diff --git a/app/controllers/admin/users_controller.rb b/app/controllers/admin/users_controller.rb
index f3dcc07cd..2fca1f2df 100644
--- a/app/controllers/admin/users_controller.rb
+++ b/app/controllers/admin/users_controller.rb
@@ -40,6 +40,30 @@ module Admin
redirect_to "/admin/users/#{params[:id]}"
end
+ def destroy
+ role = params[:role].to_sym
+ resource_type = params[:resource_type]
+
+ if role == :super_admin
+ flash[:danger] = "Super Admin roles cannot be removed."
+ redirect_to "/admin/users/#{params[:id]}/edit" and return
+ end
+
+ @user = User.find(params[:user_id])
+
+ if @user.id == current_user.id
+ flash[:danger] = "Admins cannot remove roles from themselves."
+ elsif role == :single_resource_admin && !resource_type.safe_constantize.nil?
+ User.find(params[:user_id]).remove_role(role, resource_type.safe_constantize)
+ flash[:success] = "Role: #{role.to_s.humanize.titlecase} has been successfully removed from the user!"
+ elsif User.find(params[:user_id]).remove_role(role)
+ flash[:success] = "Role: #{role.to_s.humanize.titlecase} has been successfully removed from the user!"
+ else
+ flash[:danger] = "There was an issue removing this role. Please try again."
+ end
+ redirect_to edit_admin_user_path(@user.id)
+ end
+
def user_status
@user = User.find(params[:id])
begin
diff --git a/app/views/admin/users/_activity.html.erb b/app/views/admin/users/_activity.html.erb
index 75a1e80b8..bb4061e0c 100644
--- a/app/views/admin/users/_activity.html.erb
+++ b/app/views/admin/users/_activity.html.erb
@@ -10,17 +10,4 @@
diff --git a/config/routes.rb b/config/routes.rb
index 563ffd981..f30b9bce8 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -110,7 +110,7 @@ Rails.application.routes.draw do
resources :tags, only: %i[index new create update edit] do
resource :moderator, only: %i[create destroy], module: "tags"
end
- resources :users, only: %i[index show edit update] do
+ resources :users, only: %i[index show edit update destroy] do
resources :email_messages, only: :show
member do
diff --git a/spec/requests/admin/users_manage_spec.rb b/spec/requests/admin/users_manage_spec.rb
index 341adb59f..e62230017 100644
--- a/spec/requests/admin/users_manage_spec.rb
+++ b/spec/requests/admin/users_manage_spec.rb
@@ -164,6 +164,53 @@ RSpec.describe "Admin::Users", type: :request do
put "/admin/users/#{user.id}", params: { user: { remove_credits: "3" } }
expect(user.credits.size).to eq(2)
end
+
+ it "removes non-admin roles from non-super_admin users", :aggregate_failures do
+ user.add_role(:trusted)
+
+ expect do
+ delete "/admin/users/#{user.id}", params: { user_id: user.id, role: :trusted }
+ end.to change(user.roles, :count).by(-1)
+
+ expect(user.has_role?(:trusted)).to be false
+ expect(request.flash["success"]).to include("successfully removed from the user!")
+ end
+
+ it "removes the correct resource_admin_role from non-super_admin users", :aggregate_failures do
+ user.add_role(:single_resource_admin, Comment)
+ user.add_role(:single_resource_admin, Broadcast)
+
+ expect do
+ delete "/admin/users/#{user.id}",
+ params: { user_id: user.id, role: :single_resource_admin, resource_type: Comment }
+ end.to change(user.roles, :count).by(-1)
+
+ expect(user.has_role?(:single_resource_admin, Comment)).to be false
+ expect(user.has_role?(:single_resource_admin, Broadcast)).to be true
+ expect(request.flash["success"]).to include("successfully removed from the user!")
+ end
+
+ it "does not allow super_admin roles to be removed", :aggregate_failures do
+ user.add_role(:super_admin)
+
+ expect do
+ delete "/admin/users/#{user.id}", params: { user_id: user.id, role: :super_admin }
+ end.not_to change(user.roles, :count)
+
+ expect(user.has_role?(:super_admin)).to be true
+ expect(request.flash["danger"]).to include("cannot be removed.")
+ end
+
+ it "does not allow a admins to remove a role from themselves", :aggregate_failures do
+ super_admin.add_role(:trusted)
+
+ expect do
+ delete "/admin/users/#{super_admin.id}", params: { user_id: super_admin.id, role: :trusted }
+ end.not_to change(super_admin.roles, :count)
+
+ expect(super_admin.has_role?(:trusted)).to be true
+ expect(request.flash["danger"]).to include("cannot remove roles")
+ end
end
context "when deleting user" do
diff --git a/spec/requests/admin/users_spec.rb b/spec/requests/admin/users_spec.rb
index 38adac0a7..f15e1b614 100644
--- a/spec/requests/admin/users_spec.rb
+++ b/spec/requests/admin/users_spec.rb
@@ -34,14 +34,14 @@ RSpec.describe "admin/users", type: :request do
it "only displays limited information about the user" do
user.update_columns(registered: false)
get "/admin/users/#{user.id}"
- expect(response.body).not_to include("Current Roles")
+ expect(response.body).not_to include("Activity")
end
end
context "when a user is registered" do
it "renders the Admin User profile as expected" do
get "/admin/users/#{user.id}"
- expect(response.body).to include("Current Roles")
+ expect(response.body).to include("Activity")
end
end
@@ -72,6 +72,11 @@ RSpec.describe "admin/users", type: :request do
expect { get "/admin/users/#{user.id}/edit" }.to raise_error(Pundit::NotAuthorizedError)
end
+ it "displays the 'Current Roles' section" do
+ get "/admin/users/#{user.id}/edit"
+ expect(response.body).to include("Current Roles")
+ end
+
it "displays the 'Recent Reactions' section" do
get "/admin/users/#{user.id}/edit"
expect(response.body).to include("Recent Reactions")