Merge pull request #130 from Freika/admin_flag

Admin flag

.app_version

@@ -1 +1 @@
-0.9.2
+0.9.3

CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/)
 and this project adheres to [Semantic Versioning](http://semver.org/).
 
+
+
+## [0.9.3] — 2024-07-19
+
+### Added
+
+- Admin flag to the database. Now not only the first user in the system can create new users, but also users with the admin flag set to true. This will make easier introduction of more admin functions in the future.
+
+### Fixed
+
+- Route hover distance is now being rendered in kilometers, not in meters, if route distance is more than 1 km.
+
+---
+
 ## [0.9.2] — 2024-07-19
 
 ### Fixed

app/controllers/application_controller.rb

@@ -13,10 +13,10 @@ class ApplicationController < ActionController::Base
     @unread_notifications ||= Notification.where(user: current_user).unread
   end
 
-  def authenticate_first_user!
-    return if current_user == User.first
+  def authenticate_admin!
+    return if current_user.admin?
 
-    redirect_to root_path, notice: 'You are not authorized to perform this action.', status: :unauthorized
+    redirect_to root_path, notice: 'You are not authorized to perform this action.', status: :see_other
   end
 
   def authenticate_api_key

app/controllers/settings/background_jobs_controller.rb

@@ -2,7 +2,7 @@
 
 class Settings::BackgroundJobsController < ApplicationController
   before_action :authenticate_user!
-  before_action :authenticate_first_user!
+  before_action :authenticate_admin!
 
   def index
     @queues = Sidekiq::Queue.all

app/controllers/settings/users_controller.rb

@@ -2,7 +2,7 @@
 
 class Settings::UsersController < ApplicationController
   before_action :authenticate_user!
-  before_action :authenticate_first_user!
+  before_action :authenticate_admin!
 
   def create
     @user = User.new(
@@ -12,7 +12,8 @@ class Settings::UsersController < ApplicationController
     )
 
     if @user.save
-      redirect_to settings_url, notice: "User was successfully created, email is #{@user.email}, password is \"password\"."
+      redirect_to settings_url,
+                  notice: "User was successfully created, email is #{@user.email}, password is \"password\"."
     else
       redirect_to settings_url, notice: 'User could not be created.', status: :unprocessable_entity
     end

app/javascript/controllers/maps_controller.js

@@ -244,7 +244,7 @@ export default class extends Controller {
       <b>Start:</b> ${firstTimestamp}<br>
       <b>End:</b> ${lastTimestamp}<br>
       <b>Duration:</b> ${timeOnRoute}<br>
-      <b>Distance:</b> ${Math.round(distance)}m<br>
+      <b>Distance:</b> ${this.formatDistance(distance)}<br>
     `;
 
     if (isDebugMode) {
@@ -335,4 +335,12 @@ export default class extends Controller {
       })
     ).addTo(map);
   }
+
+  formatDistance(distance) {
+    if (distance >= 1000) {
+      return (distance / 1000).toFixed(2) + ' km';
+    } else {
+      return distance.toFixed(0) + ' meters';
+    }
+  }
 }

app/views/shared/_navbar.html.erb

@@ -85,6 +85,9 @@
           <details>
             <summary>
               <%= "#{current_user.email}" %>
+              <% if current_user.admin? %>
+                <span class='tooltip tooltip-bottom' data-tip="You're an admin, Harry!">⭐️</span>
+              <% end %>
             </summary>
             <ul class="p-2 bg-base-100 rounded-t-none z-10">
               <li><%= link_to 'Account', edit_user_registration_path %></li>

config/routes.rb

@@ -5,7 +5,15 @@ require 'sidekiq/web'
 Rails.application.routes.draw do
   mount Rswag::Api::Engine => '/api-docs'
   mount Rswag::Ui::Engine => '/api-docs'
+  authenticate :user, ->(u) { u.admin? } do
     mount Sidekiq::Web => '/sidekiq'
+  end
+
+  # We want to return a nice error message if the user is not authorized to access Sidekiq
+  match '/sidekiq' => redirect { |_, request|
+                        request.flash[:error] = 'You are not authorized to perform this action.'
+                        '/'
+                      }, via: :get
 
   resources :settings, only: :index
   namespace :settings do

db/data/20240713103122_make_first_user_admin.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+class MakeFirstUserAdmin < ActiveRecord::Migration[7.1]
+  def up
+    user = User.first
+    user.update!(admin: true)
+  end
+
+  def down
+    user = User.first
+    user.update!(admin: false)
+  end
+end

db/migrate/20240713103051_add_admin_to_users.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class AddAdminToUsers < ActiveRecord::Migration[7.1]
+  def change
+    add_column :users, :admin, :boolean, default: false
+  end
+end

db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[7.1].define(version: 2024_07_12_141303) do
+ActiveRecord::Schema[7.1].define(version: 2024_07_13_103051) do
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
 
@@ -150,6 +150,7 @@ ActiveRecord::Schema[7.1].define(version: 2024_07_12_141303) do
     t.string "api_key", default: "", null: false
     t.string "theme", default: "dark", null: false
     t.jsonb "settings", default: {"fog_of_war_meters"=>"200", "meters_between_routes"=>"1000", "minutes_between_routes"=>"60"}
+    t.boolean "admin", default: false
     t.index ["email"], name: "index_users_on_email", unique: true
     t.index ["reset_password_token"], name: "index_users_on_reset_password_token", unique: true
   end

spec/factories/users.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 FactoryBot.define do
   factory :user do
     sequence :email do |n|
@@ -5,5 +7,9 @@ FactoryBot.define do
     end
 
     password { SecureRandom.hex(8) }
+
+    trait :admin do
+      admin { true }
+    end
   end
 end

spec/models/user_spec.rb

@@ -91,11 +91,10 @@ RSpec.describe User, type: :model do
     describe '#total_reverse_geocoded' do
       subject { user.total_reverse_geocoded }
 
-      let(:import) { create(:import, user:) }
       let!(:reverse_geocoded_point) do
-        create(:point, country: 'Country', city: 'City', geodata: { some: 'data' }, import:)
+        create(:point, country: 'Country', city: 'City', geodata: { some: 'data' }, user:)
       end
-      let!(:not_reverse_geocoded_point) { create(:point, country: 'Country', city: 'City', import:) }
+      let!(:not_reverse_geocoded_point) { create(:point, country: 'Country', city: 'City', user:) }
 
       it 'returns number of reverse geocoded points' do
         expect(subject).to eq(1)

spec/requests/settings/background_jobs_spec.rb

@@ -17,11 +17,19 @@ RSpec.describe '/settings/background_jobs', type: :request do
   end
 
   context 'when user is authenticated' do
-    let(:user) { create(:user) }
+    before { sign_in create(:user) }
 
-    before do
-      sign_in user
+    context 'when user is not an admin' do
+      it 'redirects to root page' do
+        get settings_background_jobs_url
+
+        expect(response).to redirect_to(root_url)
+        expect(flash[:notice]).to eq('You are not authorized to perform this action.')
       end
+    end
+
+    context 'when user is an admin' do
+      before { sign_in create(:user, :admin) }
 
       describe 'GET /index' do
         it 'renders a successful response' do
@@ -66,4 +74,5 @@ RSpec.describe '/settings/background_jobs', type: :request do
         end
       end
     end
+  end
 end

spec/requests/settings/users_spec.rb

@@ -3,14 +3,32 @@
 require 'rails_helper'
 
 RSpec.describe '/settings/users', type: :request do
-  before do
-    sign_in create(:user)
+  let(:valid_attributes) { { email: 'user@domain.com' } }
+
+  context 'when user is not authenticated' do
+    it 'redirects to sign in page' do
+      post settings_users_url, params: { user: valid_attributes }
+
+      expect(response).to redirect_to(new_user_session_url)
     end
+  end
+
+  context 'when user is authenticated' do
+    context 'when user is not an admin' do
+      before { sign_in create(:user) }
+
+      it 'redirects to root page' do
+        post settings_users_url, params: { user: valid_attributes }
+
+        expect(response).to redirect_to(root_url)
+      end
+    end
+
+    context 'when user is an admin' do
+      before { sign_in create(:user, :admin) }
 
       describe 'POST /create' do
         context 'with valid parameters' do
-      let(:valid_attributes) { { email: 'user@domain.com' } }
-
           it 'creates a new User' do
             expect do
               post settings_users_url, params: { user: valid_attributes }
@@ -41,4 +59,6 @@ RSpec.describe '/settings/users', type: :request do
           end
         end
       end
+    end
+  end
 end

spec/requests/sidekiq_spec.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe '/sidekiq', type: :request do
+  context 'when user is not authenticated' do
+    it 'redirects to sign in page' do
+      get sidekiq_url
+
+      expect(response).to redirect_to('/users/sign_in')
+    end
+  end
+
+  context 'when user is authenticated' do
+    context 'when user is not admin' do
+      before { sign_in create(:user) }
+
+      it 'redirects to root page' do
+        get sidekiq_url
+
+        expect(response).to redirect_to(root_url)
+      end
+
+      it 'shows flash message' do
+        get sidekiq_url
+
+        expect(flash[:error]).to eq('You are not authorized to perform this action.')
+      end
+    end
+
+    context 'when user is admin' do
+      before { sign_in create(:user, :admin) }
+
+      it 'renders a successful response' do
+        get sidekiq_url
+
+        expect(response).to be_successful
+      end
+    end
+  end
+end