+
+ Vous avez été invité·e par
+
+ <%= @inviter.email %>
+
+ à confirmer l'ajout de
+
+ <%= @invited_email %>
+
+ à la démarche
+
+ <%= @procedure.libelle %>
+ (<%= @procedure.id %>).
+
+
+
+
+ Confirmez-vous cet ajout ?
+
+
+ <%= form_tag manager_procedure_administrateur_confirmations_path(@procedure) do %>
+ <%= hidden_field_tag :q, params[:q] %>
+ <%= submit_tag "Oui, je confirme l'ajout" %>
+ <%= link_to "Non, je ne confirme pas l'ajout", :back %>
+ <% end %>
+
diff --git a/app/views/manager/application/_navigation.html.erb b/app/views/manager/application/_navigation.html.erb
index 063ba6789..6ba4253fe 100644
--- a/app/views/manager/application/_navigation.html.erb
+++ b/app/views/manager/application/_navigation.html.erb
@@ -12,7 +12,7 @@ as defined by the routes in the `admin/` namespace
+
+ Veuillez partager ce lien avec un autre super admin pour que l'opération soit effectuée.
+
+
+ -
+ Lien
+
+
+ -
+ <%= @url %>
+
+
+
diff --git a/config/routes.rb b/config/routes.rb
index d44e451a1..50093db4d 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -18,9 +18,10 @@ Rails.application.routes.draw do
put 'delete_administrateur', on: :member
post 'add_administrateur_and_instructeur', on: :member
post 'add_administrateur_with_confirmation', on: :member
- get 'confirm_add_administrateur', on: :member
post 'change_piece_justificative_template', on: :member
get 'export_mail_brouillons', on: :member
+ resources :confirmation_urls, only: :new
+ resources :administrateur_confirmations, only: [:new, :create]
end
resources :archives, only: [:index, :show]
diff --git a/spec/controllers/manager/administrateur_confirmations_controller_spec.rb b/spec/controllers/manager/administrateur_confirmations_controller_spec.rb
new file mode 100644
index 000000000..ef629eef1
--- /dev/null
+++ b/spec/controllers/manager/administrateur_confirmations_controller_spec.rb
@@ -0,0 +1,164 @@
+require 'rails_helper'
+
+RSpec.describe Manager::AdministrateurConfirmationsController, type: :controller do
+ let(:inviter_super_admin) { create(:super_admin) }
+ let(:inviter_administrateur) { create(:administrateur, email: inviter_super_admin.email) }
+
+ let(:invited_super_admin) { create(:super_admin) }
+ let(:invited_administrateur) { create(:administrateur, email: invited_super_admin.email) }
+
+ let(:confirmer_super_admin) { create(:super_admin) }
+
+ let(:procedure) { create(:procedure, administrateurs: [inviter_administrateur]) }
+
+ describe "GET #new" do
+ subject(:new_request) do
+ get :new, params: {
+ procedure_id: procedure.id,
+ q: encrypt({ email: invited_administrateur.email, inviter_id: inviter_super_admin.id })
+ }
+ end
+
+ shared_examples "current admin is allowed to confirm adding another one" do
+ before { new_request }
+
+ it { expect(response).to render_template(:new) }
+ end
+
+ shared_examples "current admin isn't allowed to confirm adding another one" do
+ before { new_request }
+
+ it { expect(flash[:alert]).to match(/Veuillez partager ce lien avec un autre super administrateur/) }
+
+ it { expect(response).to redirect_to(manager_procedure_path(procedure)) }
+ end
+
+ context 'when the current admin is the invited' do
+ before { sign_in invited_super_admin }
+
+ it_behaves_like "current admin isn't allowed to confirm adding another one"
+ end
+
+ context 'when the current admin is the inviter' do
+ before { sign_in inviter_super_admin }
+
+ it_behaves_like "current admin isn't allowed to confirm adding another one"
+ end
+
+ context 'when the current admin is not the invited nor the inviter' do
+ before { sign_in confirmer_super_admin }
+
+ it_behaves_like "current admin is allowed to confirm adding another one"
+ end
+
+ describe 'edge cases' do
+ context 'when the environment is development' do
+ before { Rails.env.stub(development?: true) }
+
+ context 'when the current admin is the inviter' do
+ before { sign_in inviter_super_admin }
+
+ it_behaves_like "current admin is allowed to confirm adding another one"
+ end
+
+ context 'when the current admin is the invited' do
+ before { sign_in invited_super_admin }
+
+ it_behaves_like "current admin is allowed to confirm adding another one"
+ end
+ end
+
+ context 'when the encrypted params are invalid' do
+ before { sign_in inviter_super_admin }
+ before { get :new, params: { procedure_id: procedure.id, q: "something that is invalid" } }
+
+ it { expect(flash[:error]).to match(/Le lien que vous avez utilisé est invalide/) }
+ end
+ end
+ end
+
+ describe "GET #create" do
+ subject(:create_request) do
+ post :create, params: {
+ procedure_id: procedure.id,
+ q: encrypt({ email: invited_administrateur.email, inviter_id: inviter_super_admin.id })
+ }
+ end
+
+ shared_examples "current admin is allowed to confirm adding another one" do
+ it "flashes the success message" do
+ create_request
+ expect(flash[:notice]).to include(invited_administrateur.email)
+ expect(flash[:notice]).to match(/ajouté à la démarche/)
+ end
+
+ it "adds the admin to the procedure" do
+ expect { create_request }.to change { procedure.administrateurs.count }.by(1)
+ end
+
+ it "redirects to the procedure" do
+ create_request
+ expect(response).to redirect_to(manager_procedure_path(procedure))
+ end
+ end
+
+ shared_examples "current admin isn't allowed to confirm adding another one" do
+ before { create_request }
+
+ it { expect(flash[:alert]).to match(/Veuillez partager ce lien avec un autre super administrateur/) }
+
+ it { expect(response).to redirect_to(manager_procedure_path(procedure)) }
+ end
+
+ context 'when the current admin is the invited' do
+ before { sign_in invited_super_admin }
+
+ it_behaves_like "current admin isn't allowed to confirm adding another one"
+ end
+
+ context 'when the current admin is the inviter' do
+ before { sign_in inviter_super_admin }
+
+ it_behaves_like "current admin isn't allowed to confirm adding another one"
+ end
+
+ context 'when the current admin is not the invited nor the inviter' do
+ before { sign_in confirmer_super_admin }
+
+ it_behaves_like "current admin is allowed to confirm adding another one"
+ end
+
+ describe 'edge cases' do
+ context 'when the environment is development' do
+ before { Rails.env.stub(development?: true) }
+
+ context 'when the current admin is the inviter' do
+ before { sign_in inviter_super_admin }
+
+ it_behaves_like "current admin is allowed to confirm adding another one"
+ end
+
+ context 'when the current admin is the invited' do
+ before { sign_in invited_super_admin }
+
+ it_behaves_like "current admin is allowed to confirm adding another one"
+ end
+ end
+
+ context 'when the encrypted params are invalid' do
+ before { sign_in inviter_super_admin }
+ before { post :create, params: { procedure_id: procedure.id, q: "something that is invalid" } }
+
+ it { expect(flash[:error]).to match(/Le lien que vous avez utilisé est invalide/) }
+ end
+ end
+ end
+
+ private
+
+ def encrypt(parameters)
+ key = Rails.application.key_generator.generate_key("confirm_adding_administrateur")
+ verifier = ActiveSupport::MessageVerifier.new(key)
+ Base64.urlsafe_encode64(verifier.generate(parameters))
+ end
+end
diff --git a/spec/controllers/manager/confirmation_urls_controller_spec.rb b/spec/controllers/manager/confirmation_urls_controller_spec.rb
new file mode 100644
index 000000000..b0e32a075
--- /dev/null
+++ b/spec/controllers/manager/confirmation_urls_controller_spec.rb
@@ -0,0 +1,73 @@
+describe Manager::ConfirmationUrlsController, type: :controller do
+ let(:inviter_super_admin) { create(:super_admin) }
+ let(:inviter_administrateur) { create(:administrateur, email: inviter_super_admin.email) }
+
+ let(:invited_super_admin) { create(:super_admin) }
+ let(:invited_administrateur) { create(:administrateur, email: invited_super_admin.email) }
+
+ let(:procedure) { create(:procedure, administrateurs: [inviter_administrateur]) }
+
+ before { sign_in inviter_super_admin }
+
+ describe "#add_administrateur_with_confirmation" do
+ render_views
+
+ let(:params) do
+ {
+ procedure_id: procedure.id,
+ email: invited_administrateur.email
+ }
+ end
+
+ before { get :new, params: params }
+
+ it { expect(response).to render_template(:new) }
+
+ it { expect(response.body).to match(/Veuillez partager ce lien/) }
+
+ it "shows the confirmation url with encrypted parameters" do
+ expect(response.body).to include(
+ new_manager_procedure_administrateur_confirmation_url(
+ procedure,
+ q: encrypt({ email: invited_administrateur.email, inviter_id: inviter_super_admin.id })
+ )
+ )
+ end
+
+ describe 'edge cases' do
+ context 'when the administrateur does not exist' do
+ let(:params) do
+ {
+ procedure_id: procedure.id,
+ email: "wrong@email.com"
+ }
+ end
+
+ it { expect(flash[:alert]).to match(/Cet administrateur n'existe pas/) }
+
+ it { expect(response).to redirect_to(manager_procedure_path(procedure)) }
+ end
+
+ context 'when the administrateur has already been added to the procedure' do
+ let(:params) do
+ {
+ procedure_id: procedure.id,
+ email: inviter_super_admin.email
+ }
+ end
+
+ it { expect(flash[:alert]).to match(/Cet administrateur a déjà été ajouté/) }
+
+ it { expect(response).to redirect_to(manager_procedure_path(procedure)) }
+ end
+ end
+ end
+
+ private
+
+ def encrypt(parameters)
+ key = Rails.application.key_generator.generate_key("confirm_adding_administrateur")
+ verifier = ActiveSupport::MessageVerifier.new(key)
+ Base64.urlsafe_encode64(verifier.generate(parameters))
+ end
+end