Convert admin/roles controller spec to request/sytem specs (#33947)

spec/requests/admin/roles_spec.rb

@@ -3,14 +3,142 @@
 require 'rails_helper'
 
 RSpec.describe 'Admin Roles' do
-  describe 'POST /admin/roles' do
+  context 'when signed in as lower permissions user' do
+    let(:user_role) { Fabricate(:user_role, permissions: UserRole::Flags::NONE) }
+
+    before { sign_in Fabricate(:user, role: user_role) }
+
+    describe 'GET /admin/roles' do
+      it 'returns http forbidden' do
+        get admin_roles_path
+
+        expect(response)
+          .to have_http_status(403)
+      end
+    end
+
+    describe 'GET /admin/roles/new' do
+      it 'returns http forbidden' do
+        get new_admin_role_path
+
+        expect(response)
+          .to have_http_status(403)
+      end
+    end
+
+    describe 'GET /admin/roles/:id/edit' do
+      let(:role) { Fabricate(:user_role) }
+
+      it 'returns http forbidden' do
+        get edit_admin_role_path(role)
+
+        expect(response)
+          .to have_http_status(403)
+      end
+    end
+
+    describe 'PUT /admin/roles/:id' do
+      let(:role) { Fabricate(:user_role) }
+
+      it 'returns http forbidden' do
+        put admin_role_path(role)
+
+        expect(response)
+          .to have_http_status(403)
+      end
+    end
+
+    describe 'DELETE /admin/roles/:id' do
+      let(:role) { Fabricate(:user_role) }
+
+      it 'returns http forbidden' do
+        delete admin_role_path(role)
+
+        expect(response)
+          .to have_http_status(403)
+      end
+    end
+  end
+
+  context 'when user has permissions to manage roles' do
+    let(:user_role) { Fabricate(:user_role, permissions: UserRole::FLAGS[:manage_users]) }
+
+    before { sign_in Fabricate(:user, role: user_role) }
+
+    context 'when target role permission outranks user' do
+      let(:role) { Fabricate(:user_role, position: user_role.position + 1) }
+
+      describe 'GET /admin/roles/:id/edit' do
+        it 'returns http forbidden' do
+          get edit_admin_role_path(role)
+
+          expect(response)
+            .to have_http_status(403)
+        end
+      end
+
+      describe 'PUT /admin/roles/:id' do
+        it 'returns http forbidden' do
+          put admin_role_path(role)
+
+          expect(response)
+            .to have_http_status(403)
+        end
+      end
+
+      describe 'DELETE /admin/roles/:id' do
+        it 'returns http forbidden' do
+          delete admin_role_path(role)
+
+          expect(response)
+            .to have_http_status(403)
+        end
+      end
+    end
+  end
+
+  context 'when attempting to add permissions the user does not have' do
+    let(:user_role) { Fabricate(:user_role, permissions: UserRole::FLAGS[:manage_roles], position: 5) }
+
+    before { sign_in Fabricate(:user, role: user_role) }
+
+    describe 'POST /admin/roles' do
+      subject { post admin_roles_path, params: { user_role: { name: 'Bar', position: 2, permissions_as_keys: %w(manage_roles manage_users manage_reports) } } }
+
+      it 'does not create role' do
+        expect { subject }
+          .to_not change(UserRole, :count)
+
+        expect(response.body)
+          .to include(I18n.t('admin.roles.add_new'))
+      end
+    end
+
+    describe 'PUT /admin/roles/:id' do
+      subject { put admin_role_path(role), params: { user_role: { position: 2, permissions_as_keys: %w(manage_roles manage_users manage_reports) } } }
+
+      let(:role) { Fabricate(:user_role, name: 'Bar') }
+
+      it 'does not create role' do
+        expect { subject }
+          .to_not(change { role.reload.permissions })
+
+        expect(response.parsed_body.title)
+          .to match(I18n.t('admin.roles.edit', name: 'Bar'))
+      end
+    end
+  end
+
+  context 'when signed in as admin' do
     before { sign_in Fabricate(:admin_user) }
 
-    it 'gracefully handles invalid nested params' do
-      post admin_roles_path(user_role: 'invalid')
+    describe 'POST /admin/roles' do
+      it 'gracefully handles invalid nested params' do
+        post admin_roles_path(user_role: 'invalid')
 
-      expect(response)
-        .to have_http_status(400)
+        expect(response)
+          .to have_http_status(400)
+      end
     end
   end
 end