.invited_by_id
+  end
+
+  test "should not create invitation with invalid data" do
+    login_as(users(:admin_user))
+
+    assert_no_difference("User.count") do
+      post admin_invitations_path, params: {
+        user: {
+          email: "",
+          name: "New User",
+          role: "contributor",
+          primary_language: "en"
+        }
+      }
+    end
+
+    assert_response :unprocessable_entity
+  end
+
+  test "should cancel pending invitation when logged in as admin" do
+    login_as(users(:admin_user))
+
+    assert_difference("User.count", -1) do
+      delete admin_invitation_path(users(:pending_invitation))
+    end
+
+    assert_redirected_to admin_invitations_path
+  end
+
+  test "should not cancel accepted invitation" do
+    login_as(users(:admin_user))
+
+    assert_no_difference("User.count") do
+      delete admin_invitation_path(users(:contributor_user))
+    end
+
+    assert_redirected_to admin_invitations_path
+    follow_redirect!
+    assert_select ".bg-red-50", /Cannot cancel an accepted invitation/
+  end
+
+  test "should not allow non-admin to create invitation" do
+    login_as(users(:contributor_user))
+
+    assert_no_difference("User.count") do
+      post admin_invitations_path, params: {
+        user: {
+          email: "newuser@example.com",
+          name: "New User",
+          role: "contributor",
+          primary_language: "en"
+        }
+      }
+    end
+
+    assert_redirected_to root_path
+  end
+
+  test "should not allow non-admin to cancel invitation" do
+    login_as(users(:contributor_user))
+
+    assert_no_difference("User.count") do
+      delete admin_invitation_path(users(:pending_invitation))
+    end
+
+    assert_redirected_to root_path
+  end
+end

test/controllers/admin/users_controller_test.rb

@@ -0,0 +1,68 @@
+require "test_helper"
+
+class Admin::UsersControllerTest < ActionDispatch::IntegrationTest
+  test "should redirect to login when not authenticated" do
+    get admin_users_path
+    assert_redirected_to login_path
+  end
+
+  test "should redirect to root when logged in as non-admin" do
+    login_as(users(:contributor_user))
+    get admin_users_path
+    assert_redirected_to root_path
+  end
+
+  test "should show users index when logged in as admin" do
+    login_as(users(:admin_user))
+    get admin_users_path
+    assert_response :success
+  end
+
+  test "should get edit page for user when logged in as admin" do
+    login_as(users(:admin_user))
+    get edit_admin_user_path(users(:contributor_user))
+    assert_response :success
+  end
+
+  test "should update user role when logged in as admin" do
+    login_as(users(:admin_user))
+
+    patch admin_user_path(users(:contributor_user)), params: {
+      user: { role: "reviewer" }
+    }
+
+    assert_redirected_to admin_users_path
+    assert_equal "reviewer", users(:contributor_user).reload.role
+  end
+
+  test "should delete user when logged in as admin" do
+    login_as(users(:admin_user))
+
+    # Delete reviewer_user who has no associated records
+    assert_difference("User.count", -1) do
+      delete admin_user_path(users(:reviewer_user))
+    end
+
+    assert_redirected_to admin_users_path
+  end
+
+  test "should not allow non-admin to update user" do
+    login_as(users(:contributor_user))
+
+    patch admin_user_path(users(:reviewer_user)), params: {
+      user: { role: "admin" }
+    }
+
+    assert_redirected_to root_path
+  end
+
+  test "should not allow non-admin to delete user" do
+    login_as(users(:contributor_user))
+
+    assert_no_difference("User.count") do
+      delete admin_user_path(users(:reviewer_user))
+    end
+
+    assert_redirected_to root_path
+  end
+end

test/controllers/sessions_controller_test.rb

@@ -0,0 +1,105 @@
+require "test_helper"
+
+class SessionsControllerTest < ActionDispatch::IntegrationTest
+  test "should get login page" do
+    get login_path
+    assert_response :success
+    assert_select "h1", "Sign in"
+    assert_select "input[type=email]"
+    assert_select "input[type=password]"
+  end
+
+  test "should redirect to admin if already logged in as admin" do
+    login_as(users(:admin_user))
+    get login_path
+    assert_redirected_to admin_root_path
+  end
+
+  test "should redirect to root if already logged in as non-admin" do
+    login_as(users(:contributor_user))
+    get login_path
+    assert_redirected_to root_path
+  end
+
+  test "should login with valid credentials" do
+    post login_path, params: {
+      email: "admin@example.com",
+      password: "password123456"
+    }
+
+    assert_redirected_to admin_root_path
+    assert_equal users(:admin_user).id, session[:user_id]
+    follow_redirect!
+    assert_select ".bg-green-50", /Welcome back/
+  end
+
+  test "should login contributor and redirect to root" do
+    post login_path, params: {
+      email: "contributor@example.com",
+      password: "password123456"
+    }
+
+    assert_redirected_to root_path
+    assert_equal users(:contributor_user).id, session[:user_id]
+  end
+
+  test "should not login with invalid email" do
+    post login_path, params: {
+      email: "nonexistent@example.com",
+      password: "password123456"
+    }
+
+    assert_response :unprocessable_entity
+    assert_nil session[:user_id]
+    assert_select ".bg-red-50", /Invalid email or password/
+  end
+
+  test "should not login with invalid password" do
+    post login_path, params: {
+      email: "admin@example.com",
+      password: "wrongpassword"
+    }
+
+    assert_response :unprocessable_entity
+    assert_nil session[:user_id]
+    assert_select ".bg-red-50", /Invalid email or password/
+  end
+
+  test "should handle email with whitespace and case insensitivity" do
+    post login_path, params: {
+      email: "  ADMIN@EXAMPLE.COM  ",
+      password: "password123456"
+    }
+
+    assert_redirected_to admin_root_path
+    assert_equal users(:admin_user).id, session[:user_id]
+  end
+
+  test "should not login user with pending invitation" do
+    post login_path, params: {
+      email: "pending@example.com",
+      password: "password123456"
+    }
+
+    assert_response :unprocessable_entity
+    assert_nil session[:user_id]
+    assert_select ".bg-red-50", /Your account is pending/
+  end
+
+  test "should logout and redirect to root" do
+    login_as(users(:admin_user))
+
+    delete logout_path
+
+    assert_redirected_to root_path
+    assert_nil session[:user_id]
+    assert_equal "You have been logged out.", flash[:notice]
+  end
+
+  test "should logout even when not logged in" do
+    delete logout_path
+
+    assert_redirected_to root_path
+    assert_nil session[:user_id]
+  end
+end

test/controllers/setup_controller_test.rb

@@ -0,0 +1,100 @@
+require "test_helper"
+
+class SetupControllerTest < ActionDispatch::IntegrationTest
+  def setup
+    SetupState.reset!
+  end
+
+  def teardown
+    SetupState.reset!
+  end
+
+  test "should show setup page when not installed" do
+    get setup_path
+    assert_response :success
+    assert_select "h2", /Create Admin Account/
+  end
+
+  test "should redirect to root when already installed" do
+    SetupState.mark_installed!
+
+    get setup_path
+    assert_redirected_to root_path
+    assert_equal "Setup has already been completed.", flash[:alert]
+  end
+
+  test "should create admin user and mark as installed" do
+    assert_difference("User.count", 1) do
+      post setup_path, params: {
+        user: {
+          email: "setupadmin@example.com",
+          name: "Setup Admin",
+          password: "securepassword123",
+          password_confirmation: "securepassword123",
+          primary_language: "en"
+        }
+      }
+    end
+
+    assert SetupState.installed?
+
+    new_user = User.find_by(email: "setupadmin@example.com")
+    assert_not_nil new_user
+    assert_equal "admin", new_user.role
+    assert_not_nil new_user.invitation_accepted_at
+    assert_equal new_user.id, session[:user_id]
+
+    assert_redirected_to admin_root_path
+  end
+
+  test "should not create user with invalid password" do
+    assert_no_difference("User.count") do
+      post setup_path, params: {
+        user: {
+          email: "setupadmin@example.com",
+          name: "Setup Admin",
+          password: "short",  # Too short, minimum is 12
+          password_confirmation: "short",
+          primary_language: "en"
+        }
+      }
+    end
+
+    assert_not SetupState.installed?
+    assert_response :unprocessable_entity
+  end
+
+  test "should not create user with mismatched passwords" do
+    assert_no_difference("User.count") do
+      post setup_path, params: {
+        user: {
+          email: "setupadmin@example.com",
+          name: "Setup Admin",
+          password: "securepassword123",
+          password_confirmation: "differentpassword",
+          primary_language: "en"
+        }
+      }
+    end
+
+    assert_not SetupState.installed?
+    assert_response :unprocessable_entity
+  end
+
+  test "should not create user without email" do
+    assert_no_difference("User.count") do
+      post setup_path, params: {
+        user: {
+          email: "",
+          name: "Setup Admin",
+          password: "securepassword123",
+          password_confirmation: "securepassword123",
+          primary_language: "en"
+        }
+      }
+    end
+
+    assert_not SetupState.installed?
+    assert_response :unprocessable_entity
+  end
+end