feat(platform): add protected attribute to CSS blocks to prevent deletion

feat(block_attributes): include Protected module for better content management
fix(factory): update user factory to use confirmed trait for test consistency
test(platforms_controller): enhance CSS block update tests for better coverage

Author: rsmithlal

app/models/better_together/platform.rb

@@ -69,11 +69,21 @@ def css_block?
     end
 
     def css_block_attributes=(attrs = {})
+      # Clear memoized css_block to ensure we get the latest state
+      @css_block = nil
+
+      new_attrs = attrs.except(:type).merge(protected: true, privacy: 'public')
+
       block = blocks.find_by(type: 'BetterTogether::Content::Css')
       if block
-        block.update(attrs.except(:type))
+        # Update the existing block directly and save it
+        block.update!(new_attrs)
+        @css_block = block
       else
-        platform_blocks.build(block: BetterTogether::Content::Css.new(attrs.except(:type)))
+        # Platform CSS blocks should be protected from deletion
+        new_block = BetterTogether::Content::Css.new(new_attrs)
+        platform_blocks.build(block: new_block)
+        @css_block = new_block
       end
     end
 

app/models/concerns/better_together/content/block_attributes.rb

@@ -22,6 +22,7 @@ module BlockAttributes # rubocop:todo Metrics/ModuleLength, Style/Documentation
 
         include ::BetterTogether::Creatable
         include ::BetterTogether::Privacy
+        include ::BetterTogether::Protected
         include ::BetterTogether::Translatable
         include ::BetterTogether::Visible
 

db/migrate/20251107221537_add_protected_to_better_together_content_blocks.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+# Adds protected column to prevent deletion of platform-critical blocks
+class AddProtectedToBetterTogetherContentBlocks < ActiveRecord::Migration[8.0]
+  def change
+    change_table :better_together_content_blocks, bulk: true, &:bt_protected
+  end
+end

spec/factories/better_together/users.rb

@@ -8,7 +8,7 @@
           aliases: %i[user]) do
     id { Faker::Internet.uuid }
     email { Faker::Internet.unique.email }
-    password { Faker::Internet.password(min_length: 12, max_length: 20) }
+    password { 'SecureTest123!@#' }
 
     person
 

spec/requests/better_together/platforms_controller_spec.rb

@@ -19,16 +19,230 @@
   end
 
   describe 'PATCH /:locale/.../host/platforms/:id' do
+    let(:host_platform) { BetterTogether::Platform.find_by(host: true) }
+
     # rubocop:todo RSpec/MultipleExpectations
     it 'updates settings and redirects' do # rubocop:todo RSpec/MultipleExpectations
       # rubocop:enable RSpec/MultipleExpectations
-      host_platform = BetterTogether::Platform.find_by(host: true)
       patch better_together.platform_path(locale:, id: host_platform.slug), params: {
         platform: { url: host_platform.url, time_zone: host_platform.time_zone, requires_invitation: true }
       }
       expect(response).to have_http_status(:see_other)
       follow_redirect!
       expect(response).to have_http_status(:ok)
     end
+
+    context 'when updating CSS block' do
+      context 'when platform has no existing CSS block' do # rubocop:todo RSpec/NestedGroups
+        before do
+          # Ensure platform starts without a CSS block
+          host_platform.blocks.where(type: 'BetterTogether::Content::Css').destroy_all
+          host_platform.reload
+        end
+
+        it 'creates a new CSS block with content' do # rubocop:todo RSpec/MultipleExpectations
+          css_content = '.my-custom-class { color: blue; }'
+
+          expect do
+            patch better_together.platform_path(locale:, id: host_platform.slug), params: {
+              platform: {
+                url: host_platform.url,
+                time_zone: host_platform.time_zone,
+                css_block_attributes: {
+                  type: 'BetterTogether::Content::Css',
+                  identifier: 'platform-custom-css',
+                  "content_#{locale}": css_content
+                }
+              }
+            }
+          end.to change { host_platform.reload.css_block.present? }.from(false).to(true)
+
+          expect(response).to have_http_status(:see_other)
+
+          css_block = host_platform.reload.css_block
+          expect(css_block).to be_present
+          expect(css_block.content).to eq(css_content)
+          expect(css_block.identifier).to eq('platform-custom-css')
+          expect(css_block.protected).to be(true)
+        end
+
+        it 'creates CSS block with complex real-world CSS' do # rubocop:todo RSpec/MultipleExpectations
+          complex_css = <<~CSS
+            .notification form[action*="mark_as_read"] .btn[type="submit"] { z-index: 1200; }
+            .card.journey-stage > .card-body { max-height: 50vh; }
+            @media only screen and (min-width: 768px) {
+              .hero-heading { font-size: 3em; }
+            }
+          CSS
+
+          patch better_together.platform_path(locale:, id: host_platform.slug), params: {
+            platform: {
+              url: host_platform.url,
+              time_zone: host_platform.time_zone,
+              css_block_attributes: {
+                type: 'BetterTogether::Content::Css',
+                identifier: 'platform-custom-css',
+                "content_#{locale}": complex_css
+              }
+            }
+          }
+
+          expect(response).to have_http_status(:see_other)
+
+          css_block = host_platform.reload.css_block
+          expect(css_block.content).to eq(complex_css)
+        end
+      end
+
+      context 'when platform has existing CSS block' do # rubocop:todo RSpec/NestedGroups
+        let(:existing_css_block) do
+          create(:better_together_content_css,
+                 identifier: 'existing-platform-css',
+                 content_text: '.old-class { color: red; }',
+                 protected: true)
+        end
+
+        before do
+          # Associate existing CSS block with platform
+          host_platform.platform_blocks.create!(block: existing_css_block)
+          host_platform.reload
+        end
+
+        it 'updates existing CSS block content' do # rubocop:todo RSpec/MultipleExpectations
+          new_css_content = '.updated-class { color: green; }'
+
+          patch better_together.platform_path(locale:, id: host_platform.slug), params: {
+            platform: {
+              url: host_platform.url,
+              time_zone: host_platform.time_zone,
+              css_block_attributes: {
+                id: existing_css_block.id,
+                type: 'BetterTogether::Content::Css',
+                identifier: existing_css_block.identifier,
+                "content_#{locale}": new_css_content
+              }
+            }
+          }
+
+          expect(response).to have_http_status(:see_other)
+
+          existing_css_block.reload
+          expect(existing_css_block.content).to eq(new_css_content)
+        end
+
+        it 'preserves CSS block ID when updating' do # rubocop:todo RSpec/MultipleExpectations
+          original_id = existing_css_block.id
+          new_css_content = '.another-class { font-size: 14px; }'
+
+          patch better_together.platform_path(locale:, id: host_platform.slug), params: {
+            platform: {
+              url: host_platform.url,
+              time_zone: host_platform.time_zone,
+              css_block_attributes: {
+                id: existing_css_block.id,
+                type: 'BetterTogether::Content::Css',
+                identifier: existing_css_block.identifier,
+                "content_#{locale}": new_css_content
+              }
+            }
+          }
+
+          expect(response).to have_http_status(:see_other)
+
+          css_block = host_platform.reload.css_block
+          expect(css_block.id).to eq(original_id)
+          expect(css_block.content).to eq(new_css_content)
+        end
+
+        it 'handles CSS with special characters and quotes' do # rubocop:todo RSpec/MultipleExpectations
+          css_with_quotes = <<~CSS
+            .notification form[action*="mark_as_read"] .btn[type="submit"] {
+              z-index: 1200;
+              position: relative;
+            }
+            .trix-content a[href]:not([href*="example.com"])::after {
+              content: "\\f35d";
+              font-family: "Font Awesome 6 Free";
+            }
+          CSS
+
+          patch better_together.platform_path(locale:, id: host_platform.slug), params: {
+            platform: {
+              url: host_platform.url,
+              time_zone: host_platform.time_zone,
+              css_block_attributes: {
+                id: existing_css_block.id,
+                type: 'BetterTogether::Content::Css',
+                identifier: existing_css_block.identifier,
+                "content_#{locale}": css_with_quotes
+              }
+            }
+          }
+
+          expect(response).to have_http_status(:see_other)
+
+          existing_css_block.reload
+          expect(existing_css_block.content).to eq(css_with_quotes)
+          # Verify special characters are preserved
+          expect(existing_css_block.content).to include('[action*="mark_as_read"]')
+          expect(existing_css_block.content).to include('content: "\\f35d"')
+        end
+
+        it 'clears CSS content when empty string submitted' do # rubocop:todo RSpec/MultipleExpectations
+          patch better_together.platform_path(locale:, id: host_platform.slug), params: {
+            platform: {
+              url: host_platform.url,
+              time_zone: host_platform.time_zone,
+              css_block_attributes: {
+                id: existing_css_block.id,
+                type: 'BetterTogether::Content::Css',
+                identifier: existing_css_block.identifier,
+                "content_#{locale}": ''
+              }
+            }
+          }
+
+          expect(response).to have_http_status(:see_other)
+
+          existing_css_block.reload
+          expect(existing_css_block.content).to be_blank
+        end
+      end
+
+      context 'when CSS block update fails validation' do # rubocop:todo RSpec/NestedGroups
+        let(:existing_css_block) do
+          create(:better_together_content_css,
+                 identifier: 'existing-platform-css',
+                 content_text: '.old-class { color: red; }',
+                 protected: true)
+        end
+
+        before do
+          host_platform.platform_blocks.create!(block: existing_css_block)
+          host_platform.reload
+
+          # Stub validation to force failure
+          allow_any_instance_of(BetterTogether::Platform).to receive(:update).and_return(false) # rubocop:todo RSpec/AnyInstance
+        end
+
+        it 'renders edit form with unprocessable_content status' do # rubocop:todo RSpec/MultipleExpectations
+          patch better_together.platform_path(locale:, id: host_platform.slug), params: {
+            platform: {
+              url: host_platform.url,
+              time_zone: host_platform.time_zone,
+              css_block_attributes: {
+                id: existing_css_block.id,
+                type: 'BetterTogether::Content::Css',
+                identifier: existing_css_block.identifier,
+                "content_#{locale}": '.new-class { color: blue; }'
+              }
+            }
+          }
+
+          expect(response).to have_http_status(:unprocessable_content)
+          expect(response).to render_template(:edit)
+        end
+      end
+    end
   end
 end

spec/support/test_seed_helpers.rb

@@ -7,13 +7,11 @@
     user_email = '[email protected]'
 
     unless BetterTogether::User.find_by(email: manager_email)
-      person = BetterTogether::Person.create!(name: 'Manager Person')
-      BetterTogether::User.create!(email: manager_email, password: 'SecureTest123!@#', person: person)
+      FactoryBot.create(:better_together_user, :confirmed, email: manager_email)
     end
 
     unless BetterTogether::User.find_by(email: user_email)
-      person = BetterTogether::Person.create!(name: 'Test User')
-      BetterTogether::User.create!(email: user_email, password: 'SecureTest123!@#', person: person)
+      FactoryBot.create(:better_together_user, :confirmed, email: user_email)
     end
   end
 end