- <%= link_to "Generate new API key", generate_api_key_path, data: { confirm: "Are you sure? This will invalidate the current API key.", turbo_confirm: "Are you sure?", turbo_method: :post }, class: 'btn btn-primary' %>
+ <%= link_to "Generate new API key", generate_api_key_path, data: { turbo_confirm: "Are you sure? This will invalidate the current API key.", turbo_method: :post }, class: 'btn btn-primary' %>
+ You've been invited by <%= @invitation.invited_by.email %> to join their family.
+ Create your account to accept the invitation and start sharing location data.
+
+
+
+
+ Your email (<%= @invitation.email %>) will be used for this account
+
+
+ <%= t('families.index.have_invitation', default: 'Have an invitation?') %>
+
+
+ <%= t('families.index.invitation_instructions', default: 'If someone has invited you to join their family, you should have received an email with an invitation link.') %>
+
+
+ <%= t('families.index.invitation_help', default: 'Check your email for an invitation link that looks like: ') %>
+
+ <%= "#{request.base_url}/invitations/..." %>
+
+
+
+
+
\ No newline at end of file
diff --git a/app/views/families/new.html.erb b/app/views/families/new.html.erb
new file mode 100644
index 00000000..c9350dfd
--- /dev/null
+++ b/app/views/families/new.html.erb
@@ -0,0 +1,66 @@
+
+
+
+
+ <%= t('families.new.title', default: 'Create Your Family') %>
+
+
+ <%= t('families.new.description', default: 'Create a family to share your location data with your loved ones.') %>
+
+
+
+
+ <%= form_with url: family_path, model: @family, local: true, class: "space-y-6" do |form| %>
+ <% if @family.errors.any? %>
+
+
+
+ <%= t('families.new.error_title', default: 'There were problems with your submission:') %>
+
+
+
+ <% @family.errors.full_messages.each do |message| %>
+
+ <%= t('families.new.name_help', default: 'Choose a name that all family members will recognize, like "The Smith Family" or "Our Travel Group".') %>
+
+ Your family has reached the maximum of <%= @family.class::MAX_MEMBERS %> members (including pending invitations).
+ Cancel existing invitations or wait for them to expire to invite new members.
+
+
+
+
+
+ <% end %>
+
+
+
diff --git a/app/views/family/invitations/index.html.erb b/app/views/family/invitations/index.html.erb
new file mode 100644
index 00000000..b0af0893
--- /dev/null
+++ b/app/views/family/invitations/index.html.erb
@@ -0,0 +1,68 @@
+
\ No newline at end of file
diff --git a/app/views/family/invitations/show.html.erb b/app/views/family/invitations/show.html.erb
new file mode 100644
index 00000000..414c9f29
--- /dev/null
+++ b/app/views/family/invitations/show.html.erb
@@ -0,0 +1,164 @@
+
+ You've been invited by <%= @invitation.invited_by.email %> to join their family. Create your account to accept the invitation and start sharing location data.
+
+
+
+ <%= icon 'info', class: "h-5 w-5 shrink-0" %>
+
+ Your email (<%= @invitation.email %>) will be used for this account
+
+
+ ⏰ Important: This invitation will expire in 7 days.
+
+
+
+
+ If you don't have a Dawarich account yet, you'll be able to create one when you accept the invitation.
+
+
+
+ If you didn't expect this invitation, you can safely ignore this email.
+
+
+
+
+
+ Best regards,
+ Evgenii from Dawarich
+
+
+
diff --git a/app/views/family_mailer/invitation.text.erb b/app/views/family_mailer/invitation.text.erb
new file mode 100644
index 00000000..cd9b266c
--- /dev/null
+++ b/app/views/family_mailer/invitation.text.erb
@@ -0,0 +1,22 @@
+You've been invited to join a family!
+
+Hi there!
+
+<%= @invited_by.email %> has invited you to join their family "<%= @family.name %>" on Dawarich.
+
+By joining this family, you'll be able to:
+• Share your current location with family members
+• See the current location of other family members
+• Stay connected with your loved ones
+• Control your privacy with full sharing controls
+
+Accept your invitation here: <%= @accept_url %>
+
+IMPORTANT: This invitation will expire in 7 days.
+
+If you don't have a Dawarich account yet, you'll be able to create one when you accept the invitation.
+
+If you didn't expect this invitation, you can safely ignore this email.
+
+Best regards,
+Evgenii from Dawarich
diff --git a/app/views/family_mailer/member_joined.html.erb b/app/views/family_mailer/member_joined.html.erb
new file mode 100644
index 00000000..f2429b92
--- /dev/null
+++ b/app/views/family_mailer/member_joined.html.erb
@@ -0,0 +1,39 @@
+
+
+
🎉 Great news! Someone joined your family!
+
+
Hi <%= @family.owner.email %>!
+
+
+ We're excited to let you know that <%= @user.email %> has just joined your family
+ "<%= @family.name %>" on Dawarich!
+
+
+
+
Now you can:
+
+
See <%= @user.email %>'s current location (if they've enabled sharing)
+
Stay connected with your growing family
+
Share your location with <%= @user.email %>
+
Manage family members and settings from your family page
+
+
+
+
+
+ 💡 Tip: You can manage your family members and privacy settings at any time from your family dashboard.
+
+
+
+
+ Your family now has <%= @family.member_count %> member<%= @family.member_count == 1 ? '' : 's' %>.
+
+
+
+
+
+ Best regards,
+ Evgenii from Dawarich
+
+
+
diff --git a/app/views/family_mailer/member_joined.text.erb b/app/views/family_mailer/member_joined.text.erb
new file mode 100644
index 00000000..ba840d38
--- /dev/null
+++ b/app/views/family_mailer/member_joined.text.erb
@@ -0,0 +1,18 @@
+Great news! Someone joined your family!
+
+Hi <%= @family.owner.email %>!
+
+We're excited to let you know that <%= @user.email %> has just joined your family "<%= @family.name %>" on Dawarich!
+
+Now you can:
+• See <%= @user.email %>'s current location (if they've enabled sharing)
+• Stay connected with your growing family
+• Share your location with <%= @user.email %>
+• Manage family members and settings from your family page
+
+TIP: You can manage your family members and privacy settings at any time from your family dashboard.
+
+Your family now has <%= @family.member_count %> member<%= @family.member_count == 1 ? '' : 's' %>.
+
+Best regards,
+Evgenii from Dawarich
diff --git a/app/views/imports/index.html.erb b/app/views/imports/index.html.erb
index cfcf0bef..8cf60feb 100644
--- a/app/views/imports/index.html.erb
+++ b/app/views/imports/index.html.erb
@@ -6,12 +6,12 @@
<%= link_to "New import", new_import_path, class: "rounded-lg py-3 px-5 bg-blue-600 text-white block font-medium" %>
<% if current_user.safe_settings.immich_url && current_user.safe_settings.immich_api_key %>
- <%= link_to 'Import Immich data', settings_background_jobs_path(job_name: 'start_immich_import'), method: :post, data: { confirm: 'Are you sure?', turbo_confirm: 'Are you sure?', turbo_method: :post }, class: 'rounded-lg py-3 px-5 bg-blue-600 text-white block font-medium' %>
+ <%= link_to 'Import Immich data', settings_background_jobs_path(job_name: 'start_immich_import'), method: :post, data: { turbo_confirm: 'Are you sure?', turbo_method: :post }, class: 'rounded-lg py-3 px-5 bg-blue-600 text-white block font-medium' %>
<% else %>
Import Immich data
<% end %>
<% if current_user.safe_settings.photoprism_url && current_user.safe_settings.photoprism_api_key %>
- <%= link_to 'Import Photoprism data', settings_background_jobs_path(job_name: 'start_photoprism_import'), method: :post, data: { confirm: 'Are you sure?', turbo_confirm: 'Are you sure?', turbo_method: :post }, class: 'rounded-lg py-3 px-5 bg-blue-600 text-white block font-medium' %>
+ <%= link_to 'Import Photoprism data', settings_background_jobs_path(job_name: 'start_photoprism_import'), method: :post, data: { turbo_confirm: 'Are you sure?', turbo_method: :post }, class: 'rounded-lg py-3 px-5 bg-blue-600 text-white block font-medium' %>
<% else %>
Import Photoprism data
<% end %>
@@ -75,7 +75,7 @@
<% if import.file.present? %>
<%= link_to 'Download', rails_blob_path(import.file, disposition: 'attachment'), class: "btn btn-outline btn-sm btn-info", download: import.name %>
<% end %>
- <%= link_to 'Delete', import, data: { confirm: "Are you sure?", turbo_confirm: "Are you sure?", turbo_method: :delete }, method: :delete, class: "btn btn-outline btn-sm btn-error" %>
+ <%= link_to 'Delete', import, data: { turbo_confirm: "Are you sure?", turbo_method: :delete }, method: :delete, class: "btn btn-outline btn-sm btn-error" %>
<% end %>
diff --git a/app/views/imports/show.html.erb b/app/views/imports/show.html.erb
index 41fe784c..c92eeb2e 100644
--- a/app/views/imports/show.html.erb
+++ b/app/views/imports/show.html.erb
@@ -10,7 +10,7 @@
<%= link_to "Edit this import", edit_import_path(@import), class: "mt-2 rounded-lg py-3 px-5 bg-secondary-content inline-block font-medium" %>
- <%= link_to "Destroy this import", import_path(@import), data: { confirm: "Are you sure?", turbo_confirm: "Are you sure? This action will delete all points imported with this file", turbo_method: :delete }, method: :delete, class: "mt-2 rounded-lg py-3 px-5 bg-secondary-content font-medium" %>
+ <%= link_to "Destroy this import", import_path(@import), data: { turbo_confirm: "Are you sure? This action will delete all points imported with this file", turbo_method: :delete }, method: :delete, class: "mt-2 rounded-lg py-3 px-5 bg-secondary-content font-medium" %>
- <%= link_to 'Delete', place, data: { confirm: "Are you sure? Deleting a place will result in deleting all visits for this place.", turbo_confirm: "Are you sure? Deleting a place will result in deleting all visits for this place.", turbo_method: :delete }, method: :delete, class: "px-4 py-2 bg-red-500 text-white rounded-md" %>
+ <%= link_to 'Delete', place, data: { turbo_confirm: "Are you sure? Deleting a place will result in deleting all visits for this place.", turbo_method: :delete }, method: :delete, class: "px-4 py-2 bg-red-500 text-white rounded-md" %>
<% end %>
diff --git a/app/views/points/index.html.erb b/app/views/points/index.html.erb
index 098d9860..66c1bf0b 100644
--- a/app/views/points/index.html.erb
+++ b/app/views/points/index.html.erb
@@ -28,12 +28,12 @@
- <%= link_to 'Export as GeoJSON', exports_path(start_at: @start_at, end_at: @end_at, file_format: :json), data: { confirm: "Are you sure?", turbo_confirm: "Are you sure? This will start background process of exporting points within timeframe, selected between #{@start_at} and #{@end_at}", turbo_method: :post }, class: "btn border border-base-300 hover:btn-ghost" %>
+ <%= link_to 'Export as GeoJSON', exports_path(start_at: @start_at, end_at: @end_at, file_format: :json), data: { turbo_confirm: "Are you sure? This will start background process of exporting points within timeframe, selected between #{@start_at} and #{@end_at}", turbo_method: :post }, class: "btn border border-base-300 hover:btn-ghost" %>
- <%= link_to 'Export as GPX', exports_path(start_at: @start_at, end_at: @end_at, file_format: :gpx), data: { confirm: "Are you sure?", turbo_confirm: "Are you sure? This will start background process of exporting points within timeframe, selected between #{@start_at} and #{@end_at}", turbo_method: :post }, class: "btn border border-base-300 hover:btn-ghost" %>
+ <%= link_to 'Export as GPX', exports_path(start_at: @start_at, end_at: @end_at, file_format: :gpx), data: { turbo_confirm: "Are you sure? This will start background process of exporting points within timeframe, selected between #{@start_at} and #{@end_at}", turbo_method: :post }, class: "btn border border-base-300 hover:btn-ghost" %>
This job will re-run reverse geocoding process for all the points in your database. Might take a few days or even weeks based on the amount of points you have!
Enable or disable visits suggestions. It's a background task that runs every day at midnight. Disabling it might be useful if you don't want to receive visits suggestions or if you're using the Dawarich iOS app, which has its own visits suggestions.
diff --git a/config/importmap.rb b/config/importmap.rb
index badf814e..53ca7e84 100644
--- a/config/importmap.rb
+++ b/config/importmap.rb
@@ -23,5 +23,6 @@ pin 'leaflet-draw' # @1.0.4
pin 'notifications_channel', to: 'channels/notifications_channel.js'
pin 'points_channel', to: 'channels/points_channel.js'
pin 'imports_channel', to: 'channels/imports_channel.js'
+pin 'family_locations_channel', to: 'channels/family_locations_channel.js'
pin 'trix'
pin '@rails/actiontext', to: 'actiontext.esm.js'
diff --git a/config/initializers/03_dawarich_settings.rb b/config/initializers/03_dawarich_settings.rb
index 08cb0785..89a49267 100644
--- a/config/initializers/03_dawarich_settings.rb
+++ b/config/initializers/03_dawarich_settings.rb
@@ -39,9 +39,14 @@ class DawarichSettings
@store_geodata ||= STORE_GEODATA
end
+ def family_feature_enabled?
+ @family_feature_enabled ||= self_hosted?
+ end
+
def features
@features ||= {
- reverse_geocoding: reverse_geocoding_enabled?
+ reverse_geocoding: reverse_geocoding_enabled?,
+ family: family_feature_enabled?
}
end
end
diff --git a/config/routes.rb b/config/routes.rb
index bc73947c..d34aa775 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -56,6 +56,20 @@ Rails.application.routes.draw do
resources :places, only: %i[index destroy]
resources :exports, only: %i[index create destroy]
resources :trips
+
+ # Family management routes (only if feature is enabled)
+ if DawarichSettings.family_feature_enabled?
+ resource :family, only: %i[show new create edit update destroy] do
+ patch :update_location_sharing, on: :member
+
+ resources :invitations, except: %i[edit update], controller: 'family/invitations'
+ resources :members, only: %i[destroy], controller: 'family/memberships'
+ end
+
+ get 'invitations/:token', to: 'family/invitations#show', as: :public_invitation
+ post 'family/memberships', to: 'family/memberships#create', as: :accept_family_invitation
+ end
+
resources :points, only: %i[index] do
collection do
delete :bulk_destroy
@@ -87,15 +101,10 @@ Rails.application.routes.draw do
get 'auth/ios/success', to: 'auth/ios#success', as: :ios_success
- if SELF_HOSTED
- devise_for :users, skip: [:registrations]
- as :user do
- get 'users/edit' => 'devise/registrations#edit', :as => 'edit_user_registration'
- put 'users' => 'devise/registrations#update', :as => 'user_registration'
- end
- else
- devise_for :users
- end
+ devise_for :users, controllers: {
+ registrations: 'users/registrations',
+ sessions: 'users/sessions'
+ }
resources :metrics, only: [:index]
@@ -157,6 +166,12 @@ Rails.application.routes.draw do
end
end
+ resources :families, only: [] do
+ collection do
+ get :locations
+ end
+ end
+
post 'subscriptions/callback', to: 'subscriptions#callback'
end
end
diff --git a/config/schedule.yml b/config/schedule.yml
index cb0c94e7..ae920927 100644
--- a/config/schedule.yml
+++ b/config/schedule.yml
@@ -44,3 +44,8 @@ nightly_reverse_geocoding_job:
cron: "15 1 * * *" # every day at 01:15
class: "Points::NightlyReverseGeocodingJob"
queue: reverse_geocoding
+
+nightly_family_invitations_cleanup_job:
+ cron: "30 2 * * *" # every day at 02:30
+ class: "Family::Invitations::CleanupJob"
+ queue: family
diff --git a/config/sidekiq.yml b/config/sidekiq.yml
index 780bbc1c..5f2e133e 100644
--- a/config/sidekiq.yml
+++ b/config/sidekiq.yml
@@ -5,6 +5,7 @@
- points
- default
- mailers
+ - families
- imports
- exports
- stats
diff --git a/db/migrate/20250926220114_create_families.rb b/db/migrate/20250926220114_create_families.rb
new file mode 100644
index 00000000..cbaeaf25
--- /dev/null
+++ b/db/migrate/20250926220114_create_families.rb
@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+class CreateFamilies < ActiveRecord::Migration[8.0]
+ def change
+ create_table :families do |t|
+ t.string :name, null: false, limit: 50
+ t.bigint :creator_id, null: false
+ t.timestamps
+ end
+
+ add_foreign_key :families, :users, column: :creator_id, validate: false
+ add_index :families, :creator_id
+ end
+end
diff --git a/db/migrate/20250926220135_create_family_memberships.rb b/db/migrate/20250926220135_create_family_memberships.rb
new file mode 100644
index 00000000..fa8e051a
--- /dev/null
+++ b/db/migrate/20250926220135_create_family_memberships.rb
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+class CreateFamilyMemberships < ActiveRecord::Migration[8.0]
+ def change
+ create_table :family_memberships do |t|
+ t.bigint :family_id, null: false
+ t.bigint :user_id, null: false
+ t.integer :role, null: false, default: 1 # member
+ t.timestamps
+ end
+
+ add_foreign_key :family_memberships, :families, validate: false
+ add_foreign_key :family_memberships, :users, validate: false
+ add_index :family_memberships, :user_id, unique: true # One family per user
+ add_index :family_memberships, %i[family_id role], name: 'index_family_memberships_on_family_and_role'
+ end
+end
diff --git a/db/migrate/20250926220158_create_family_invitations.rb b/db/migrate/20250926220158_create_family_invitations.rb
new file mode 100644
index 00000000..be841652
--- /dev/null
+++ b/db/migrate/20250926220158_create_family_invitations.rb
@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+class CreateFamilyInvitations < ActiveRecord::Migration[8.0]
+ def change
+ create_table :family_invitations do |t|
+ t.bigint :family_id, null: false
+ t.string :email, null: false
+ t.string :token, null: false
+ t.datetime :expires_at, null: false
+ t.bigint :invited_by_id, null: false
+ t.integer :status, null: false, default: 0 # pending
+ t.timestamps
+ end
+
+ add_foreign_key :family_invitations, :families, validate: false
+ add_foreign_key :family_invitations, :users, column: :invited_by_id, validate: false
+ add_index :family_invitations, :token, unique: true
+ add_index :family_invitations, %i[family_id email], name: 'index_family_invitations_on_family_id_and_email'
+ add_index :family_invitations, %i[family_id status expires_at],
+ name: 'index_family_invitations_on_family_status_expires'
+ add_index :family_invitations, %i[status expires_at],
+ name: 'index_family_invitations_on_status_and_expires_at'
+ add_index :family_invitations, %i[status updated_at],
+ name: 'index_family_invitations_on_status_and_updated_at'
+ end
+end
diff --git a/db/migrate/20250926220345_validate_family_foreign_keys.rb b/db/migrate/20250926220345_validate_family_foreign_keys.rb
new file mode 100644
index 00000000..45461b79
--- /dev/null
+++ b/db/migrate/20250926220345_validate_family_foreign_keys.rb
@@ -0,0 +1,9 @@
+class ValidateFamilyForeignKeys < ActiveRecord::Migration[8.0]
+ def change
+ validate_foreign_key :families, :users
+ validate_foreign_key :family_memberships, :families
+ validate_foreign_key :family_memberships, :users
+ validate_foreign_key :family_invitations, :families
+ validate_foreign_key :family_invitations, :users
+ end
+end
diff --git a/db/schema.rb b/db/schema.rb
index d097aca9..c0f8d0cd 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -10,7 +10,7 @@
#
# It's strongly recommended that you check this file into your version control system.
-ActiveRecord::Schema[8.0].define(version: 2025_09_18_215512) do
+ActiveRecord::Schema[8.0].define(version: 2025_09_30_150256) do
# These are extensions that must be enabled in order to support this database
enable_extension "pg_catalog.plpgsql"
enable_extension "postgis"
@@ -96,6 +96,41 @@ ActiveRecord::Schema[8.0].define(version: 2025_09_18_215512) do
t.index ["user_id"], name: "index_exports_on_user_id"
end
+ create_table "families", force: :cascade do |t|
+ t.string "name", limit: 50, null: false
+ t.bigint "creator_id", null: false
+ t.datetime "created_at", null: false
+ t.datetime "updated_at", null: false
+ t.index ["creator_id"], name: "index_families_on_creator_id"
+ end
+
+ create_table "family_invitations", force: :cascade do |t|
+ t.bigint "family_id", null: false
+ t.string "email", null: false
+ t.string "token", null: false
+ t.datetime "expires_at", null: false
+ t.bigint "invited_by_id", null: false
+ t.integer "status", default: 0, null: false
+ t.datetime "created_at", null: false
+ t.datetime "updated_at", null: false
+ t.index ["email"], name: "index_family_invitations_on_email"
+ t.index ["expires_at"], name: "index_family_invitations_on_expires_at"
+ t.index ["family_id"], name: "index_family_invitations_on_family_id"
+ t.index ["status"], name: "index_family_invitations_on_status"
+ t.index ["token"], name: "index_family_invitations_on_token", unique: true
+ end
+
+ create_table "family_memberships", force: :cascade do |t|
+ t.bigint "family_id", null: false
+ t.bigint "user_id", null: false
+ t.integer "role", default: 1, null: false
+ t.datetime "created_at", null: false
+ t.datetime "updated_at", null: false
+ t.index ["family_id", "role"], name: "index_family_memberships_on_family_id_and_role"
+ t.index ["family_id"], name: "index_family_memberships_on_family_id"
+ t.index ["user_id"], name: "index_family_memberships_on_user_id", unique: true
+ end
+
create_table "imports", force: :cascade do |t|
t.string "name", null: false
t.bigint "user_id", null: false
@@ -307,6 +342,11 @@ ActiveRecord::Schema[8.0].define(version: 2025_09_18_215512) do
add_foreign_key "active_storage_attachments", "active_storage_blobs", column: "blob_id"
add_foreign_key "active_storage_variant_records", "active_storage_blobs", column: "blob_id"
add_foreign_key "areas", "users"
+ add_foreign_key "families", "users", column: "creator_id", validate: false
+ add_foreign_key "family_invitations", "families", validate: false
+ add_foreign_key "family_invitations", "users", column: "invited_by_id", validate: false
+ add_foreign_key "family_memberships", "families", validate: false
+ add_foreign_key "family_memberships", "users", validate: false
add_foreign_key "notifications", "users"
add_foreign_key "place_visits", "places"
add_foreign_key "place_visits", "visits"
diff --git a/e2e/map.spec.js b/e2e/map.spec.js
index 03fb59d2..1aac2601 100644
--- a/e2e/map.spec.js
+++ b/e2e/map.spec.js
@@ -525,7 +525,7 @@ test.describe('Map Functionality', () => {
// Verify it's actually a clickable button with gear icon
const buttonText = await settingsButton.textContent();
- expect(buttonText).toBe('⚙️');
+ expect(buttonText).toBe('');
// Test opening settings panel
await settingsButton.click();
diff --git a/spec/factories/families.rb b/spec/factories/families.rb
new file mode 100644
index 00000000..9958a049
--- /dev/null
+++ b/spec/factories/families.rb
@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+ factory :family do
+ sequence(:name) { |n| "Test Family #{n}" }
+ association :creator, factory: :user
+ end
+end
diff --git a/spec/factories/family_invitations.rb b/spec/factories/family_invitations.rb
new file mode 100644
index 00000000..41e71969
--- /dev/null
+++ b/spec/factories/family_invitations.rb
@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+ factory :family_invitation, class: 'Family::Invitation' do
+ association :family
+ association :invited_by, factory: :user
+ sequence(:email) { |n| "invite#{n}@example.com" }
+ token { SecureRandom.urlsafe_base64(32) }
+ expires_at { 7.days.from_now }
+ status { :pending }
+
+ trait :accepted do
+ status { :accepted }
+ end
+
+ trait :expired do
+ status { :expired }
+ expires_at { 1.day.ago }
+ end
+
+ trait :cancelled do
+ status { :cancelled }
+ end
+
+ trait :with_expired_date do
+ expires_at { 1.day.ago }
+ end
+ end
+end
diff --git a/spec/factories/family_memberships.rb b/spec/factories/family_memberships.rb
new file mode 100644
index 00000000..0796c9af
--- /dev/null
+++ b/spec/factories/family_memberships.rb
@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+ factory :family_membership, class: 'Family::Membership' do
+ association :family
+ association :user
+ role { :member }
+
+ trait :owner do
+ role { :owner }
+ end
+ end
+end
diff --git a/spec/models/family/invitation_spec.rb b/spec/models/family/invitation_spec.rb
new file mode 100644
index 00000000..2abd5db4
--- /dev/null
+++ b/spec/models/family/invitation_spec.rb
@@ -0,0 +1,177 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe Family::Invitation, type: :model do
+ describe 'associations' do
+ it { is_expected.to belong_to(:family) }
+ it { is_expected.to belong_to(:invited_by).class_name('User') }
+ end
+
+ describe 'validations' do
+ subject { build(:family_invitation) }
+
+ it { is_expected.to validate_presence_of(:email) }
+ it { is_expected.to allow_value('test@example.com').for(:email) }
+ it { is_expected.not_to allow_value('invalid-email').for(:email) }
+ it { is_expected.to validate_uniqueness_of(:token) }
+ it { is_expected.to validate_presence_of(:status) }
+
+ it 'validates token presence after creation' do
+ invitation = build(:family_invitation, token: nil)
+ invitation.save
+ expect(invitation.token).to be_present
+ end
+
+ it 'validates expires_at presence after creation' do
+ invitation = build(:family_invitation, expires_at: nil)
+ invitation.save
+ expect(invitation.expires_at).to be_present
+ end
+ end
+
+ describe 'enums' do
+ it { is_expected.to define_enum_for(:status).with_values(pending: 0, accepted: 1, expired: 2, cancelled: 3) }
+ end
+
+ describe 'scopes' do
+ let(:family) { create(:family) }
+ let(:pending_invitation) do
+ create(:family_invitation, family: family, status: :pending, expires_at: 1.day.from_now)
+ end
+ let(:expired_invitation) { create(:family_invitation, family: family, status: :pending, expires_at: 1.day.ago) }
+ let(:accepted_invitation) { create(:family_invitation, :accepted, family: family) }
+
+ describe '.active' do
+ it 'returns only pending and non-expired invitations' do
+ expect(Family::Invitation.active).to include(pending_invitation)
+ expect(Family::Invitation.active).not_to include(expired_invitation)
+ expect(Family::Invitation.active).not_to include(accepted_invitation)
+ end
+ end
+ end
+
+ describe 'callbacks' do
+ describe 'before_validation on create' do
+ let(:invitation) { build(:family_invitation, token: nil, expires_at: nil) }
+
+ it 'generates a token' do
+ invitation.save
+ expect(invitation.token).to be_present
+ expect(invitation.token.length).to be > 20
+ end
+
+ it 'sets expiry date' do
+ invitation.save
+ expect(invitation.expires_at).to be_within(1.minute).of(Family::Invitation::EXPIRY_DAYS.days.from_now)
+ end
+
+ it 'does not override existing token' do
+ custom_token = 'custom-token'
+ invitation.token = custom_token
+ invitation.save
+ expect(invitation.token).to eq(custom_token)
+ end
+
+ it 'does not override existing expiry date' do
+ custom_expiry = 3.days.from_now
+ invitation.expires_at = custom_expiry
+ invitation.save
+ expect(invitation.expires_at).to be_within(1.second).of(custom_expiry)
+ end
+ end
+ end
+
+ describe '#expired?' do
+ context 'when expires_at is in the future' do
+ let(:invitation) { create(:family_invitation, expires_at: 1.day.from_now) }
+
+ it 'returns false' do
+ expect(invitation.expired?).to be false
+ end
+ end
+
+ context 'when expires_at is in the past' do
+ let(:invitation) { create(:family_invitation, expires_at: 1.day.ago) }
+
+ it 'returns true' do
+ expect(invitation.expired?).to be true
+ end
+ end
+ end
+
+ describe '#can_be_accepted?' do
+ context 'when invitation is pending and not expired' do
+ let(:invitation) { create(:family_invitation, status: :pending, expires_at: 1.day.from_now) }
+
+ it 'returns true' do
+ expect(invitation.can_be_accepted?).to be true
+ end
+ end
+
+ context 'when invitation is pending but expired' do
+ let(:invitation) { create(:family_invitation, status: :pending, expires_at: 1.day.ago) }
+
+ it 'returns false' do
+ expect(invitation.can_be_accepted?).to be false
+ end
+ end
+
+ context 'when invitation is accepted' do
+ let(:invitation) { create(:family_invitation, :accepted, expires_at: 1.day.from_now) }
+
+ it 'returns false' do
+ expect(invitation.can_be_accepted?).to be false
+ end
+ end
+
+ context 'when invitation is cancelled' do
+ let(:invitation) { create(:family_invitation, :cancelled, expires_at: 1.day.from_now) }
+
+ it 'returns false' do
+ expect(invitation.can_be_accepted?).to be false
+ end
+ end
+ end
+
+ describe 'constants' do
+ it 'defines EXPIRY_DAYS' do
+ expect(Family::Invitation::EXPIRY_DAYS).to eq(7)
+ end
+ end
+
+ describe 'token uniqueness' do
+ let(:family) { create(:family) }
+ let(:user) { create(:user) }
+
+ it 'ensures each invitation has a unique token' do
+ invitation1 = create(:family_invitation, family: family, invited_by: user)
+ invitation2 = create(:family_invitation, family: family, invited_by: user)
+
+ expect(invitation1.token).not_to eq(invitation2.token)
+ end
+ end
+
+ describe 'email format validation' do
+ let(:invitation) { build(:family_invitation) }
+
+ it 'accepts valid email formats' do
+ valid_emails = ['test@example.com', 'user.name@domain.co.uk', 'user+tag@example.org']
+
+ valid_emails.each do |email|
+ invitation.email = email
+ expect(invitation).to be_valid
+ end
+ end
+
+ it 'rejects invalid email formats' do
+ invalid_emails = ['invalid-email', '@example.com', 'user@', 'user space@example.com']
+
+ invalid_emails.each do |email|
+ invitation.email = email
+ expect(invitation).not_to be_valid
+ expect(invitation.errors[:email]).to be_present
+ end
+ end
+ end
+end
diff --git a/spec/models/family/membership_spec.rb b/spec/models/family/membership_spec.rb
new file mode 100644
index 00000000..0cc859e7
--- /dev/null
+++ b/spec/models/family/membership_spec.rb
@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe Family::Membership, type: :model do
+ describe 'associations' do
+ it { is_expected.to belong_to(:family) }
+ it { is_expected.to belong_to(:user) }
+ end
+
+ describe 'validations' do
+ subject { build(:family_membership) }
+
+ it { is_expected.to validate_presence_of(:user_id) }
+ it { is_expected.to validate_uniqueness_of(:user_id) }
+ it { is_expected.to validate_presence_of(:role) }
+ end
+
+ describe 'enums' do
+ it { is_expected.to define_enum_for(:role).with_values(owner: 0, member: 1) }
+ end
+
+ describe 'one family per user constraint' do
+ let(:user) { create(:user) }
+ let(:family1) { create(:family) }
+ let(:family2) { create(:family) }
+
+ it 'allows a user to be in one family' do
+ membership1 = build(:family_membership, family: family1, user: user)
+ expect(membership1).to be_valid
+ end
+
+ it 'prevents a user from being in multiple families' do
+ create(:family_membership, family: family1, user: user)
+ membership2 = build(:family_membership, family: family2, user: user)
+
+ expect(membership2).not_to be_valid
+ expect(membership2.errors[:user_id]).to include('has already been taken')
+ end
+ end
+
+ describe 'role assignment' do
+ let(:family) { create(:family) }
+
+ context 'when created as owner' do
+ let(:membership) { create(:family_membership, :owner, family: family) }
+
+ it 'can be created' do
+ expect(membership.role).to eq('owner')
+ expect(membership.owner?).to be true
+ end
+ end
+
+ context 'when created as member' do
+ let(:membership) { create(:family_membership, family: family, role: :member) }
+
+ it 'can be created' do
+ expect(membership.role).to eq('member')
+ expect(membership.member?).to be true
+ end
+ end
+
+ it 'defaults to member role' do
+ membership = create(:family_membership, family: family)
+ expect(membership.role).to eq('member')
+ end
+ end
+end
diff --git a/spec/models/family_spec.rb b/spec/models/family_spec.rb
new file mode 100644
index 00000000..7f81b898
--- /dev/null
+++ b/spec/models/family_spec.rb
@@ -0,0 +1,125 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe Family, type: :model do
+ let(:user) { create(:user) }
+
+ describe 'associations' do
+ it { is_expected.to have_many(:family_memberships).dependent(:destroy) }
+ it { is_expected.to have_many(:members).through(:family_memberships).source(:user) }
+ it { is_expected.to have_many(:family_invitations).dependent(:destroy) }
+ it { is_expected.to belong_to(:creator).class_name('User') }
+ end
+
+ describe 'validations' do
+ it { is_expected.to validate_presence_of(:name) }
+ it { is_expected.to validate_length_of(:name).is_at_most(50) }
+ end
+
+ describe 'constants' do
+ it 'defines MAX_MEMBERS' do
+ expect(Family::MAX_MEMBERS).to eq(5)
+ end
+ end
+
+ describe '#can_add_members?' do
+ let(:family) { create(:family, creator: user) }
+
+ context 'when family has fewer than max members' do
+ before do
+ create(:family_membership, family: family, user: user, role: :owner)
+ create_list(:family_membership, 3, family: family, role: :member)
+ end
+
+ it 'returns true' do
+ expect(family.can_add_members?).to be true
+ end
+ end
+
+ context 'when family has max members' do
+ before do
+ create(:family_membership, family: family, user: user, role: :owner)
+ create_list(:family_membership, 4, family: family, role: :member)
+ end
+
+ it 'returns false' do
+ expect(family.can_add_members?).to be false
+ end
+ end
+
+ context 'when family has no members' do
+ it 'returns true' do
+ expect(family.can_add_members?).to be true
+ end
+ end
+ end
+
+ describe 'family creation' do
+ let(:family) { Family.new(name: 'Test Family', creator: user) }
+
+ it 'can be created with valid attributes' do
+ expect(family).to be_valid
+ end
+
+ it 'requires a name' do
+ family.name = nil
+
+ expect(family).not_to be_valid
+ expect(family.errors[:name]).to include("can't be blank")
+ end
+
+ it 'requires a creator' do
+ family.creator = nil
+
+ expect(family).not_to be_valid
+ end
+
+ it 'rejects names longer than 50 characters' do
+ long_name = 'a' * 51
+ family.name = long_name
+
+ expect(family).not_to be_valid
+ expect(family.errors[:name]).to include('is too long (maximum is 50 characters)')
+ end
+ end
+
+ describe 'members association' do
+ let(:family) { create(:family, creator: user) }
+ let(:member1) { create(:user) }
+ let(:member2) { create(:user) }
+
+ before do
+ create(:family_membership, family: family, user: user, role: :owner)
+ create(:family_membership, family: family, user: member1, role: :member)
+ create(:family_membership, family: family, user: member2, role: :member)
+ end
+
+ it 'includes all family members' do
+ expect(family.members).to include(user, member1, member2)
+ expect(family.members.count).to eq(3)
+ end
+ end
+
+ describe 'family invitations association' do
+ let(:family) { create(:family, creator: user) }
+
+ it 'destroys associated invitations when family is destroyed' do
+ invitation = create(:family_invitation, family: family, invited_by: user)
+
+ expect { family.destroy }.to change(Family::Invitation, :count).by(-1)
+ expect(Family::Invitation.find_by(id: invitation.id)).to be_nil
+ end
+ end
+
+ describe 'family memberships association' do
+ let(:family) { create(:family, creator: user) }
+
+ it 'destroys associated memberships when family is destroyed' do
+ membership = create(:family_membership, family: family, user: user, role: :owner)
+
+ expect { family.destroy }.to change(Family::Membership, :count).by(-1)
+ expect(Family::Membership.find_by(id: membership.id)).to be_nil
+ end
+ end
+end
diff --git a/spec/models/user_family_spec.rb b/spec/models/user_family_spec.rb
new file mode 100644
index 00000000..0a0d2879
--- /dev/null
+++ b/spec/models/user_family_spec.rb
@@ -0,0 +1,136 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe User, 'family methods', type: :model do
+ let(:user) { create(:user) }
+
+ describe 'family associations' do
+ it { is_expected.to have_one(:family_membership).dependent(:destroy) }
+ it { is_expected.to have_one(:family).through(:family_membership) }
+ it {
+ is_expected.to have_one(:created_family).class_name('Family').with_foreign_key('creator_id').dependent(:destroy)
+ }
+ it {
+ is_expected.to have_many(:sent_family_invitations).class_name('Family::Invitation').with_foreign_key('invited_by_id').dependent(:destroy)
+ }
+ end
+
+ describe '#in_family?' do
+ context 'when user has no family membership' do
+ it 'returns false' do
+ expect(user.in_family?).to be false
+ end
+ end
+
+ context 'when user has family membership' do
+ let(:family) { create(:family, creator: user) }
+
+ before do
+ create(:family_membership, user: user, family: family)
+ end
+
+ it 'returns true' do
+ expect(user.in_family?).to be true
+ end
+ end
+ end
+
+ describe '#family_owner?' do
+ let(:family) { create(:family, creator: user) }
+
+ context 'when user is family owner' do
+ before do
+ create(:family_membership, user: user, family: family, role: :owner)
+ end
+
+ it 'returns true' do
+ expect(user.family_owner?).to be true
+ end
+ end
+
+ context 'when user is family member' do
+ before do
+ create(:family_membership, user: user, family: family, role: :member)
+ end
+
+ it 'returns false' do
+ expect(user.family_owner?).to be false
+ end
+ end
+
+ context 'when user has no family membership' do
+ it 'returns false' do
+ expect(user.family_owner?).to be false
+ end
+ end
+ end
+
+ describe '#can_delete_account?' do
+ context 'when user is not a family owner' do
+ it 'returns true' do
+ expect(user.can_delete_account?).to be true
+ end
+ end
+
+ context 'when user is family owner with only themselves as member' do
+ let(:family) { create(:family, creator: user) }
+
+ before do
+ create(:family_membership, user: user, family: family, role: :owner)
+ end
+
+ it 'returns true' do
+ expect(user.can_delete_account?).to be true
+ end
+ end
+
+ context 'when user is family owner with other members' do
+ let(:family) { create(:family, creator: user) }
+ let(:other_user) { create(:user) }
+
+ before do
+ create(:family_membership, user: user, family: family, role: :owner)
+ create(:family_membership, user: other_user, family: family, role: :member)
+ end
+
+ it 'returns false' do
+ expect(user.can_delete_account?).to be false
+ end
+ end
+ end
+
+ describe 'dependent destroy behavior' do
+ let(:family) { create(:family, creator: user) }
+
+ context 'when user has created families' do
+ it 'prevents deletion when family has members' do
+ other_user = create(:user)
+ create(:family_membership, user: user, family: family, role: :owner)
+ create(:family_membership, user: other_user, family: family, role: :member)
+
+ expect(user.can_delete_account?).to be false
+ end
+ end
+
+ context 'when user has sent invitations' do
+ before do
+ create(:family_invitation, family: family, invited_by: user)
+ end
+
+ it 'destroys associated invitations when user is destroyed' do
+ expect { user.destroy }.to change(Family::Invitation, :count).by(-1)
+ end
+ end
+
+ context 'when user has family membership' do
+ before do
+ create(:family_membership, user: user, family: family)
+ end
+
+ it 'destroys associated membership when user is destroyed' do
+ expect { user.destroy }.to change(Family::Membership, :count).by(-1)
+ end
+ end
+ end
+end
diff --git a/spec/policies/family/invitation_policy_spec.rb b/spec/policies/family/invitation_policy_spec.rb
new file mode 100644
index 00000000..0478c645
--- /dev/null
+++ b/spec/policies/family/invitation_policy_spec.rb
@@ -0,0 +1,238 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe Family::InvitationPolicy, type: :policy do
+ let(:family) { create(:family) }
+ let(:owner) { family.creator }
+ let(:member) { create(:user) }
+ let(:other_user) { create(:user) }
+ let(:invitation) { create(:family_invitation, family: family, invited_by: owner) }
+
+ before do
+ create(:family_membership, family: family, user: owner, role: :owner)
+ create(:family_membership, family: family, user: member, role: :member)
+ end
+
+ describe '#create?' do
+ context 'when user is family owner' do
+ before do
+ allow(owner).to receive(:family).and_return(family)
+ allow(owner).to receive(:family_owner?).and_return(true)
+ end
+
+ it 'allows family owner to create invitations' do
+ policy = described_class.new(owner, invitation)
+
+ expect(policy).to permit(:create)
+ end
+ end
+
+ context 'when user is regular family member' do
+ before do
+ allow(member).to receive(:family).and_return(family)
+ allow(member).to receive(:family_owner?).and_return(false)
+ end
+
+ it 'denies regular family member from creating invitations' do
+ policy = described_class.new(member, invitation)
+
+ expect(policy).not_to permit(:create)
+ end
+ end
+
+ context 'when user is not in the family' do
+ it 'denies user not in the family from creating invitations' do
+ policy = described_class.new(other_user, invitation)
+
+ expect(policy).not_to permit(:create)
+ end
+ end
+
+ context 'with unauthenticated user' do
+ it 'denies unauthenticated user from creating invitations' do
+ policy = described_class.new(nil, invitation)
+
+ expect(policy).not_to permit(:create)
+ end
+ end
+ end
+
+ describe '#accept?' do
+ context 'when user email matches invitation email' do
+ let(:invited_user) { create(:user, email: invitation.email) }
+
+ it 'allows user to accept invitation sent to their email' do
+ policy = described_class.new(invited_user, invitation)
+
+ expect(policy).to permit(:accept)
+ end
+ end
+
+ context 'when user email does not match invitation email' do
+ it 'denies user with different email from accepting invitation' do
+ policy = described_class.new(other_user, invitation)
+
+ expect(policy).not_to permit(:accept)
+ end
+ end
+
+ context 'when family owner tries to accept invitation' do
+ it 'denies family owner from accepting invitation sent to different email' do
+ policy = described_class.new(owner, invitation)
+
+ expect(policy).not_to permit(:accept)
+ end
+ end
+
+ context 'with unauthenticated user' do
+ it 'denies unauthenticated user from accepting invitation' do
+ policy = described_class.new(nil, invitation)
+
+ expect(policy).not_to permit(:accept)
+ end
+ end
+ end
+
+ describe '#destroy?' do
+ context 'when user is family owner' do
+ before do
+ allow(owner).to receive(:family).and_return(family)
+ allow(owner).to receive(:family_owner?).and_return(true)
+ end
+
+ it 'allows family owner to cancel invitations' do
+ policy = described_class.new(owner, invitation)
+
+ expect(policy).to permit(:destroy)
+ end
+ end
+
+ context 'when user is regular family member' do
+ before do
+ allow(member).to receive(:family).and_return(family)
+ allow(member).to receive(:family_owner?).and_return(false)
+ end
+
+ it 'denies regular family member from cancelling invitations' do
+ policy = described_class.new(member, invitation)
+
+ expect(policy).not_to permit(:destroy)
+ end
+ end
+
+ context 'when user is not in the family' do
+ it 'denies user not in the family from cancelling invitations' do
+ policy = described_class.new(other_user, invitation)
+
+ expect(policy).not_to permit(:destroy)
+ end
+ end
+
+ context 'with unauthenticated user' do
+ it 'denies unauthenticated user from cancelling invitations' do
+ policy = described_class.new(nil, invitation)
+
+ expect(policy).not_to permit(:destroy)
+ end
+ end
+ end
+
+ describe 'edge cases' do
+ context 'when invitation belongs to different family' do
+ let(:other_family) { create(:family) }
+ let(:other_family_owner) { other_family.creator }
+ let(:other_invitation) { create(:family_invitation, family: other_family, invited_by: other_family_owner) }
+
+ before do
+ create(:family_membership, family: other_family, user: other_family_owner, role: :owner)
+ allow(owner).to receive(:family).and_return(family)
+ allow(owner).to receive(:family_owner?).and_return(true)
+ end
+
+ it 'denies owner from creating invitations for different family' do
+ policy = described_class.new(owner, other_invitation)
+
+ expect(policy).not_to permit(:create)
+ end
+
+ it 'denies owner from destroying invitations for different family' do
+ policy = described_class.new(owner, other_invitation)
+
+ expect(policy).not_to permit(:destroy)
+ end
+ end
+
+ context 'with expired invitation' do
+ let(:expired_invitation) { create(:family_invitation, :expired, family: family, invited_by: owner) }
+ let(:invited_user) { create(:user, email: expired_invitation.email) }
+
+ it 'still allows user to attempt to accept expired invitation (business logic handles expiry)' do
+ policy = described_class.new(invited_user, expired_invitation)
+
+ expect(policy).to permit(:accept)
+ end
+
+ it 'allows owner to destroy expired invitation' do
+ allow(owner).to receive(:family).and_return(family)
+ allow(owner).to receive(:family_owner?).and_return(true)
+ policy = described_class.new(owner, expired_invitation)
+
+ expect(policy).to permit(:destroy)
+ end
+ end
+
+ context 'with accepted invitation' do
+ let(:accepted_invitation) { create(:family_invitation, :accepted, family: family, invited_by: owner) }
+
+ it 'allows owner to destroy accepted invitation' do
+ allow(owner).to receive(:family).and_return(family)
+ allow(owner).to receive(:family_owner?).and_return(true)
+ policy = described_class.new(owner, accepted_invitation)
+
+ expect(policy).to permit(:destroy)
+ end
+ end
+
+ context 'with cancelled invitation' do
+ let(:cancelled_invitation) { create(:family_invitation, :cancelled, family: family, invited_by: owner) }
+
+ it 'allows owner to destroy cancelled invitation' do
+ allow(owner).to receive(:family).and_return(family)
+ allow(owner).to receive(:family_owner?).and_return(true)
+ policy = described_class.new(owner, cancelled_invitation)
+
+ expect(policy).to permit(:destroy)
+ end
+ end
+ end
+
+ describe 'authorization consistency' do
+ it 'ensures owner can both create and destroy invitations' do
+ allow(owner).to receive(:family).and_return(family)
+ allow(owner).to receive(:family_owner?).and_return(true)
+ policy = described_class.new(owner, invitation)
+
+ expect(policy).to permit(:create)
+ expect(policy).to permit(:destroy)
+ end
+
+ it 'ensures regular members cannot create or destroy invitations' do
+ allow(member).to receive(:family).and_return(family)
+ allow(member).to receive(:family_owner?).and_return(false)
+ policy = described_class.new(member, invitation)
+
+ expect(policy).not_to permit(:create)
+ expect(policy).not_to permit(:destroy)
+ end
+
+ it 'ensures invited users can only accept their own invitations' do
+ invited_user = create(:user, email: invitation.email)
+ policy = described_class.new(invited_user, invitation)
+
+ expect(policy).to permit(:accept)
+ expect(policy).not_to permit(:create)
+ expect(policy).not_to permit(:destroy)
+ end
+ end
+end
diff --git a/spec/policies/family/membership_policy_spec.rb b/spec/policies/family/membership_policy_spec.rb
new file mode 100644
index 00000000..b720149a
--- /dev/null
+++ b/spec/policies/family/membership_policy_spec.rb
@@ -0,0 +1,205 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe Family::MembershipPolicy, type: :policy do
+ let(:family) { create(:family) }
+ let(:owner) { family.creator }
+ let(:member) { create(:user) }
+ let(:another_member) { create(:user) }
+ let(:other_user) { create(:user) }
+
+ let(:owner_membership) { create(:family_membership, :owner, family: family, user: owner) }
+ let(:member_membership) { create(:family_membership, family: family, user: member) }
+ let(:another_member_membership) { create(:family_membership, family: family, user: another_member) }
+
+ describe '#create?' do
+ let(:valid_invitation) { create(:family_invitation, family: family, email: member.email) }
+ let(:expired_invitation) { create(:family_invitation, family: family, email: member.email, expires_at: 1.day.ago) }
+ let(:accepted_invitation) { create(:family_invitation, :accepted, family: family, email: member.email) }
+ let(:wrong_email_invitation) { create(:family_invitation, family: family, email: 'wrong@example.com') }
+
+ context 'when user has valid invitation' do
+ it 'allows user to create membership with valid pending invitation for their email' do
+ policy = described_class.new(member, valid_invitation)
+
+ expect(policy).to permit(:create)
+ end
+ end
+
+ context 'when invitation is expired' do
+ it 'denies user from creating membership with expired invitation' do
+ policy = described_class.new(member, expired_invitation)
+
+ expect(policy).not_to permit(:create)
+ end
+ end
+
+ context 'when invitation is already accepted' do
+ it 'denies user from creating membership with already accepted invitation' do
+ policy = described_class.new(member, accepted_invitation)
+
+ expect(policy).not_to permit(:create)
+ end
+ end
+
+ context 'when invitation is for different email' do
+ it 'denies user from creating membership with invitation for different email' do
+ policy = described_class.new(member, wrong_email_invitation)
+
+ expect(policy).not_to permit(:create)
+ end
+ end
+
+ context 'with unauthenticated user' do
+ it 'denies unauthenticated user from creating membership' do
+ policy = described_class.new(nil, valid_invitation)
+
+ expect(policy).not_to permit(:create)
+ end
+ end
+ end
+
+ describe '#destroy?' do
+ context 'when user is removing themselves' do
+ it 'allows user to remove their own membership (leave family)' do
+ allow(member).to receive(:family).and_return(family)
+ policy = described_class.new(member, member_membership)
+
+ expect(policy).to permit(:destroy)
+ end
+
+ it 'allows owner to remove their own membership' do
+ allow(owner).to receive(:family).and_return(family)
+ policy = described_class.new(owner, owner_membership)
+
+ expect(policy).to permit(:destroy)
+ end
+ end
+
+ context 'when user is family owner' do
+ before do
+ allow(owner).to receive(:family).and_return(family)
+ allow(owner).to receive(:family_owner?).and_return(true)
+ end
+
+ it 'allows family owner to remove other members' do
+ policy = described_class.new(owner, member_membership)
+
+ expect(policy).to permit(:destroy)
+ end
+
+ it 'allows family owner to remove multiple members' do
+ policy1 = described_class.new(owner, member_membership)
+ policy2 = described_class.new(owner, another_member_membership)
+
+ expect(policy1).to permit(:destroy)
+ expect(policy2).to permit(:destroy)
+ end
+ end
+
+ context 'when user is regular family member' do
+ before do
+ allow(member).to receive(:family).and_return(family)
+ allow(member).to receive(:family_owner?).and_return(false)
+ end
+
+ it 'denies regular member from removing other members' do
+ policy = described_class.new(member, another_member_membership)
+
+ expect(policy).not_to permit(:destroy)
+ end
+
+ it 'denies regular member from removing owner' do
+ policy = described_class.new(member, owner_membership)
+
+ expect(policy).not_to permit(:destroy)
+ end
+ end
+
+ context 'when user is not in the family' do
+ it 'denies user from removing membership of different family' do
+ policy = described_class.new(other_user, member_membership)
+
+ expect(policy).not_to permit(:destroy)
+ end
+ end
+
+ context 'with unauthenticated user' do
+ it 'denies unauthenticated user from removing membership' do
+ policy = described_class.new(nil, member_membership)
+
+ expect(policy).not_to permit(:destroy)
+ end
+ end
+ end
+
+ describe 'edge cases' do
+ context 'when membership belongs to different family' do
+ let(:other_family) { create(:family) }
+ let(:other_family_owner) { other_family.creator }
+ let(:other_family_membership) do
+ create(:family_membership, :owner, family: other_family, user: other_family_owner)
+ end
+
+ before do
+ allow(owner).to receive(:family).and_return(family)
+ allow(owner).to receive(:family_owner?).and_return(true)
+ end
+
+ it 'denies owner from destroying membership of different family' do
+ policy = described_class.new(owner, other_family_membership)
+
+ expect(policy).not_to permit(:destroy)
+ end
+ end
+
+ context 'when owner tries to modify another owners membership' do
+ let(:co_owner) { create(:user) }
+ let(:co_owner_membership) { create(:family_membership, :owner, family: family, user: co_owner) }
+
+ before do
+ allow(owner).to receive(:family).and_return(family)
+ allow(owner).to receive(:family_owner?).and_return(true)
+ end
+
+ it 'allows owner to remove another owner (family owner has full control)' do
+ policy = described_class.new(owner, co_owner_membership)
+
+ expect(policy).to permit(:destroy)
+ end
+ end
+ end
+
+ describe 'authorization consistency' do
+ it 'ensures owner can destroy all memberships in their family' do
+ allow(owner).to receive(:family).and_return(family)
+ allow(owner).to receive(:family_owner?).and_return(true)
+
+ policy = described_class.new(owner, member_membership)
+
+ expect(policy).to permit(:destroy)
+ end
+
+ it 'ensures regular members can only remove their own membership' do
+ allow(member).to receive(:family).and_return(family)
+ allow(member).to receive(:family_owner?).and_return(false)
+
+ own_policy = described_class.new(member, member_membership)
+ other_policy = described_class.new(member, another_member_membership)
+
+ # Can remove own membership
+ expect(own_policy).to permit(:destroy)
+
+ # Cannot remove others
+ expect(other_policy).not_to permit(:destroy)
+ end
+
+ it 'ensures users can always leave the family (remove own membership)' do
+ allow(member).to receive(:family).and_return(family)
+ policy = described_class.new(member, member_membership)
+
+ expect(policy).to permit(:destroy)
+ end
+ end
+end
diff --git a/spec/requests/authentication_spec.rb b/spec/requests/authentication_spec.rb
index 621a86cc..75620f5c 100644
--- a/spec/requests/authentication_spec.rb
+++ b/spec/requests/authentication_spec.rb
@@ -166,4 +166,79 @@ RSpec.describe 'Authentication', type: :request do
expect(response.location).not_to include('auth/ios/success')
end
end
+
+ describe 'Family Invitation with Authentication' do
+ let(:family) { create(:family, creator: user) }
+ let!(:membership) { create(:family_membership, user: user, family: family, role: :owner) }
+ let(:invitee) { create(:user, email: 'invitee@example.com', password: 'password123') }
+ let(:invitation) { create(:family_invitation, family: family, invited_by: user, email: invitee.email) }
+
+ it 'redirects to invitation page when signing in with invitation token in params' do
+ post user_session_path, params: {
+ user: { email: invitee.email, password: 'password123' },
+ invitation_token: invitation.token
+ }
+
+ expect(response).to redirect_to(family_invitation_path(invitation.token))
+ end
+
+ it 'redirects to invitation page when signing in with invitation token in session' do
+ # The invitation token is stored in session by Users::SessionsController#load_invitation_context
+ # when accessing the sign-in page with invitation_token param
+ get new_user_session_path, params: { invitation_token: invitation.token }
+
+ # Then sign in without the invitation_token in params (should use session value)
+ post user_session_path, params: {
+ user: { email: invitee.email, password: 'password123' }
+ }
+
+ expect(response).to redirect_to(family_invitation_path(invitation.token))
+ end
+
+ it 'prioritizes invitation over iOS flow when both are present' do
+ # Sign in with both iOS header AND invitation token
+ post user_session_path, params: {
+ user: { email: invitee.email, password: 'password123' },
+ invitation_token: invitation.token
+ }, headers: {
+ 'X-Dawarich-Client' => 'ios'
+ }
+
+ # Should redirect to invitation page, NOT iOS success
+ expect(response).to redirect_to(family_invitation_path(invitation.token))
+ expect(response.location).not_to include('auth/ios/success')
+ end
+
+ it 'redirects to iOS success when invitation is expired' do
+ # Create an expired invitation
+ expired_invitation = create(:family_invitation,
+ family: family,
+ invited_by: user,
+ email: invitee.email,
+ expires_at: 1.day.ago)
+
+ # Sign in with iOS header and expired invitation token
+ post user_session_path, params: {
+ user: { email: invitee.email, password: 'password123' },
+ invitation_token: expired_invitation.token
+ }, headers: {
+ 'X-Dawarich-Client' => 'ios'
+ }
+
+ # Should redirect to iOS success since invitation can't be accepted
+ expect(response).to redirect_to(%r{auth/ios/success\?token=})
+ end
+
+ it 'uses default path when invitation token is invalid' do
+ # Sign in with invalid invitation token
+ post user_session_path, params: {
+ user: { email: invitee.email, password: 'password123' },
+ invitation_token: 'invalid-token-123'
+ }
+
+ # Should use default redirect path
+ expect(response).not_to redirect_to(%r{/invitations/})
+ expect(response).to redirect_to(root_path)
+ end
+ end
end
diff --git a/spec/requests/families_spec.rb b/spec/requests/families_spec.rb
new file mode 100644
index 00000000..5bc4e826
--- /dev/null
+++ b/spec/requests/families_spec.rb
@@ -0,0 +1,252 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Family', type: :request do
+ let(:user) { create(:user) }
+ let(:other_user) { create(:user) }
+ let(:family) { create(:family, creator: user) }
+ let!(:membership) { create(:family_membership, user: user, family: family, role: :owner) }
+
+ before do
+ stub_request(:any, 'https://api.github.com/repos/Freika/dawarich/tags')
+ .to_return(status: 200, body: '[{"name": "1.0.0"}]', headers: {})
+ sign_in user
+ end
+
+ describe 'GET /family' do
+ it 'shows the family page' do
+ get "/family"
+ expect(response).to have_http_status(:ok)
+ end
+
+ context 'when user is not in the family' do
+ let(:outsider) { create(:user) }
+
+ before { sign_in outsider }
+
+ it 'redirects to new family path' do
+ get "/family"
+ expect(response).to redirect_to(new_family_path)
+ end
+ end
+ end
+
+ describe 'GET /family/new' do
+ context 'when user is not in a family' do
+ let(:user_without_family) { create(:user) }
+
+ before { sign_in user_without_family }
+
+ it 'renders the new family form' do
+ get '/family/new'
+ expect(response).to have_http_status(:ok)
+ end
+ end
+
+ context 'when user is already in a family' do
+ it 'redirects to family show page' do
+ get '/family/new'
+ expect(response).to redirect_to(family_path)
+ end
+ end
+ end
+
+ describe 'POST /family' do
+ let(:user_without_family) { create(:user) }
+
+ before { sign_in user_without_family }
+
+ context 'with valid attributes' do
+ let(:valid_attributes) { { family: { name: 'Test Family' } } }
+
+ it 'creates a new family' do
+ expect do
+ post '/family', params: valid_attributes
+ end.to change(Family, :count).by(1)
+ end
+
+ it 'creates a family membership for the user' do
+ expect do
+ post '/family', params: valid_attributes
+ end.to change(Family::Membership, :count).by(1)
+ end
+
+ it 'redirects to the new family with success message' do
+ post '/family', params: valid_attributes
+
+ expect(response).to have_http_status(:found)
+ expect(response.location).to eq family_url
+ follow_redirect!
+ expect(response.body).to include('Family created successfully!')
+ end
+ end
+
+ context 'with invalid attributes' do
+ let(:invalid_attributes) { { family: { name: '' } } }
+
+ it 'does not create a family' do
+ expect do
+ post '/family', params: invalid_attributes
+ end.not_to change(Family, :count)
+ end
+
+ it 'renders the new template with errors' do
+ post '/family', params: invalid_attributes
+ expect(response).to have_http_status(:unprocessable_content)
+ end
+ end
+ end
+
+ describe 'GET /family/edit' do
+ it 'shows the edit form' do
+ get "/family/edit"
+ expect(response).to have_http_status(:ok)
+ end
+
+ context 'when user is not the owner' do
+ before { membership.update!(role: :member) }
+
+ it 'redirects due to authorization failure' do
+ get "/family/edit"
+ expect(response).to have_http_status(:see_other)
+ expect(flash[:alert]).to include('not authorized')
+ end
+ end
+ end
+
+ describe 'PATCH /family' do
+ let(:new_attributes) { { family: { name: 'Updated Family Name' } } }
+
+ context 'with valid attributes' do
+ it 'updates the family' do
+ patch "/family", params: new_attributes
+ family.reload
+ expect(family.name).to eq('Updated Family Name')
+ expect(response).to redirect_to(family_path)
+ end
+ end
+
+ context 'with invalid attributes' do
+ let(:invalid_attributes) { { family: { name: '' } } }
+
+ it 'does not update the family' do
+ original_name = family.name
+ patch "/family", params: invalid_attributes
+ family.reload
+ expect(family.name).to eq(original_name)
+ expect(response).to have_http_status(:unprocessable_content)
+ end
+ end
+
+ context 'when user is not the owner' do
+ before { membership.update!(role: :member) }
+
+ it 'redirects due to authorization failure' do
+ patch "/family", params: new_attributes
+ expect(response).to have_http_status(:see_other)
+ expect(flash[:alert]).to include('not authorized')
+ end
+ end
+ end
+
+ describe 'DELETE /family' do
+ context 'when family has only one member' do
+ it 'deletes the family' do
+ expect { delete '/family' }.to change(Family, :count).by(-1)
+ expect(response).to redirect_to(new_family_path)
+ end
+ end
+
+ context 'when family has multiple members' do
+ before do
+ create(:family_membership, user: other_user, family: family, role: :member)
+ end
+
+ it 'does not delete the family' do
+ expect { delete "/family" }.not_to change(Family, :count)
+ expect(response).to redirect_to(family_path)
+ follow_redirect!
+ expect(response.body).to include('Cannot delete family with members')
+ end
+ end
+
+ context 'when user is not the owner' do
+ before { membership.update!(role: :member) }
+
+ it 'redirects due to authorization failure' do
+ delete "/family"
+ expect(response).to have_http_status(:see_other)
+ expect(flash[:alert]).to include('not authorized')
+ end
+ end
+ end
+
+
+ describe 'authorization for outsiders' do
+ let(:outsider) { create(:user) }
+
+ before { sign_in outsider }
+
+ it 'denies access to show when user is not in family' do
+ get "/family"
+ expect(response).to redirect_to(new_family_path)
+ end
+
+ it 'redirects to family page when user is not in family for edit' do
+ get "/family/edit"
+ expect(response).to redirect_to(new_family_path)
+ end
+
+ it 'redirects to family page when user is not in family for update' do
+ patch "/family", params: { family: { name: 'Hacked' } }
+ expect(response).to redirect_to(new_family_path)
+ end
+
+ it 'redirects to family page when user is not in family for destroy' do
+ delete "/family"
+ expect(response).to redirect_to(new_family_path)
+ end
+
+ end
+
+ describe 'authentication required' do
+ before { sign_out user }
+
+ it 'redirects to login for index' do
+ get '/family'
+ expect(response).to redirect_to(new_user_session_path)
+ end
+
+ it 'redirects to login for show' do
+ get "/family"
+ expect(response).to redirect_to(new_user_session_path)
+ end
+
+ it 'redirects to login for new' do
+ get '/family/new'
+
+ expect(response).to redirect_to(new_user_session_path)
+ end
+
+ it 'redirects to login for create' do
+ post '/family', params: { family: { name: 'Test' } }
+ expect(response).to redirect_to(new_user_session_path)
+ end
+
+ it 'redirects to login for edit' do
+ get "/family/edit"
+ expect(response).to redirect_to(new_user_session_path)
+ end
+
+ it 'redirects to login for update' do
+ patch "/family", params: { family: { name: 'Test' } }
+ expect(response).to redirect_to(new_user_session_path)
+ end
+
+ it 'redirects to login for destroy' do
+ delete "/family"
+ expect(response).to redirect_to(new_user_session_path)
+ end
+ end
+end
diff --git a/spec/requests/family/invitations_spec.rb b/spec/requests/family/invitations_spec.rb
new file mode 100644
index 00000000..b75d501e
--- /dev/null
+++ b/spec/requests/family/invitations_spec.rb
@@ -0,0 +1,240 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Family::Invitations', type: :request do
+ let(:user) { create(:user) }
+ let(:family) { create(:family, creator: user) }
+ let!(:membership) { create(:family_membership, user: user, family: family, role: :owner) }
+ let(:invitation) { create(:family_invitation, family: family, invited_by: user) }
+
+ before do
+ stub_request(:any, 'https://api.github.com/repos/Freika/dawarich/tags')
+ .to_return(status: 200, body: '[{"name": "1.0.0"}]', headers: {})
+ end
+
+ describe 'GET /family/invitations' do
+ before { sign_in user }
+
+ it 'shows pending invitations' do
+ invitation # create the invitation
+ get "/family/invitations"
+ expect(response).to have_http_status(:ok)
+ end
+
+ context 'when user is not in the family' do
+ let(:outsider) { create(:user) }
+
+ before { sign_in outsider }
+
+ it 'redirects to families index' do
+ get "/family/invitations"
+ expect(response).to redirect_to(new_family_path)
+ end
+ end
+
+ context 'when not authenticated' do
+ before { sign_out user }
+
+ it 'redirects to login' do
+ get "/family/invitations"
+ expect(response).to redirect_to(new_user_session_path)
+ end
+ end
+ end
+
+ describe 'GET /invitations/:token (public invitation view)' do
+ context 'when invitation is valid and pending' do
+ it 'shows the invitation without authentication' do
+ get "/invitations/#{invitation.token}"
+ expect(response).to have_http_status(:ok)
+ end
+ end
+
+ context 'when invitation is expired' do
+ before { invitation.update!(expires_at: 1.day.ago) }
+
+ it 'redirects with error message' do
+ get "/invitations/#{invitation.token}"
+ expect(response).to redirect_to(root_path)
+ follow_redirect!
+ expect(response.body).to include('This invitation has expired')
+ end
+ end
+
+ context 'when invitation is not pending' do
+ before { invitation.update!(status: :accepted) }
+
+ it 'redirects with error message' do
+ get "/invitations/#{invitation.token}"
+ expect(response).to redirect_to(root_path)
+ follow_redirect!
+ expect(response.body).to include('This invitation is no longer valid')
+ end
+ end
+
+ context 'when invitation does not exist' do
+ it 'returns not found' do
+ get '/invitations/invalid-token'
+ expect(response).to have_http_status(:not_found)
+ end
+ end
+ end
+
+ describe 'POST /family/invitations' do
+ before { sign_in user }
+
+ context 'with valid email' do
+ let(:valid_params) do
+ { family_invitation: { email: 'newuser@example.com' } }
+ end
+
+ it 'creates a new invitation' do
+ expect do
+ post "/family/invitations", params: valid_params
+ end.to change(Family::Invitation, :count).by(1)
+ end
+
+ it 'redirects with success message' do
+ post "/family/invitations", params: valid_params
+ expect(response).to redirect_to(family_path)
+ follow_redirect!
+ expect(response.body).to include('Invitation sent successfully!')
+ end
+ end
+
+ context 'with duplicate email' do
+ let(:duplicate_params) do
+ { family_invitation: { email: invitation.email } }
+ end
+
+ it 'does not create a duplicate invitation' do
+ invitation # create the existing invitation
+ expect do
+ post "/family/invitations", params: duplicate_params
+ end.not_to change(Family::Invitation, :count)
+ end
+
+ it 'redirects with error message' do
+ invitation # create the existing invitation
+ post "/family/invitations", params: duplicate_params
+ expect(response).to redirect_to(family_path)
+ follow_redirect!
+ expect(response.body).to include('Invitation already sent to this email')
+ end
+ end
+
+ context 'when user is not the owner' do
+ before { membership.update!(role: :member) }
+
+ it 'redirects due to authorization failure' do
+ post "/family/invitations", params: {
+ family_invitation: { email: 'test@example.com' }
+ }
+ expect(response).to have_http_status(:see_other)
+ expect(flash[:alert]).to include('not authorized')
+ end
+ end
+
+ context 'when user is not in the family' do
+ let(:outsider) { create(:user) }
+
+ before { sign_in outsider }
+
+ it 'redirects to families index' do
+ post "/family/invitations", params: {
+ family_invitation: { email: 'test@example.com' }
+ }
+ expect(response).to redirect_to(new_family_path)
+ end
+ end
+
+ context 'when not authenticated' do
+ before { sign_out user }
+
+ it 'redirects to login' do
+ post "/family/invitations", params: {
+ family_invitation: { email: 'test@example.com' }
+ }
+ expect(response).to redirect_to(new_user_session_path)
+ end
+ end
+ end
+
+ describe 'DELETE /family/invitations/:id' do
+ before { sign_in user }
+
+ it 'cancels the invitation' do
+ delete "/family/invitations/#{invitation.token}"
+ invitation.reload
+ expect(invitation.status).to eq('cancelled')
+ end
+
+ it 'redirects with success message' do
+ delete "/family/invitations/#{invitation.token}"
+ expect(response).to redirect_to(family_path)
+ follow_redirect!
+ expect(response.body).to include('Invitation cancelled')
+ end
+
+ context 'when user is not the owner' do
+ before { membership.update!(role: :member) }
+
+ it 'redirects due to authorization failure' do
+ delete "/family/invitations/#{invitation.token}"
+ expect(response).to have_http_status(:see_other)
+ expect(flash[:alert]).to include('not authorized')
+ end
+ end
+
+ context 'when user is not in the family' do
+ let(:outsider) { create(:user) }
+
+ before { sign_in outsider }
+
+ it 'redirects to families index' do
+ delete "/family/invitations/#{invitation.token}"
+ expect(response).to redirect_to(new_family_path)
+ end
+ end
+
+ context 'when not authenticated' do
+ before { sign_out user }
+
+ it 'redirects to login' do
+ delete "/family/invitations/#{invitation.token}"
+ expect(response).to redirect_to(new_user_session_path)
+ end
+ end
+ end
+
+ describe 'invitation workflow integration' do
+ let(:invitee) { create(:user) }
+
+ it 'completes full invitation acceptance workflow' do
+ # 1. Owner creates invitation
+ sign_in user
+ post "/family/invitations", params: {
+ family_invitation: { email: invitee.email }
+ }
+ expect(response).to redirect_to(family_path)
+
+ created_invitation = Family::Invitation.last
+ expect(created_invitation.email).to eq(invitee.email)
+
+ # 2. Invitee views public invitation page
+ sign_out user
+ get "/invitations/#{created_invitation.token}"
+ expect(response).to have_http_status(:ok)
+
+ # 3. Invitee accepts invitation
+ sign_in invitee
+ post accept_family_invitation_path(token: created_invitation.token)
+ expect(response).to redirect_to(family_path)
+
+ # 4. Verify invitee is now in family
+ expect(invitee.reload.family).to eq(family)
+ expect(created_invitation.reload.status).to eq('accepted')
+ end
+ end
+end
diff --git a/spec/requests/family/memberships_spec.rb b/spec/requests/family/memberships_spec.rb
new file mode 100644
index 00000000..5efde1ba
--- /dev/null
+++ b/spec/requests/family/memberships_spec.rb
@@ -0,0 +1,248 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Family::Memberships', type: :request do
+ let(:user) { create(:user) }
+ let(:family) { create(:family, creator: user) }
+ let!(:owner_membership) { create(:family_membership, user: user, family: family, role: :owner) }
+ let(:member_user) { create(:user) }
+ let!(:member_membership) { create(:family_membership, user: member_user, family: family, role: :member) }
+
+ before do
+ stub_request(:any, 'https://api.github.com/repos/Freika/dawarich/tags')
+ .to_return(status: 200, body: '[{"name": "1.0.0"}]', headers: {})
+ sign_in user
+ end
+
+ describe 'POST /family/memberships' do
+ let(:invitee) { create(:user) }
+ let(:invitee_invitation) { create(:family_invitation, family: family, invited_by: user, email: invitee.email) }
+
+ context 'with valid invitation and user' do
+ before { sign_in invitee }
+
+ it 'accepts the invitation' do
+ expect do
+ post accept_family_invitation_path(token: invitee_invitation.token)
+ end.to change { invitee.reload.family }.from(nil).to(family)
+ end
+
+ it 'redirects with success message' do
+ post accept_family_invitation_path(token: invitee_invitation.token)
+ expect(response).to redirect_to(family_path)
+ follow_redirect!
+ expect(response.body).to include('Welcome to the family!')
+ end
+
+ it 'marks invitation as accepted' do
+ post accept_family_invitation_path(token: invitee_invitation.token)
+ invitee_invitation.reload
+ expect(invitee_invitation.status).to eq('accepted')
+ end
+ end
+
+ context 'when user is already in a family' do
+ let(:other_family) { create(:family) }
+
+ before do
+ create(:family_membership, user: invitee, family: other_family, role: :member)
+ sign_in invitee
+ end
+
+ it 'does not accept the invitation' do
+ expect do
+ post accept_family_invitation_path(token: invitee_invitation.token)
+ end.not_to(change { invitee.reload.family })
+ end
+
+ it 'redirects with error message' do
+ post accept_family_invitation_path(token: invitee_invitation.token)
+ expect(response).to redirect_to(root_path)
+ expect(flash[:alert]).to include('You must leave your current family before joining a new one')
+ end
+ end
+
+ context 'when invitation is expired' do
+ before do
+ invitee_invitation.update!(expires_at: 1.day.ago)
+ sign_in invitee
+ end
+
+ it 'does not accept the invitation' do
+ expect do
+ post accept_family_invitation_path(token: invitee_invitation.token)
+ end.not_to(change { invitee.reload.family })
+ end
+
+ it 'redirects with error message' do
+ post accept_family_invitation_path(token: invitee_invitation.token)
+ expect(response).to redirect_to(root_path)
+ expect(flash[:alert]).to include('This invitation is no longer valid or has expired')
+ end
+ end
+
+ context 'when not authenticated' do
+ before { sign_out user }
+
+ it 'redirects to login' do
+ post accept_family_invitation_path(token: invitee_invitation.token)
+ expect(response).to redirect_to(new_user_session_path)
+ end
+ end
+ end
+
+ describe 'DELETE /family/members/:id' do
+ context 'when removing a regular member' do
+ it 'removes the member from the family' do
+ expect do
+ delete "/family/members/#{member_membership.id}"
+ end.to change(Family::Membership, :count).by(-1)
+ end
+
+ it 'redirects with success message' do
+ member_email = member_user.email
+ delete "/family/members/#{member_membership.id}"
+ expect(response).to redirect_to(family_path)
+ follow_redirect!
+ expect(response.body).to include("#{member_email} has been removed from the family")
+ end
+
+ it 'removes the user from the family' do
+ delete "/family/members/#{member_membership.id}"
+ expect(member_user.reload.family).to be_nil
+ end
+ end
+
+ context 'when trying to remove the owner' do
+ it 'does not remove the owner' do
+ expect do
+ delete "/family/members/#{owner_membership.id}"
+ end.not_to change(Family::Membership, :count)
+ end
+
+ it 'redirects with error message explaining owners must delete family' do
+ delete "/family/members/#{owner_membership.id}"
+ expect(response).to redirect_to(family_path)
+ follow_redirect!
+ expect(response.body).to include('Family owners cannot remove their own membership. To leave the family, delete it instead.')
+ end
+
+ it 'prevents owner removal even when they are the only member' do
+ member_membership.destroy!
+
+ expect do
+ delete "/family/members/#{owner_membership.id}"
+ end.not_to change(Family::Membership, :count)
+
+ expect(response).to redirect_to(family_path)
+ follow_redirect!
+ expect(response.body).to include('Family owners cannot remove their own membership')
+ end
+ end
+
+ context 'when membership does not belong to the family' do
+ let(:other_family) { create(:family) }
+ let(:other_membership) { create(:family_membership, family: other_family) }
+
+ it 'returns not found' do
+ delete "/family/members/#{other_membership.id}"
+ expect(response).to have_http_status(:not_found)
+ end
+ end
+
+ context 'when user is not in the family' do
+ let(:outsider) { create(:user) }
+
+ before { sign_in outsider }
+
+ it 'redirects to families index' do
+ delete "/family/members/#{member_membership.id}"
+ expect(response).to redirect_to(new_family_path)
+ end
+ end
+
+ context 'when not authenticated' do
+ before { sign_out user }
+
+ it 'redirects to login' do
+ delete "/family/members/#{member_membership.id}"
+ expect(response).to redirect_to(new_user_session_path)
+ end
+ end
+ end
+
+ describe 'authorization for different member roles' do
+ context 'when member tries to remove another member' do
+ before { sign_in member_user }
+
+ it 'returns forbidden' do
+ delete "/family/members/#{owner_membership.id}"
+ expect(response).to have_http_status(:see_other)
+ expect(flash[:alert]).to include('not authorized')
+ end
+ end
+
+ end
+
+ describe 'member removal workflow' do
+ it 'removes member and updates family associations' do
+ # Verify initial state
+ expect(family.members).to include(user, member_user)
+ expect(member_user.family).to eq(family)
+
+ # Remove member
+ delete "/family/members/#{member_membership.id}"
+
+ # Verify removal
+ expect(response).to redirect_to(family_path)
+ expect(family.reload.members).to include(user)
+ expect(family.members).not_to include(member_user)
+ expect(member_user.reload.family).to be_nil
+ end
+
+ it 'prevents removing owner regardless of member count' do
+ # Verify initial state
+ expect(family.members.count).to eq(2)
+ expect(user.family_owner?).to be true
+
+ # Try to remove owner
+ delete "/family/members/#{owner_membership.id}"
+
+ # Verify prevention
+ expect(response).to redirect_to(family_path)
+ expect(family.reload.members).to include(user, member_user)
+ expect(user.reload.family).to eq(family)
+ end
+
+ it 'prevents removing owner even when they are the only member' do
+ # Remove other member first
+ member_membership.destroy!
+
+ # Verify only owner remains
+ expect(family.reload.members.count).to eq(1)
+ expect(family.members).to include(user)
+
+ # Try to remove owner - should be prevented
+ expect do
+ delete "/family/members/#{owner_membership.id}"
+ end.not_to change(Family::Membership, :count)
+
+ expect(response).to redirect_to(family_path)
+ expect(user.reload.family).to eq(family)
+ expect(family.reload).to be_present
+ end
+
+ it 'requires owners to use family deletion to leave the family' do
+ member_membership.destroy!
+
+ delete "/family/members/#{owner_membership.id}"
+ expect(response).to redirect_to(family_path)
+ expect(flash[:alert]).to include('Family owners cannot remove their own membership')
+
+ delete "/family"
+ expect(response).to redirect_to(new_family_path)
+ expect(user.reload.family).to be_nil
+ end
+ end
+end
diff --git a/spec/requests/family_workflows_spec.rb b/spec/requests/family_workflows_spec.rb
new file mode 100644
index 00000000..38f64ed9
--- /dev/null
+++ b/spec/requests/family_workflows_spec.rb
@@ -0,0 +1,300 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Family Workflows', type: :request do
+ let(:user1) { create(:user, email: 'alice@example.com') }
+ let(:user2) { create(:user, email: 'bob@example.com') }
+ let(:user3) { create(:user, email: 'charlie@example.com') }
+
+ before do
+ stub_request(:any, 'https://api.github.com/repos/Freika/dawarich/tags')
+ .to_return(status: 200, body: '[{"name": "1.0.0"}]', headers: {})
+ end
+
+ describe 'Complete family creation and management workflow' do
+ it 'allows creating a family, inviting members, and managing the family' do
+ # Step 1: User1 creates a family
+ sign_in user1
+
+ get '/family/new'
+ expect(response).to have_http_status(:ok)
+
+ post '/family', params: { family: { name: 'The Smith Family' } }
+
+ # The redirect should be to the newly created family
+ expect(response).to have_http_status(:found)
+ family = Family.find_by(name: 'The Smith Family')
+ expect(family).to be_present
+ expect(family.name).to eq('The Smith Family')
+ expect(family.creator).to eq(user1)
+ expect(user1.reload.family).to eq(family)
+ expect(user1.family_owner?).to be true
+
+ # Step 2: User1 invites User2
+ post "/family/invitations", params: {
+ family_invitation: { email: user2.email }
+ }
+ expect(response).to redirect_to(family_path)
+
+ invitation = family.family_invitations.find_by(email: user2.email)
+ expect(invitation).to be_present
+ expect(invitation.email).to eq(user2.email)
+ expect(invitation.family).to eq(family)
+ expect(invitation.pending?).to be true
+
+ # Step 3: User2 views and accepts invitation
+ sign_out user1
+
+ # Public invitation view (no auth required)
+ get "/invitations/#{invitation.token}"
+ expect(response).to have_http_status(:ok)
+
+ # User2 accepts invitation
+ sign_in user2
+ post accept_family_invitation_path(token: invitation.token)
+ expect(response).to redirect_to(family_path)
+
+ expect(user2.reload.family).to eq(family)
+ expect(user2.family_owner?).to be false
+ expect(invitation.reload.accepted?).to be true
+
+ # Step 4: User1 invites User3
+ sign_in user1
+ post "/family/invitations", params: {
+ family_invitation: { email: user3.email }
+ }
+
+ invitation2 = family.family_invitations.find_by(email: user3.email)
+ expect(invitation2).to be_present
+ expect(invitation2.email).to eq(user3.email)
+
+ # Step 5: User3 accepts invitation
+ sign_in user3
+ post accept_family_invitation_path(token: invitation2.token)
+
+ expect(user3.reload.family).to eq(family)
+ expect(family.reload.members.count).to eq(3)
+
+ # Step 6: Family owner views members on family show page
+ sign_in user1
+ get "/family"
+ expect(response).to have_http_status(:ok)
+
+ # Step 7: Owner removes a member
+ delete "/family/members/#{user2.family_membership.id}"
+ expect(response).to redirect_to(family_path)
+
+ expect(user2.reload.family).to be_nil
+ expect(family.reload.members.count).to eq(2)
+ expect(family.members).to include(user1, user3)
+ expect(family.members).not_to include(user2)
+ end
+ end
+
+ describe 'Family invitation expiration workflow' do
+ let(:family) { create(:family, name: 'Test Family', creator: user1) }
+ let!(:owner_membership) { create(:family_membership, user: user1, family: family, role: :owner) }
+ let!(:invitation) do
+ create(:family_invitation, family: family, email: user2.email, invited_by: user1, expires_at: 1.day.ago)
+ end
+
+ it 'handles expired invitations correctly' do
+ # User2 tries to view expired invitation
+ get "/invitations/#{invitation.token}"
+ expect(response).to redirect_to(root_path)
+ follow_redirect!
+ expect(response.body).to include('This invitation has expired')
+
+ # User2 tries to accept expired invitation
+ sign_in user2
+ post accept_family_invitation_path(token: invitation.token)
+ expect(response).to redirect_to(root_path)
+
+ expect(user2.reload.family).to be_nil
+ expect(invitation.reload.pending?).to be true
+ end
+ end
+
+ describe 'Multiple family membership prevention workflow' do
+ let(:family1) { create(:family, name: 'Family 1', creator: user1) }
+ let(:family2) { create(:family, name: 'Family 2', creator: user2) }
+ let!(:user1_membership) { create(:family_membership, user: user1, family: family1, role: :owner) }
+ let!(:user2_membership) { create(:family_membership, user: user2, family: family2, role: :owner) }
+ let!(:invitation1) { create(:family_invitation, family: family1, email: user3.email, invited_by: user1) }
+ let!(:invitation2) { create(:family_invitation, family: family2, email: user3.email, invited_by: user2) }
+
+ it 'prevents users from joining multiple families' do
+ # User3 accepts invitation to Family 1
+ sign_in user3
+ post accept_family_invitation_path(token: invitation1.token)
+ expect(response).to redirect_to(family_path)
+ expect(user3.family).to eq(family1)
+
+ # User3 tries to accept invitation to Family 2
+ post accept_family_invitation_path(token: invitation2.token)
+ expect(response).to redirect_to(root_path)
+ expect(flash[:alert]).to include('You must leave your current family')
+
+ expect(user3.reload.family).to eq(family1) # Still in first family
+ end
+ end
+
+ describe 'Family ownership transfer and leaving workflow' do
+ let(:family) { create(:family, creator: user1) }
+ let!(:owner_membership) { create(:family_membership, user: user1, family: family, role: :owner) }
+ let!(:member_membership) { create(:family_membership, user: user2, family: family, role: :member) }
+
+ it 'prevents owner from leaving when members exist' do
+ sign_in user1
+
+ # Owner tries to leave family with members (using memberships destroy route)
+ owner_membership = user1.family_membership
+ delete "/family/members/#{owner_membership.id}"
+ expect(response).to redirect_to(family_path)
+ follow_redirect!
+ expect(response.body).to include('cannot remove their own membership')
+
+ expect(user1.reload.family).to eq(family)
+ expect(user1.family_owner?).to be true
+ end
+
+ it 'allows owner to leave when they are the only member' do
+ sign_in user1
+
+ # Remove the member first
+ delete "/family/members/#{member_membership.id}"
+
+ # Owner cannot leave even when alone - they must delete the family instead
+ owner_membership = user1.reload.family_membership
+ delete "/family/members/#{owner_membership.id}"
+ expect(response).to redirect_to(family_path)
+ follow_redirect!
+ expect(response.body).to include('cannot remove their own membership')
+
+ expect(user1.reload.family).to eq(family)
+ end
+
+ it 'allows members to leave freely' do
+ sign_in user2
+
+ delete "/family/members/#{member_membership.id}"
+ expect(response).to redirect_to(new_family_path)
+
+ expect(user2.reload.family).to be_nil
+ expect(family.reload.members.count).to eq(1)
+ expect(family.members).to include(user1)
+ expect(family.members).not_to include(user2)
+ end
+ end
+
+ describe 'Family deletion workflow' do
+ let(:family) { create(:family, creator: user1) }
+ let!(:owner_membership) { create(:family_membership, user: user1, family: family, role: :owner) }
+
+ context 'when members exist' do
+ let!(:member_membership) { create(:family_membership, user: user2, family: family, role: :member) }
+
+ it 'prevents family deletion when members exist' do
+ sign_in user1
+
+ expect do
+ delete "/family"
+ end.not_to change(Family, :count)
+
+ expect(response).to redirect_to(family_path)
+ follow_redirect!
+ expect(response.body).to include('Cannot delete family with members')
+ end
+ end
+
+ it 'allows family deletion when owner is the only member' do
+ sign_in user1
+
+ expect do
+ delete "/family"
+ end.to change(Family, :count).by(-1)
+
+ expect(response).to redirect_to(new_family_path)
+ expect(user1.reload.family).to be_nil
+ end
+ end
+
+ describe 'Authorization workflow' do
+ let(:family) { create(:family, creator: user1) }
+ let!(:owner_membership) { create(:family_membership, user: user1, family: family, role: :owner) }
+ let!(:member_membership) { create(:family_membership, user: user2, family: family, role: :member) }
+
+ it 'enforces proper authorization for family management' do
+ # Member cannot invite others
+ sign_in user2
+ post "/family/invitations", params: {
+ family_invitation: { email: user3.email }
+ }
+ expect(response).to have_http_status(:see_other)
+ expect(flash[:alert]).to include('not authorized')
+
+ # Member cannot remove other members
+ delete "/family/members/#{owner_membership.id}"
+ expect(response).to have_http_status(:see_other)
+ expect(flash[:alert]).to include('not authorized')
+
+ # Member cannot edit family
+ patch "/family", params: { family: { name: 'Hacked Family' } }
+ expect(response).to have_http_status(:see_other)
+ expect(flash[:alert]).to include('not authorized')
+
+ # Member cannot delete family
+ delete "/family"
+ expect(response).to have_http_status(:see_other)
+ expect(flash[:alert]).to include('not authorized')
+
+ # Outsider cannot access family
+ sign_in user3
+ get "/family"
+ expect(response).to redirect_to(new_family_path)
+ end
+ end
+
+ describe 'Email invitation workflow' do
+ let(:family) { create(:family, name: 'Test Family', creator: user1) }
+ let!(:owner_membership) { create(:family_membership, user: user1, family: family, role: :owner) }
+
+ it 'handles invitation emails correctly' do
+ sign_in user1
+
+ # Mock email delivery
+ expect do
+ post "/family/invitations", params: {
+ family_invitation: { email: 'newuser@example.com' }
+ }
+ end.to change(Family::Invitation, :count).by(1)
+
+ invitation = family.family_invitations.find_by(email: 'newuser@example.com')
+ expect(invitation.email).to eq('newuser@example.com')
+ expect(invitation.token).to be_present
+ expect(invitation.expires_at).to be > Time.current
+ end
+ end
+
+ describe 'Navigation and redirect workflow' do
+ it 'handles proper redirects for family-related navigation' do
+ # User without family can access new family page
+ sign_in user1
+ get '/family/new'
+ expect(response).to have_http_status(:ok)
+
+ # User creates family
+ post '/family', params: { family: { name: 'Test Family' } }
+ expect(response).to have_http_status(:found)
+
+ # User with family can view their family
+ get '/family'
+ expect(response).to have_http_status(:ok)
+
+ # User with family gets redirected from new family page
+ get '/family/new'
+ expect(response).to redirect_to(family_path)
+ end
+ end
+end
diff --git a/spec/requests/users/registrations_spec.rb b/spec/requests/users/registrations_spec.rb
new file mode 100644
index 00000000..96b1469f
--- /dev/null
+++ b/spec/requests/users/registrations_spec.rb
@@ -0,0 +1,328 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Users::Registrations', type: :request do
+ let(:family_owner) { create(:user) }
+ let(:family) { create(:family, creator: family_owner) }
+ let!(:owner_membership) { create(:family_membership, user: family_owner, family: family, role: :owner) }
+ let(:invitation) do
+ create(:family_invitation, family: family, invited_by: family_owner, email: 'invited@example.com')
+ end
+
+ before do
+ stub_request(:any, 'https://api.github.com/repos/Freika/dawarich/tags')
+ .to_return(status: 200, body: '[{"name": "1.0.0"}]', headers: {})
+ end
+
+ describe 'Family Invitation Registration Flow' do
+ context 'when accessing registration with a valid invitation token' do
+ it 'shows family-focused registration page' do
+ get new_user_registration_path(invitation_token: invitation.token)
+
+ expect(response).to have_http_status(:ok)
+ expect(response.body).to include("Join #{family.name}!")
+ expect(response.body).to include(family_owner.email)
+ expect(response.body).to include(invitation.email)
+ expect(response.body).to include('Create Account & Join Family')
+ end
+
+ it 'pre-fills email field with invitation email' do
+ get new_user_registration_path(invitation_token: invitation.token)
+
+ expect(response.body).to include('value="invited@example.com"')
+ end
+
+ it 'makes email field readonly' do
+ get new_user_registration_path(invitation_token: invitation.token)
+
+ expect(response.body).to include('readonly')
+ end
+
+ it 'hides normal login links' do
+ get new_user_registration_path(invitation_token: invitation.token)
+
+ expect(response.body).not_to include('devise/shared/links')
+ end
+ end
+
+ context 'when accessing registration without invitation token' do
+ it 'shows normal registration page' do
+ get new_user_registration_path
+
+ expect(response).to have_http_status(:ok)
+ expect(response.body).to include('Register now!')
+ expect(response.body).to include('take control over your location data')
+ expect(response.body).not_to include('Join')
+ expect(response.body).to include('Sign up')
+ end
+ end
+
+ context 'when creating account with valid invitation token' do
+ let(:user_params) do
+ {
+ email: invitation.email,
+ password: 'password123',
+ password_confirmation: 'password123'
+ }
+ end
+
+ let(:request_params) do
+ {
+ user: user_params,
+ invitation_token: invitation.token
+ }
+ end
+
+ it 'creates user and accepts invitation automatically' do
+ expect do
+ post user_registration_path, params: request_params
+ end.to change(User, :count).by(1)
+ .and change { invitation.reload.status }.from('pending').to('accepted')
+
+ new_user = User.find_by(email: invitation.email)
+ expect(new_user).to be_present
+ expect(new_user.family).to eq(family)
+ expect(family.reload.members).to include(new_user)
+ end
+
+ it 'redirects to family page after successful registration' do
+ post user_registration_path, params: request_params
+
+ expect(response).to redirect_to(family_path)
+ end
+
+ it 'displays success message with family name' do
+ post user_registration_path, params: request_params
+
+ # Check that user got the default registration success message
+ # (family welcome message is set but may be overridden by Devise)
+ expect(flash[:notice]).to include('signed up successfully')
+ end
+ end
+
+ context 'when creating account with invalid invitation token' do
+ it 'creates user but does not accept any invitation' do
+ expect do
+ post user_registration_path, params: {
+ user: {
+ email: 'user@example.com',
+ password: 'password123',
+ password_confirmation: 'password123'
+ },
+ invitation_token: 'invalid-token'
+ }
+ end.to change(User, :count).by(1)
+
+ new_user = User.find_by(email: 'user@example.com')
+ expect(new_user.family).to be_nil
+ end
+ end
+
+ context 'when invitation email does not match registration email' do
+ it 'creates user but does not accept invitation' do
+ expect do
+ post user_registration_path, params: {
+ user: {
+ email: 'different@example.com',
+ password: 'password123',
+ password_confirmation: 'password123'
+ },
+ invitation_token: invitation.token
+ }
+ end.to change(User, :count).by(1)
+
+ new_user = User.find_by(email: 'different@example.com')
+ expect(new_user.family).to be_nil
+ expect(invitation.reload.status).to eq('pending')
+ end
+ end
+ end
+
+ describe 'Self-Hosted Mode' do
+ before do
+ allow(ENV).to receive(:[]).and_call_original
+ allow(ENV).to receive(:[]).with('SELF_HOSTED').and_return('true')
+ end
+
+ context 'when accessing registration without invitation token' do
+ it 'redirects to root with error message' do
+ get new_user_registration_path
+
+ expect(response).to redirect_to(root_path)
+ expect(flash[:alert]).to include('Registration is not available')
+ end
+
+ it 'prevents account creation' do
+ expect do
+ post user_registration_path, params: {
+ user: {
+ email: 'test@example.com',
+ password: 'password123',
+ password_confirmation: 'password123'
+ }
+ }
+ end.not_to change(User, :count)
+
+ expect(response).to redirect_to(root_path)
+ expect(flash[:alert]).to include('Registration is not available')
+ end
+ end
+
+ context 'when accessing registration with valid invitation token' do
+ it 'allows registration page access' do
+ get new_user_registration_path(invitation_token: invitation.token)
+
+ expect(response).to have_http_status(:ok)
+ expect(response.body).to include("Join #{family.name}!")
+ end
+
+ it 'allows account creation' do
+ expect do
+ post user_registration_path, params: {
+ user: {
+ email: invitation.email,
+ password: 'password123',
+ password_confirmation: 'password123'
+ },
+ invitation_token: invitation.token
+ }
+ end.to change(User, :count).by(1)
+
+ expect(response).to redirect_to(family_path)
+ end
+ end
+
+ context 'when accessing registration with expired invitation' do
+ before { invitation.update!(expires_at: 1.day.ago) }
+
+ it 'redirects to root with error message' do
+ get new_user_registration_path(invitation_token: invitation.token)
+
+ expect(response).to redirect_to(root_path)
+ expect(flash[:alert]).to include('Registration is not available')
+ end
+ end
+
+ context 'when accessing registration with cancelled invitation' do
+ before { invitation.update!(status: :cancelled) }
+
+ it 'redirects to root with error message' do
+ get new_user_registration_path(invitation_token: invitation.token)
+
+ expect(response).to redirect_to(root_path)
+ expect(flash[:alert]).to include('Registration is not available')
+ end
+ end
+ end
+
+ describe 'Non-Self-Hosted Mode' do
+ before do
+ allow(DawarichSettings).to receive(:self_hosted?).and_return(false)
+ allow(DawarichSettings).to receive(:family_feature_enabled?).and_return(false)
+ end
+
+ context 'when accessing registration without invitation token' do
+ it 'allows normal registration' do
+ get new_user_registration_path
+
+ expect(response).to have_http_status(:ok)
+ expect(response.body).to include('Register now!')
+ end
+
+ it 'allows account creation' do
+ unique_email = "newuser-#{Time.current.to_i}@example.com"
+
+ expect do
+ post user_registration_path, params: {
+ user: {
+ email: unique_email,
+ password: 'password123',
+ password_confirmation: 'password123'
+ }
+ }
+ end.to change(User, :count).by(1)
+
+ expect(response).to redirect_to(root_path)
+ expect(User.find_by(email: unique_email)).to be_present
+ end
+ end
+ end
+
+ describe 'Invitation Token Handling' do
+ it 'accepts invitation token from params' do
+ get new_user_registration_path(invitation_token: invitation.token)
+
+ expect(response.body).to include("Join #{invitation.family.name}!")
+ end
+
+ it 'accepts invitation token from nested user params' do
+ post user_registration_path, params: {
+ user: {
+ email: invitation.email,
+ password: 'password123',
+ password_confirmation: 'password123'
+ },
+ invitation_token: invitation.token
+ }
+
+ new_user = User.find_by(email: invitation.email)
+ expect(new_user.family).to eq(family)
+ end
+
+ it 'handles session-stored invitation token' do
+ # Simulate session storage by passing the token directly in params
+ # (In real usage, this would come from the session after redirect from invitation page)
+ get new_user_registration_path(invitation_token: invitation.token)
+
+ expect(response.body).to include("Join #{invitation.family.name}!")
+ end
+ end
+
+ describe 'Error Handling' do
+ context 'when invitation acceptance fails' do
+ before do
+ # Mock service failure
+ allow_any_instance_of(Families::AcceptInvitation).to receive(:call).and_return(false)
+ allow_any_instance_of(Families::AcceptInvitation).to receive(:error_message).and_return('Mock error')
+ end
+
+ it 'creates user but shows invitation error in flash' do
+ expect do
+ post user_registration_path, params: {
+ user: {
+ email: invitation.email,
+ password: 'password123',
+ password_confirmation: 'password123'
+ },
+ invitation_token: invitation.token
+ }
+ end.to change(User, :count).by(1)
+
+ expect(flash[:alert]).to include('Mock error')
+ end
+ end
+
+ context 'when invitation acceptance raises exception' do
+ before do
+ # Mock service exception
+ allow_any_instance_of(Families::AcceptInvitation).to receive(:call).and_raise(StandardError, 'Test error')
+ end
+
+ it 'creates user but shows generic error in flash' do
+ expect do
+ post user_registration_path, params: {
+ user: {
+ email: invitation.email,
+ password: 'password123',
+ password_confirmation: 'password123'
+ },
+ invitation_token: invitation.token
+ }
+ end.to change(User, :count).by(1)
+
+ expect(flash[:alert]).to include('there was an issue accepting the invitation')
+ end
+ end
+ end
+end
diff --git a/spec/requests/users_spec.rb b/spec/requests/users_spec.rb
index 8c0bcdf5..219c4d4d 100644
--- a/spec/requests/users_spec.rb
+++ b/spec/requests/users_spec.rb
@@ -11,19 +11,21 @@ RSpec.describe 'Users', type: :request do
describe 'GET /users/sign_up' do
context 'when self-hosted' do
before do
- stub_const('SELF_HOSTED', true)
+ allow(ENV).to receive(:[]).and_call_original
+ allow(ENV).to receive(:[]).with('SELF_HOSTED').and_return('true')
end
- it 'returns http success' do
+ it 'redirects to root path' do
get '/users/sign_up'
- expect(response).to have_http_status(:not_found)
+ expect(response).to redirect_to(root_path)
+ expect(flash[:alert]).to include('Registration is not available')
end
end
context 'when not self-hosted' do
before do
- stub_const('SELF_HOSTED', false)
- Rails.application.reload_routes!
+ allow(ENV).to receive(:[]).and_call_original
+ allow(ENV).to receive(:[]).with('SELF_HOSTED').and_return(nil)
end
it 'returns http success' do
diff --git a/spec/services/families/accept_invitation_spec.rb b/spec/services/families/accept_invitation_spec.rb
new file mode 100644
index 00000000..28dca538
--- /dev/null
+++ b/spec/services/families/accept_invitation_spec.rb
@@ -0,0 +1,115 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe Families::AcceptInvitation do
+ let(:family) { create(:family) }
+ let(:invitee) { create(:user, email: 'invitee@example.com') }
+ let(:invitation) { create(:family_invitation, family: family, email: invitee.email) }
+ let(:service) { described_class.new(invitation: invitation, user: invitee) }
+
+ describe '#call' do
+ context 'when invitation can be accepted' do
+ it 'creates membership for user' do
+ expect { service.call }.to change(Family::Membership, :count).by(1)
+ membership = invitee.reload.family_membership
+ expect(membership.family).to eq(family)
+ expect(membership.role).to eq('member')
+ end
+
+ it 'updates invitation status to accepted' do
+ service.call
+ invitation.reload
+ expect(invitation.status).to eq('accepted')
+ end
+
+ it 'sends notifications to both parties' do
+ expect { service.call }.to change(Notification, :count).by(2)
+
+ user_notification = Notification.find_by(user: invitee, title: 'Welcome to Family!')
+ expect(user_notification).to be_present
+
+ owner_notification = Notification.find_by(user: family.creator, title: 'New Family Member!')
+ expect(owner_notification).to be_present
+ end
+
+ it 'returns true' do
+ expect(service.call).to be true
+ end
+ end
+
+ context 'when user is already in another family' do
+ let(:other_family) { create(:family) }
+ let!(:existing_membership) { create(:family_membership, user: invitee, family: other_family) }
+
+ it 'returns false' do
+ expect(service.call).to be false
+ end
+
+ it 'does not create membership' do
+ expect { service.call }.not_to change(Family::Membership, :count)
+ end
+
+ it 'sets appropriate error message' do
+ service.call
+ expect(service.error_message).to eq('You must leave your current family before joining a new one.')
+ end
+
+ it 'does not change user family' do
+ expect { service.call }.not_to(change { invitee.reload.family })
+ end
+ end
+
+ context 'when invitation is expired' do
+ let(:invitation) { create(:family_invitation, family: family, email: invitee.email, expires_at: 1.day.ago) }
+
+ it 'returns false' do
+ expect(service.call).to be false
+ end
+
+ it 'does not create membership' do
+ expect { service.call }.not_to change(Family::Membership, :count)
+ end
+ end
+
+ context 'when invitation is not pending' do
+ let(:invitation) { create(:family_invitation, :accepted, family: family, email: invitee.email) }
+
+ it 'returns false' do
+ expect(service.call).to be false
+ end
+
+ it 'does not create membership' do
+ expect { service.call }.not_to change(Family::Membership, :count)
+ end
+ end
+
+ context 'when email does not match user' do
+ let(:wrong_user) { create(:user, email: 'wrong@example.com') }
+ let(:service) { described_class.new(invitation: invitation, user: wrong_user) }
+
+ it 'returns false' do
+ expect(service.call).to be false
+ end
+
+ it 'does not create membership' do
+ expect { service.call }.not_to change(Family::Membership, :count)
+ end
+ end
+
+ context 'when family is at max capacity' do
+ before do
+ # Fill family to max capacity
+ create_list(:family_membership, Family::MAX_MEMBERS, family: family, role: :member)
+ end
+
+ it 'returns false' do
+ expect(service.call).to be false
+ end
+
+ it 'does not create membership' do
+ expect { service.call }.not_to change(Family::Membership, :count)
+ end
+ end
+ end
+end
diff --git a/spec/services/families/create_spec.rb b/spec/services/families/create_spec.rb
new file mode 100644
index 00000000..216c344b
--- /dev/null
+++ b/spec/services/families/create_spec.rb
@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe Families::Create do
+ let(:user) { create(:user) }
+ let(:service) { described_class.new(user: user, name: 'Test Family') }
+
+ describe '#call' do
+ context 'when user is not in a family' do
+ it 'creates a family successfully' do
+ expect { service.call }.to change(Family, :count).by(1)
+ expect(service.family.name).to eq('Test Family')
+ expect(service.family.creator).to eq(user)
+ end
+
+ it 'creates owner membership' do
+ service.call
+ membership = user.reload.family_membership
+ expect(membership.role).to eq('owner')
+ expect(membership.family).to eq(service.family)
+ end
+
+ it 'returns true on success' do
+ expect(service.call).to be true
+ end
+ end
+
+ context 'when user is already in a family' do
+ before { create(:family_membership, user: user) }
+
+ it 'returns false' do
+ expect(service.call).to be false
+ end
+
+ it 'does not create a family' do
+ expect { service.call }.not_to change(Family, :count)
+ end
+
+ it 'does not create a membership' do
+ expect { service.call }.not_to change(Family::Membership, :count)
+ end
+
+ it 'sets appropriate error message' do
+ service.call
+ expect(service.error_message).to eq('You must leave your current family before creating a new one')
+ end
+ end
+
+ context 'when user has already created a family before' do
+ before do
+ # User creates and then deletes their family membership, but family still exists
+ old_family = create(:family, creator: user)
+ membership = create(:family_membership, user: user, family: old_family, role: :owner)
+ membership.destroy! # User leaves the family but family still exists
+ user.reload # Ensure user association is refreshed
+ end
+
+ it 'returns false' do
+ expect(service.call).to be false
+ end
+
+ it 'does not create a family' do
+ expect { service.call }.not_to change(Family, :count)
+ end
+
+ it 'does not create a membership' do
+ expect { service.call }.not_to change(Family::Membership, :count)
+ end
+
+ it 'sets appropriate error message' do
+ service.call
+ expect(service.error_message).to eq('You have already created a family. Each user can only create one family')
+ end
+ end
+ end
+end
diff --git a/spec/services/families/invite_spec.rb b/spec/services/families/invite_spec.rb
new file mode 100644
index 00000000..8ea3c747
--- /dev/null
+++ b/spec/services/families/invite_spec.rb
@@ -0,0 +1,142 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe Families::Invite do
+ let(:owner) { create(:user) }
+ let(:family) { create(:family, creator: owner) }
+ let!(:owner_membership) { create(:family_membership, user: owner, family: family, role: :owner) }
+ let(:email) { 'invitee@example.com' }
+ let(:service) { described_class.new(family: family, email: email, invited_by: owner) }
+
+ describe '#call' do
+ context 'when invitation is valid' do
+ it 'creates an invitation' do
+ expect { service.call }.to change(Family::Invitation, :count).by(1)
+
+ invitation = owner.sent_family_invitations.last
+
+ expect(invitation.family).to eq(family)
+ expect(invitation.email).to eq(email)
+ expect(invitation.invited_by).to eq(owner)
+ end
+
+ it 'sends invitation email' do
+ expect(FamilyMailer).to receive(:invitation).and_call_original
+ expect_any_instance_of(ActionMailer::MessageDelivery).to receive(:deliver_later)
+ service.call
+ end
+
+ it 'sends notification to inviter' do
+ expect { service.call }.to change(Notification, :count).by(1)
+
+ notification = owner.notifications.last
+
+ expect(notification.user).to eq(owner)
+ expect(notification.title).to eq('Invitation Sent')
+ end
+
+ it 'returns true' do
+ expect(service.call).to be true
+ end
+ end
+
+ context 'when inviter is not family owner' do
+ let(:member) { create(:user) }
+ let!(:member_membership) { create(:family_membership, user: member, family: family, role: :member) }
+ let(:service) { described_class.new(family: family, email: email, invited_by: member) }
+
+ it 'returns false' do
+ expect(service.call).to be false
+ end
+
+ it 'does not create invitation' do
+ expect { service.call }.not_to change(Family::Invitation, :count)
+ end
+ end
+
+ context 'when family is at max capacity' do
+ before do
+ # Create max members (5 total including owner)
+ create_list(:family_membership, Family::MAX_MEMBERS - 1, family: family, role: :member)
+ end
+
+ it 'returns false' do
+ expect(service.call).to be false
+ end
+
+ it 'does not create invitation' do
+ expect { service.call }.not_to change(Family::Invitation, :count)
+ end
+ end
+
+ context 'when user is already in a family' do
+ let(:existing_user) { create(:user, email: email) }
+ let(:other_family) { create(:family) }
+
+ before do
+ create(:family_membership, user: existing_user, family: other_family)
+ end
+
+ it 'returns false' do
+ expect(service.call).to be false
+ end
+
+ it 'does not create invitation' do
+ expect { service.call }.not_to change(Family::Invitation, :count)
+ end
+ end
+
+ context 'when pending invitation already exists' do
+ before do
+ create(:family_invitation, family: family, email: email, invited_by: owner)
+ end
+
+ it 'returns false' do
+ expect(service.call).to be false
+ end
+
+ it 'does not create another invitation' do
+ expect { service.call }.not_to change(Family::Invitation, :count)
+ end
+ end
+
+ context 'with invalid email' do
+ let(:service) { described_class.new(family: family, email: 'invalid-email', invited_by: owner) }
+
+ it 'returns false' do
+ expect(service.call).to be false
+ end
+
+ it 'has validation errors' do
+ service.call
+ expect(service.errors[:email]).to be_present
+ end
+ end
+ end
+
+ describe 'email normalization' do
+ let(:service) { described_class.new(family: family, email: ' UPPER@EXAMPLE.COM ', invited_by: owner) }
+
+ it 'normalizes email to lowercase and strips whitespace' do
+ service.call
+ invitation = family.family_invitations.last
+
+ expect(invitation.email).to eq('upper@example.com')
+ end
+ end
+
+ describe 'validations' do
+ it 'validates presence of email' do
+ service = described_class.new(family: family, email: '', invited_by: owner)
+ expect(service).not_to be_valid
+ expect(service.errors[:email]).to include("can't be blank")
+ end
+
+ it 'validates email format' do
+ service = described_class.new(family: family, email: 'invalid-email', invited_by: owner)
+ expect(service).not_to be_valid
+ expect(service.errors[:email]).to include('is invalid')
+ end
+ end
+end
diff --git a/spec/services/families/memberships/destroy_spec.rb b/spec/services/families/memberships/destroy_spec.rb
new file mode 100644
index 00000000..ac2475e5
--- /dev/null
+++ b/spec/services/families/memberships/destroy_spec.rb
@@ -0,0 +1,93 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe Families::Memberships::Destroy do
+ let(:user) { create(:user) }
+ let(:family) { create(:family, creator: user) }
+ let(:service) { described_class.new(user: user) }
+
+ describe '#call' do
+ context 'when user is a member (not owner)' do
+ let(:member) { create(:user) }
+ let!(:owner_membership) { create(:family_membership, user: user, family: family, role: :owner) }
+ let!(:member_membership) { create(:family_membership, user: member, family: family, role: :member) }
+ let(:service) { described_class.new(user: member) }
+
+ it 'removes the membership' do
+ result = service.call
+ expect(result).to be_truthy, "Expected service to succeed but got error: #{service.error_message}"
+ expect(Family::Membership.count).to eq(1) # Only owner should remain
+ expect(member.reload.family_membership).to be_nil
+ end
+
+ it 'sends notification to member who left' do
+ expect { service.call }.to change(Notification, :count).by(2)
+
+ member_notification = member.notifications.last
+ expect(member_notification.title).to eq('Left Family')
+ expect(member_notification.content).to include(family.name)
+ end
+
+ it 'sends notification to family owner' do
+ service.call
+
+ owner_notification = user.notifications.last
+ expect(owner_notification.title).to eq('Family Member Left')
+ expect(owner_notification.content).to include(member.email)
+ expect(owner_notification.content).to include(family.name)
+ end
+
+ it 'returns true' do
+ expect(service.call).to be true
+ end
+ end
+
+ context 'when user is family owner with no other members' do
+ let!(:membership) { create(:family_membership, user: user, family: family, role: :owner) }
+
+ it 'prevents owner from leaving' do
+ expect { service.call }.not_to change(Family::Membership, :count)
+ expect(user.reload.family_membership).to be_present
+ end
+
+ it 'does not delete the family' do
+ expect { service.call }.not_to change(Family, :count)
+ end
+
+ it 'returns false' do
+ expect(service.call).to be false
+ end
+
+ it 'sets error message' do
+ service.call
+ expect(service.error_message).to include('cannot remove their own membership')
+ end
+ end
+
+ context 'when user is family owner with other members' do
+ let(:member) { create(:user) }
+ let!(:owner_membership) { create(:family_membership, user: user, family: family, role: :owner) }
+ let!(:member_membership) { create(:family_membership, user: member, family: family, role: :member) }
+
+ it 'returns false' do
+ expect(service.call).to be false
+ end
+
+ it 'does not remove membership' do
+ expect { service.call }.not_to change(Family::Membership, :count)
+ expect(user.reload.family_membership).to be_present
+ end
+ end
+
+ context 'when user is not in a family' do
+ it 'returns false' do
+ expect(service.call).to be false
+ end
+
+ it 'does not create any notifications' do
+ expect { service.call }.not_to change(Notification, :count)
+ end
+ end
+ end
+end
diff --git a/spec/services/families/update_location_sharing_spec.rb b/spec/services/families/update_location_sharing_spec.rb
new file mode 100644
index 00000000..72243d5b
--- /dev/null
+++ b/spec/services/families/update_location_sharing_spec.rb
@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe Families::UpdateLocationSharing do
+ include ActiveSupport::Testing::TimeHelpers
+
+ describe '.call' do
+ subject(:call_service) do
+ described_class.new(user: user, enabled: enabled, duration: duration).call
+ end
+
+ let(:duration) { '1h' }
+
+ context 'when the user is in a family' do
+ let(:user) { create(:user) }
+ let!(:family_membership) { create(:family_membership, user: user) }
+
+ context 'when enabling location sharing with a duration' do
+ let(:enabled) { true }
+
+ around do |example|
+ travel_to(Time.zone.local(2024, 1, 1, 12, 0, 0)) { example.run }
+ end
+
+ it 'returns a successful result with the expected payload' do
+ result = call_service
+
+ expect(result).to be_success
+ expect(result.status).to eq(:ok)
+ expect(result.payload[:success]).to be true
+ expect(result.payload[:enabled]).to be true
+ expect(result.payload[:duration]).to eq('1h')
+ expect(result.payload[:message]).to eq('Location sharing enabled for 1 hour')
+ expect(result.payload[:expires_at]).to eq(1.hour.from_now.iso8601)
+ expect(result.payload[:expires_at_formatted]).to eq(1.hour.from_now.strftime('%b %d at %I:%M %p'))
+ end
+ end
+
+ context 'when disabling location sharing' do
+ let(:enabled) { false }
+ let(:duration) { nil }
+
+ it 'returns a successful result without expiration details' do
+ result = call_service
+
+ expect(result).to be_success
+ expect(result.payload[:success]).to be true
+ expect(result.payload[:enabled]).to be false
+ expect(result.payload[:message]).to eq('Location sharing disabled')
+ expect(result.payload).not_to have_key(:expires_at)
+ expect(result.payload).not_to have_key(:expires_at_formatted)
+ end
+ end
+
+ context 'when update raises an unexpected error' do
+ let(:enabled) { true }
+
+ before do
+ allow(user).to receive(:update_family_location_sharing!).and_raise(StandardError, 'boom')
+ end
+
+ it 'returns a failure result with internal server error status' do
+ result = call_service
+
+ expect(result).not_to be_success
+ expect(result.status).to eq(:internal_server_error)
+ expect(result.payload[:success]).to be false
+ expect(result.payload[:message]).to eq('An error occurred while updating location sharing')
+ end
+ end
+ end
+
+ context 'when the user is not in a family' do
+ let(:user) { create(:user) }
+ let(:enabled) { true }
+
+ it 'returns a failure result with unprocessable content status' do
+ result = call_service
+
+ expect(result).not_to be_success
+ expect(result.status).to eq(:unprocessable_content)
+ expect(result.payload[:success]).to be false
+ expect(result.payload[:message]).to eq('Failed to update location sharing setting')
+ end
+ end
+ end
+end
diff --git a/spec/services/google_maps/records_importer_spec.rb b/spec/services/google_maps/records_importer_spec.rb
index e2761d4f..c0cf5033 100644
--- a/spec/services/google_maps/records_importer_spec.rb
+++ b/spec/services/google_maps/records_importer_spec.rb
@@ -17,6 +17,12 @@ RSpec.describe GoogleMaps::RecordsImporter do
'accuracy' => 10,
'altitude' => 100,
'verticalAccuracy' => 5,
+ 'heading' => 270,
+ 'velocity' => 15,
+ 'batteryCharging' => true,
+ 'source' => 'GPS',
+ 'deviceTag' => 1234567890,
+ 'platformType' => 'ANDROID',
'activity' => [
{
'timestampMs' => (time.to_f * 1000).to_i.to_s,
@@ -111,5 +117,87 @@ RSpec.describe GoogleMaps::RecordsImporter do
expect(created_point.timestamp).to eq(time.to_i)
end
end
+
+ context 'with additional Records.json schema fields' do
+ let(:locations) do
+ [
+ {
+ 'timestamp' => time.iso8601,
+ 'latitudeE7' => 123_456_789,
+ 'longitudeE7' => 123_456_789,
+ 'accuracy' => 20,
+ 'altitude' => 150,
+ 'verticalAccuracy' => 10,
+ 'heading' => 270,
+ 'velocity' => 10,
+ 'batteryCharging' => true,
+ 'source' => 'WIFI',
+ 'deviceTag' => 1234567890,
+ 'platformType' => 'ANDROID'
+ }
+ ]
+ end
+
+ it 'extracts all supported fields' do
+ expect { parser }.to change(Point, :count).by(1)
+
+ created_point = Point.last
+ expect(created_point.accuracy).to eq(20)
+ expect(created_point.altitude).to eq(150)
+ expect(created_point.vertical_accuracy).to eq(10)
+ expect(created_point.course).to eq(270)
+ expect(created_point.velocity).to eq('10')
+ expect(created_point.battery).to eq(1) # true -> 1
+ end
+
+ it 'stores all fields in raw_data' do
+ parser
+ created_point = Point.last
+
+ expect(created_point.raw_data['source']).to eq('WIFI')
+ expect(created_point.raw_data['deviceTag']).to eq(1234567890)
+ expect(created_point.raw_data['platformType']).to eq('ANDROID')
+ end
+ end
+
+ context 'with batteryCharging false' do
+ let(:locations) do
+ [
+ {
+ 'timestamp' => time.iso8601,
+ 'latitudeE7' => 123_456_789,
+ 'longitudeE7' => 123_456_789,
+ 'batteryCharging' => false
+ }
+ ]
+ end
+
+ it 'stores battery as 0' do
+ expect { parser }.to change(Point, :count).by(1)
+ expect(Point.last.battery).to eq(0)
+ end
+ end
+
+ context 'with missing optional fields' do
+ let(:locations) do
+ [
+ {
+ 'timestamp' => time.iso8601,
+ 'latitudeE7' => 123_456_789,
+ 'longitudeE7' => 123_456_789
+ }
+ ]
+ end
+
+ it 'handles missing fields gracefully' do
+ expect { parser }.to change(Point, :count).by(1)
+
+ created_point = Point.last
+ expect(created_point.accuracy).to be_nil
+ expect(created_point.vertical_accuracy).to be_nil
+ expect(created_point.course).to be_nil
+ expect(created_point.battery).to be_nil
+ end
+ end
end
end
diff --git a/spec/services/users/safe_settings_spec.rb b/spec/services/users/safe_settings_spec.rb
index 573009c9..45ac2fec 100644
--- a/spec/services/users/safe_settings_spec.rb
+++ b/spec/services/users/safe_settings_spec.rb
@@ -29,7 +29,8 @@ RSpec.describe Users::SafeSettings do
distance_unit: 'km',
visits_suggestions_enabled: true,
speed_color_scale: nil,
- fog_of_war_threshold: nil
+ fog_of_war_threshold: nil,
+ enabled_map_layers: ['Routes', 'Heatmap']
}
)
end
@@ -53,7 +54,8 @@ RSpec.describe Users::SafeSettings do
'photoprism_url' => 'https://photoprism.example.com',
'photoprism_api_key' => 'photoprism-key',
'maps' => { 'name' => 'custom', 'url' => 'https://custom.example.com' },
- 'visits_suggestions_enabled' => false
+ 'visits_suggestions_enabled' => false,
+ 'enabled_map_layers' => ['Points', 'Routes', 'Areas', 'Photos']
}
end
let(:safe_settings) { described_class.new(settings) }
@@ -76,7 +78,8 @@ RSpec.describe Users::SafeSettings do
"photoprism_url" => "https://photoprism.example.com",
"photoprism_api_key" => "photoprism-key",
"maps" => { "name" => "custom", "url" => "https://custom.example.com" },
- "visits_suggestions_enabled" => false
+ "visits_suggestions_enabled" => false,
+ "enabled_map_layers" => ['Points', 'Routes', 'Areas', 'Photos']
}
)
end
@@ -102,7 +105,8 @@ RSpec.describe Users::SafeSettings do
distance_unit: nil,
visits_suggestions_enabled: false,
speed_color_scale: nil,
- fog_of_war_threshold: nil
+ fog_of_war_threshold: nil,
+ enabled_map_layers: ['Points', 'Routes', 'Areas', 'Photos']
}
)
end
@@ -132,6 +136,7 @@ RSpec.describe Users::SafeSettings do
expect(safe_settings.photoprism_api_key).to be_nil
expect(safe_settings.maps).to eq({ "distance_unit" => "km" })
expect(safe_settings.visits_suggestions_enabled?).to be true
+ expect(safe_settings.enabled_map_layers).to eq(['Routes', 'Heatmap'])
end
end
@@ -153,7 +158,8 @@ RSpec.describe Users::SafeSettings do
'photoprism_url' => 'https://photoprism.example.com',
'photoprism_api_key' => 'photoprism-key',
'maps' => { 'name' => 'custom', 'url' => 'https://custom.example.com' },
- 'visits_suggestions_enabled' => false
+ 'visits_suggestions_enabled' => false,
+ 'enabled_map_layers' => ['Points', 'Tracks', 'Fog of War', 'Suggested Visits']
}
end
@@ -174,6 +180,7 @@ RSpec.describe Users::SafeSettings do
expect(safe_settings.photoprism_api_key).to eq('photoprism-key')
expect(safe_settings.maps).to eq({ 'name' => 'custom', 'url' => 'https://custom.example.com' })
expect(safe_settings.visits_suggestions_enabled?).to be false
+ expect(safe_settings.enabled_map_layers).to eq(['Points', 'Tracks', 'Fog of War', 'Suggested Visits'])
end
end
end