move recruiter to admin/candidate

test/controllers/admin/candidate_controller/index_test.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+require 'test_helper'
+
+module Admin
+  class CandidateControllerTest < ActionDispatch::IntegrationTest
+    test "should require auth or redirect" do
+      get admin_candidate_url
+      assert_redirected_to admin_login_url
+
+      get admin_new_candidate_url
+      assert_redirected_to admin_login_url
+
+      post admin_create_candidate_url, params: { candidate: { name: 'foo', email: 'bar', experience: 'baz' } }
+      assert_redirected_to admin_login_url
+    end
+
+    test "should get candidate list" do
+      auth_recruiter
+      get admin_candidate_url
+      assert_response :success
+      assert assigns(:candidates), "@candidates not present"
+    end
+
+    test 'should have edit links' do
+      auth_recruiter
+      get admin_candidate_url
+      assert_response :success
+      assert_select "a[href='#{admin_edit_candidate_path(candidates(:martha))}']"
+    end
+  end
+end

test/controllers/admin/candidate_controller/new_candidate_test.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+require 'test_helper'
+
+module Admin
+  class CandidateControllerTest < ActionDispatch::IntegrationTest
+    include ActiveJob::TestHelper
+
+    test "should get new" do
+      auth_recruiter
+      get admin_new_candidate_url
+      assert_response :success
+      assert assigns(:candidate), "@candidate not present"
+    end
+
+    test "should get create" do
+      auth_recruiter
+      get admin_create_candidate_url
+      assert_response :success
+    end
+
+    test "should create new candidate" do
+      auth_recruiter
+
+      assert_enqueued_jobs 2 do
+        assert_difference("Candidate.count") do
+          post admin_create_candidate_path, params: { candidate:
+            { name: 'new name', email: 'test@mailinator.com', experience: '0-3', quiz_id: quizzes(:fed).id } }
+        end
+      end
+      assert_redirected_to admin_candidate_path
+      assert flash[:success]
+    end
+
+    test "should fail creation with improper email format" do
+      auth_recruiter
+
+      assert_enqueued_jobs 0 do
+        assert_difference("Candidate.count", 0) do
+          post admin_create_candidate_path, params: { candidate:
+            { name: 'new name', email: 'test@mailinatorcom', experience: '0-3', quiz_id: quizzes(:fed).id } }
+        end
+      end
+      assert :success
+      assert assigns(:candidate), "@candidate not present"
+      assert_match(/failed.*save/i, flash[:error])
+    end
+
+    test "should fail creation gracefully with empty email" do
+      auth_recruiter
+
+      assert_enqueued_jobs 0 do
+        assert_difference("Candidate.count", 0) do
+          post admin_create_candidate_path, params: { candidate:
+            { name: 'new name', email: "", experience: '0-3', quiz_id: quizzes(:fed).id } }
+        end
+      end
+      assert :success
+      assert assigns(:candidate), "@candidate not present"
+      assert_match(/failed.*save/i, flash[:error])
+    end
+
+    test 'should queue up a welcome email [resend]' do
+      auth_recruiter
+
+      assert_enqueued_jobs 1 do
+        get admin_resend_welcome_path(id: candidates(:peggy)), xhr: true
+      end
+      assert_response :success
+      data = JSON.parse(response.body)
+      assert_match 'queued', data["message"]
+    end
+  end
+end

test/controllers/admin/candidate_controller/update_candidate_test.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+require 'test_helper'
+
+module Admin
+  class CandidateControllerTest < ActionDispatch::IntegrationTest
+    test 'should edit candidate' do
+      auth_recruiter
+      candidate = candidates(:martha)
+
+      get admin_edit_candidate_path(candidate.id)
+      assert_response :success
+      assert_select 'form'
+    end
+
+    test 'should update candidate, but NOT test_hash' do
+      auth_recruiter
+      candidate = candidates(:martha)
+      post admin_update_candidate_url(id: candidate.id), params:
+             { candidate: { name: 'new name', email: "mail@martha.me", test_hash: 'SOMENEWSTRING' } }
+
+      refute_equal candidate.name, Candidate.find_by(id: candidate.id).name
+      assert_equal candidate.test_hash, Candidate.find_by(id: candidate.id).test_hash
+      assert_redirected_to admin_candidate_url
+    end
+
+    test 'should redirect to form on fail' do
+      auth_recruiter
+      candidate = candidates(:martha)
+      post admin_update_candidate_url(id: candidate.id), params:
+             { candidate: { name: 'new name', email: "mail@martha" } }
+
+      assert :success
+      assert_match(/failed.*save/i, flash[:error])
+    end
+  end
+end

test/controllers/recruiter_controller/index_test.rb

@@ -1,56 +0,0 @@
-# frozen_string_literal: true
-require 'test_helper'
-
-class RecruiterControllerTest < ActionDispatch::IntegrationTest
-  test "should get login" do
-    get recruiter_login_url
-    assert_response :success
-  end
-
-  test 'should logout and reset session' do
-    auth_recruiter
-    get recruiter_logout_path
-
-    assert :success
-    assert session[:user].nil?
-  end
-
-  test "should require auth or redirect" do
-    get recruiter_url
-    assert_redirected_to recruiter_login_path
-
-    get new_candidate_url
-    assert_redirected_to recruiter_login_path
-
-    post create_candidate_url, params: { candidate: { name: 'foo', email: 'bar', experience: 'baz' } }
-    assert_redirected_to recruiter_login_path
-  end
-
-  test "should auth to index" do
-    auth_recruiter
-    assert_redirected_to recruiter_path
-    assert session[:user].present?
-  end
-
-  test "should fail auth with flash" do
-    post recruiter_auth_url, params: { auth:
-        { email: 'pdr.recruiter@mailinator.com', password: 'bad-password' } }
-
-    assert_redirected_to recruiter_login_path
-    assert flash[:error]
-  end
-
-  test "should get candidate list" do
-    auth_recruiter
-    get recruiter_url
-    assert_response :success
-    assert assigns(:candidates), "@candidates not present"
-  end
-
-  test 'should have edit links' do
-    auth_recruiter
-    get recruiter_url
-    assert_response :success
-    assert_select "a[href='#{edit_candidate_path(candidates(:martha))}']"
-  end
-end

test/controllers/recruiter_controller/new_candidate_test.rb

@@ -1,71 +0,0 @@
-# frozen_string_literal: true
-require 'test_helper'
-
-class RecruiterControllerTest < ActionDispatch::IntegrationTest
-  include ActiveJob::TestHelper
-
-  test "should get new" do
-    auth_recruiter
-    get new_candidate_url
-    assert_response :success
-    assert assigns(:candidate), "@candidate not present"
-  end
-
-  test "should get create" do
-    auth_recruiter
-    get create_candidate_url
-    assert_response :success
-  end
-
-  test "should create new candidate" do
-    auth_recruiter
-
-    assert_enqueued_jobs 2 do
-      assert_difference("Candidate.count") do
-        post create_candidate_path, params: { candidate:
-          { name: 'new name', email: 'test@mailinator.com', experience: '0-3', quiz_id: quizzes(:fed).id } }
-      end
-    end
-    assert_redirected_to recruiter_path
-    assert flash[:success]
-  end
-
-  test "should fail creation with improper email format" do
-    auth_recruiter
-
-    assert_enqueued_jobs 0 do
-      assert_difference("Candidate.count", 0) do
-        post create_candidate_path, params: { candidate:
-          { name: 'new name', email: 'test@mailinatorcom', experience: '0-3', quiz_id: quizzes(:fed).id } }
-      end
-    end
-    assert :success
-    assert assigns(:candidate), "@candidate not present"
-    assert_match(/failed.*save/i, flash[:error])
-  end
-
-  test "should fail creation gracefully with empty email" do
-    auth_recruiter
-
-    assert_enqueued_jobs 0 do
-      assert_difference("Candidate.count", 0) do
-        post create_candidate_path, params: { candidate:
-          { name: 'new name', email: "", experience: '0-3', quiz_id: quizzes(:fed).id } }
-      end
-    end
-    assert :success
-    assert assigns(:candidate), "@candidate not present"
-    assert_match(/failed.*save/i, flash[:error])
-  end
-
-  test 'should queue up a welcome email [resend]' do
-    auth_recruiter
-
-    assert_enqueued_jobs 1 do
-      get resend_welcome_path(id: candidates(:peggy)), xhr: true
-    end
-    assert_response :success
-    data = JSON.parse(response.body)
-    assert_match 'queued', data["message"]
-  end
-end

test/controllers/recruiter_controller/update_candidate_test.rb

@@ -1,34 +0,0 @@
-# frozen_string_literal: true
-require 'test_helper'
-
-class RecruiterControllerTest < ActionDispatch::IntegrationTest
-  test 'should edit candidate' do
-    auth_recruiter
-    candidate = candidates(:martha)
-
-    get edit_candidate_path(candidate.id)
-    assert_response :success
-    assert_select 'form'
-  end
-
-  test 'should update candidate, but NOT test_hash' do
-    auth_recruiter
-    candidate = candidates(:martha)
-    post update_candidate_url(id: candidate.id), params:
-           { candidate: { name: 'new name', email: "mail@martha.me", test_hash: 'SOMENEWSTRING' } }
-
-    refute_equal candidate.name, Candidate.find_by(id: candidate.id).name
-    assert_equal candidate.test_hash, Candidate.find_by(id: candidate.id).test_hash
-    assert_redirected_to recruiter_url
-  end
-
-  test 'should redirect to form on fail' do
-    auth_recruiter
-    candidate = candidates(:martha)
-    post update_candidate_url(id: candidate.id), params:
-           { candidate: { name: 'new name', email: "mail@martha" } }
-
-    assert :success
-    assert_match(/failed.*save/i, flash[:error])
-  end
-end

test/controllers/review_controller_test.rb

@@ -17,7 +17,7 @@ class ReviewControllerTest < ActionDispatch::IntegrationTest
 
   test "should auth to index" do
     auth_reviewer
-    assert_redirected_to review_path
+    assert_redirected_to admin_path
     assert session[:user].present?
   end
 

test/policies/candidate_policy_test.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+require 'test_helper'
+
+class CandidatePolicyTest < PolicyAssertions::Test
+  test 'should require current_user' do
+    assert_raise Pundit::NotAuthorizedError do
+      CandidatePolicy.new(nil, Candidate.first).view?
+    end
+  end
+
+  test 'should allow admin to scope' do
+    scope = CandidatePolicy::Scope.new(users(:admin), Candidate).resolve
+    assert_equal Candidate.count, scope.count
+  end
+
+  test 'should allow recruiter to scope' do
+    scope = CandidatePolicy::Scope.new(users(:recruiter), Candidate).resolve
+    assert_equal Candidate.count, scope.count
+  end
+
+  test 'reviewer CAN NOT scope candidates' do
+    assert_raise Pundit::NotAuthorizedError do
+      CandidatePolicy::Scope.new(users(:reviewer), Candidate).resolve
+    end
+  end
+
+  test 'manager CAN NOT scope candidates' do
+    assert_raise Pundit::NotAuthorizedError do
+      CandidatePolicy::Scope.new(users(:manager), Candidate).resolve
+    end
+  end
+
+  def test_view_and_update
+    assert_permit users(:admin), candidates(:roy)
+    assert_permit users(:recruiter), candidates(:roy)
+
+    refute_permit users(:manager), candidates(:roy)
+    refute_permit users(:reviewer), candidates(:roy)
+  end
+
+  def test_create
+    assert_permit users(:admin), Candidate
+    assert_permit users(:recruiter), Candidate
+
+    refute_permit users(:manager), Candidate
+    refute_permit users(:reviewer), Candidate
+  end
+end

test/policies/question_policy_test.rb

@@ -31,7 +31,7 @@ class QuestionPolicyTest < PolicyAssertions::Test
     end
   end
 
-  def test_view
+  def test_view_and_options
     assert_permit users(:admin), questions(:fed1)
     assert_permit users(:manager), questions(:fed1)
     assert_permit users(:reviewer), questions(:fed1)

test/test_helpers/auth_test_helper.rb

@@ -4,13 +4,28 @@ module AuthTestHelper
     post validate_candidate_url, params: { test_id: candidate.test_hash }
   end
 
+  def auth_user user
+    post admin_auth_url, params: { auth:
+        { email: user.email, password: 'password' } }
+  end
+
+  def auth_admin
+    post admin_auth_url, params: { auth:
+        { email: 'alan.admin@mailinator.com', password: 'password' } }
+  end
+
+  def auth_manager
+    post admin_auth_url, params: { auth:
+        { email: 'mary.manager@mailinator.com', password: 'password' } }
+  end
+
   def auth_recruiter
-    post recruiter_auth_url, params: { auth:
+    post admin_auth_url, params: { auth:
         { email: 'pdr.recruiter@mailinator.com', password: 'password' } }
   end
 
   def auth_reviewer
-    post review_auth_url, params: { auth:
+    post admin_auth_url, params: { auth:
         { email: 'fed.reviewer@mailinator.com', password: 'password' } }
   end
 end