docbrown/spec/requests/user/user_organization_spec.rb

require "rails_helper"

RSpec.describe "UserOrganization", type: :request do
  let(:user)          { create(:user) }
  let(:organization)  { create(:organization, secret: SecureRandom.hex(50)) }

  context "when joining an org" do
    before { sign_in user }

    it "creates an organization_membership association" do
      post "/users/join_org", params: { org_secret: organization.secret }
      org_membership = OrganizationMembership.first
      expect(org_membership.persisted?).to eq true
      expect(org_membership.user).to eq user
      expect(org_membership.organization).to eq organization
      expect(org_membership.type_of_user).to eq "member"
    end

    it "shows an error message if secret is invalid" do
      post "/users/join_org", params: { org_secret: "NOT SECRET" }
      expect(flash[:error]).to eq "The given organization secret was invalid."
    end

    it "correctly strips the secret of the org_secret param" do
      post "/users/join_org", params: { org_secret: organization.secret + "     " }
      expect(OrganizationMembership.exists?(user: user, organization: organization)).to eq true
    end
  end

  context "when creating a new org" do
    let(:org_params) { build(:organization).attributes }
    let(:rate_limiter) { RateLimitChecker.new(user) }
    let(:create_org) { post "/organizations", params: { organization: org_params } }

    before do
      sign_in user
      org_params["profile_image"] = Rack::Test::UploadedFile.new(Rails.root.join("app/assets/images/android-icon-36x36.png"), "image/jpeg")
      allow(RateLimitChecker).to receive(:new).and_return(rate_limiter)
      allow(rate_limiter).to receive(:limit_by_action).and_return(false)
    end

    it "creates the correct organization_membership association" do
      create_org
      org_membership = OrganizationMembership.first
      expect(org_membership.persisted?).to eq true
      expect(org_membership.user).to eq user
      expect(org_membership.organization).to eq Organization.last
      expect(org_membership.type_of_user).to eq "admin"
    end

    it "redirects to the proper org settings page" do
      create_org
      expect(response.status).to eq 302
      expect(response.redirect_url).to include "/settings/organization/#{Organization.last.id}"
    end

    it "raises a Rate limit error if the rate limit is reached" do
      allow(rate_limiter).to receive(:limit_by_action).and_return(true)

      expect { create_org }.to raise_error(RateLimitChecker::LimitReached)
    end
  end

  it "catches error if profile image file name is too long" do
    sign_in user
    org_params = build(:organization).attributes
    org_params["profile_image"] = fixture_file_upload("files/800x600.png", "image/png")
    allow(Organization).to receive(:new).and_return(organization)
    allow(organization).to receive(:save).and_raise(Errno::ENAMETOOLONG)
    allow(DatadogStatsClient).to receive(:increment)

    expect do
      post "/organizations", params: { organization: org_params }
    end.to raise_error(Errno::ENAMETOOLONG)

    tags = hash_including(tags: instance_of(Array))

    expect(DatadogStatsClient).to have_received(:increment).with("image_upload_error", tags)
  end

  it "returns error if profile image file name is too long" do
    sign_in user
    org_params = build(:organization).attributes
    image = fixture_file_upload("files/800x600.png", "image/png")
    allow(image).to receive(:original_filename).and_return("#{'a_very_long_filename' * 15}.png")
    org_params["profile_image"] = image
    allow(Organization).to receive(:new).and_return(organization)

    post "/organizations", params: { organization: org_params }
    expect(response.body).to include("filename too long")
  end

  context "when leaving an org" do
    let(:org_member) { create(:user, :org_member) }

    before { sign_in org_member }

    it "leaves org and deletes the member's organization membership" do
      org_id = org_member.organizations.first.id
      post "/users/leave_org/#{org_id}"
      expect(OrganizationMembership.exists?(user_id: org_member.id, organization_id: org_id)).to eq false
    end
  end

  context "when adding an org admin" do
    let(:org_admin) { create(:user, :org_admin) }
    let(:org_member) { create(:user, :org_member) }
    let(:org_id) { org_admin.organizations.first.id }
    let(:user2) { create(:user) }

    def add_org_admin
      org_admin
      create(:organization_membership, user_id: user2.id, organization_id: org_id)
      sign_in org_admin
      post "/users/add_org_admin", params: { user_id: user2.id, organization_id: org_id }
    end

    it "adds org admin" do
      org = org_admin.organizations.first
      add_org_admin
      expect(user2.org_admin?(org)).to eq(true)
    end

    it "creates the org_membership association" do
      add_org_admin
      org_membership = OrganizationMembership.last
      expect(org_membership.persisted?).to eq true
      expect(org_membership.user_id).to eq user2.id
      expect(org_membership.organization_id).to eq org_id
      expect(org_membership.type_of_user).to eq "admin"
    end

    it "raises not_authorized if user is not org_admin" do
      org_member_org_id = org_member.organizations.first.id
      sign_in org_member
      expect { post "/users/add_org_admin", params: { user_id: user2.id, organization_id: org_member_org_id } }.
        to raise_error Pundit::NotAuthorizedError
    end
  end

  context "when removing an org admin" do
    let(:org_admin) { create(:user, :org_admin) }
    let(:org_id) { org_admin.organizations.first.id }
    let(:second_org_admin) { create(:user, :org_admin) }

    before do
      second_org_admin.organization_memberships.update_all(organization_id: org_id)
      sign_in org_admin
    end

    it "removes org admin" do
      post "/users/remove_org_admin", params: { user_id: second_org_admin.id, organization_id: org_id }
      expect(second_org_admin.org_admin?(org_id)).to eq false
    end

    it "updates the correct org_membership association to a member level" do
      org_membership = second_org_admin.organization_memberships.first
      post "/users/remove_org_admin", params: { user_id: second_org_admin.id, organization_id: org_id }
      expect(org_membership.reload.type_of_user).to eq "member"
    end

    it "remove_org_admin raises if user not org_admin" do
      org_admin.organization_memberships.update_all(type_of_user: "member")
      expect { post "/users/remove_org_admin", params: { user_id: second_org_admin.id, organization_id: org_id } }.
        to raise_error Pundit::NotAuthorizedError
    end
  end
end