Merge pull request #5019 from betagouv/fix-attachment-redirect

Fix middle-click on "Delete attachment" button

app/controllers/attachments_controller.rb

@@ -5,6 +5,11 @@ class AttachmentsController < ApplicationController
   def show
     @attachment = @blob.attachments.find(params[:id])
     @user_can_upload = params[:user_can_upload]
+
+    respond_to do |format|
+      format.js
+      format.html { redirect_back(fallback_location: root_url) }
+    end
   end
 
   def destroy

config/routes.rb

@@ -124,8 +124,7 @@ Rails.application.routes.draw do
     put 'piece_justificative/:champ_id', to: 'piece_justificative#update', as: :piece_justificative
   end
 
-  get 'attachments/:id', to: 'attachments#show', as: :attachment
+  resources :attachments, only: [:show, :destroy]
-  delete 'attachments/:id', to: 'attachments#destroy'
 
   get "patron" => "root#patron"
   get "accessibilite" => "root#accessibilite"

spec/controllers/attachments_controller_spec.rb

@@ -1,5 +1,46 @@
 describe AttachmentsController, type: :controller do
   let(:user) { create(:user) }
+  let(:attachment) { champ.piece_justificative_file.attachment }
+  let(:dossier) { create(:dossier, user: user) }
+  let(:champ) { create(:champ_piece_justificative, dossier_id: dossier.id) }
+  let(:signed_id) { attachment.blob.signed_id }
+
+  describe '#show' do
+    render_views
+
+    let(:format) { :js }
+
+    subject do
+      request.headers['HTTP_REFERER'] = dossier_url(dossier)
+      get :show, params: { id: attachment.id, signed_id: signed_id }, format: format
+    end
+
+    context 'when authenticated' do
+      before { sign_in(user) }
+
+      context 'when requesting Javascript' do
+        let(:format) { :js }
+
+        it { is_expected.to have_http_status(200) }
+
+        it 'renders JS that replaces the attachment HTML' do
+          subject
+          expect(response.body).to have_text(".attachment-link[data-attachment-id=\"#{attachment.id}\"]")
+        end
+      end
+
+      context 'when the user opens the delete link in a new tab' do
+        let(:format) { :html }
+
+        it { is_expected.to have_http_status(302) }
+        it { is_expected.to redirect_to(dossier_path(dossier)) }
+      end
+    end
+
+    context 'when not authenticated' do
+      it { is_expected.to have_http_status(401) }
+    end
+  end
 
   describe '#destroy' do
     render_views
@@ -19,7 +60,7 @@ describe AttachmentsController, type: :controller do
       context 'and dossier is owned by user' do
         it { is_expected.to have_http_status(200) }
 
-        it do
+        it 'removes the attachment' do
           subject
           expect(champ.reload.piece_justificative_file.attached?).to be(false)
         end
@@ -30,7 +71,7 @@ describe AttachmentsController, type: :controller do
 
         it { is_expected.to have_http_status(404) }
 
-        it do
+        it 'doesn’t remove the attachment' do
           subject
           expect(champ.reload.piece_justificative_file.attached?).to be(true)
         end
@@ -40,7 +81,7 @@ describe AttachmentsController, type: :controller do
     context 'when not authenticated' do
       it { is_expected.to have_http_status(401) }
 
-      it do
+      it 'doesn’t remove the attachment' do
         subject
         expect(champ.reload.piece_justificative_file.attached?).to be(true)
       end