feat(Administrateur::ExportsController#*): prevent SuperAdmin to ask/download export
This commit is contained in:
parent
bfd0f3379f
commit
5e8210b8f8
2 changed files with 20 additions and 1 deletions
|
@ -1,6 +1,7 @@
|
||||||
module Administrateurs
|
module Administrateurs
|
||||||
class ExportsController < AdministrateurController
|
class ExportsController < AdministrateurController
|
||||||
before_action :retrieve_procedure, only: [:download]
|
before_action :retrieve_procedure
|
||||||
|
before_action :ensure_not_super_admin!
|
||||||
|
|
||||||
def download
|
def download
|
||||||
export = Export.find_or_create_export(export_format, all_groupe_instructeurs, **export_options)
|
export = Export.find_or_create_export(export_format, all_groupe_instructeurs, **export_options)
|
||||||
|
|
|
@ -63,5 +63,23 @@ describe Administrateurs::ExportsController, type: :controller do
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
|
context 'when admin is allowed present as manager' do
|
||||||
|
let!(:procedure) { create(:procedure) }
|
||||||
|
let!(:administrateur_procedure) { create(:administrateurs_procedure, procedure: procedure, administrateur: administrateur, manager: true) }
|
||||||
|
|
||||||
|
context 'get #index.html' do
|
||||||
|
it { is_expected.to have_http_status(:forbidden) }
|
||||||
|
end
|
||||||
|
context 'get #index.turbo_stream' do
|
||||||
|
it 'is forbidden' do
|
||||||
|
post :download,
|
||||||
|
params: { export_format: :csv, procedure_id: procedure.id },
|
||||||
|
format: :turbo_stream
|
||||||
|
expect(response).to have_http_status(:forbidden)
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
end
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
Loading…
Reference in a new issue