Finish user edit, update, index, and destroy action

khin-alu · khin-alu · commit ae7bde8fb6ac · 2025-09-22T13:09:06.000+07:00
diff --git a/Gemfile b/Gemfile
@@ -6,6 +6,8 @@ ruby "3.4.3"
 gem "rails", "8.0.2"
 gem "jsbundling-rails", "1.3.1"
 gem "bcrypt", "3.1.13"
+gem "faker", "3.5.2"
+gem "will_paginate", "4.0.1"
 gem "cssbundling-rails", "1.4.3"
 gem "propshaft", "1.2.1"
 gem "importmap-rails", "2.1.0"
diff --git a/Gemfile.lock b/Gemfile.lock
@@ -108,6 +108,8 @@ GEM
     ed25519 (1.4.0)
     erb (5.0.2)
     erubi (1.13.1)
+    faker (3.5.2)
+      i18n (>= 1.8.11, < 2)
     ffi (1.17.2-aarch64-linux-gnu)
     ffi (1.17.2-aarch64-linux-musl)
     ffi (1.17.2-arm-linux-gnu)
@@ -336,6 +338,7 @@ GEM
       base64
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)
+    will_paginate (4.0.1)
     xpath (3.2.0)
       nokogiri (~> 1.8)
     zeitwerk (2.7.3)
@@ -355,6 +358,7 @@ DEPENDENCIES
   capybara (= 3.40.0)
   cssbundling-rails (= 1.4.3)
   debug (= 1.11.0)
+  faker (= 3.5.2)
   guard (= 2.19.1)
   guard-minitest (= 2.4.6)
   importmap-rails (= 2.1.0)
@@ -376,6 +380,7 @@ DEPENDENCIES
   tzinfo-data (= 1.2025.2)
   web-console (= 4.2.1)
   webdrivers (= 5.3.1)
+  will_paginate (= 4.0.1)
 
 RUBY VERSION
    ruby 3.4.3p32
diff --git a/app/assets/stylesheets/application.bootstrap.scss b/app/assets/stylesheets/application.bootstrap.scss
@@ -204,3 +204,14 @@ input {
   width: auto;
   margin-left: 0;
 }
+
+/* Users index */
+.users {
+  list-style: none;
+  margin: 0;
+  li {
+    overflow: auto;
+    padding: 10px 0;
+    border-bottom: 1px solid $gray-500;
+  }
+}
diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb
@@ -5,10 +5,11 @@ def new
   def create
     user = User.find_by(email: params[:session][:email].downcase)
     if user && user.authenticate(params[:session][:password])
+      forwarding_url = session[:forwarding_url]
       reset_session
       params[:session][:remember_me] == "1" ? remember(user) : forget(user)
       log_in user
-      redirect_to user
+      redirect_to forwarding_url || user
     else
       flash.now[:danger] = "Invalid email/password combination"
       render "new", status: :unprocessable_entity
diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
@@ -1,4 +1,8 @@
 class UsersController < ApplicationController
+  before_action :logged_in_user, only: [:index, :edit, :update, :destroy]
+  before_action :correct_user, only: [:edit, :update]
+  before_action :admin_user, only: :destroy
+
   def show
     @user = User.find(params[:id])
   end
@@ -19,10 +23,56 @@ def create
     end
   end
 
+  def edit
+    # @user = User.find(params[:id])
+  end
+
+  def update
+    if @user.update(user_params)
+      flash[:success] = "Profile updated"
+      redirect_to @user
+    else
+      render "edit", status: :unprocessable_entity
+    end
+  end
+
+  def show
+    @user = User.find(params[:id])
+  end
+
+  def index
+    @users = User.paginate(page: params[:page])
+  end
+
+  def destroy
+    User.find(params[:id]).destroy
+    flash[:success] = "User deleted"
+    redirect_to users_url, status: :see_other
+  end
+
   private
 
   def user_params
     params.require(:user).permit(:name, :email, :password,
                                  :password_confirmation)
   end
+
+  def logged_in_user
+    unless logged_in?
+      store_location
+      flash[:danger] = "Please log in."
+      redirect_to login_url, status: :see_other
+    end
+  end
+
+  # Confirms the correct user.
+  def correct_user
+    @user = User.find(params[:id])
+    redirect_to(root_url, status: :see_other) unless current_user?(@user)
+  end
+
+  # Confirms an admin user.
+  def admin_user
+    redirect_to(root_url, status: :see_other) unless current_user.admin?
+  end
 end
diff --git a/app/helpers/sessions_helper.rb b/app/helpers/sessions_helper.rb
@@ -31,6 +31,11 @@ def current_user
     end
   end
 
+  # Returns true if the given user is the current user.
+  def current_user?(user)
+    user && user == current_user
+  end
+
   # Returns true if the user is logged in, false otherwise.
   def logged_in?
     !current_user.nil?
@@ -49,4 +54,9 @@ def log_out
     reset_session
     @current_user = nil
   end
-end
+
+  # Stores the URL trying to be accessed.
+  def store_location
+    session[:forwarding_url] = request.original_url if request.get?
+  end
+end
diff --git a/app/helpers/users_helper.rb b/app/helpers/users_helper.rb
@@ -1,7 +1,8 @@
 module UsersHelper
   # Returns the Gravatar for the given user.
   # Returns the Gravatar for the given user.
-  def gravatar_for(user, size: 80)
+  def gravatar_for(user, options = { size: 80 })
+    size = options[:size]
     gravatar_id = Digest::MD5::hexdigest(user.email.downcase)
     gravatar_url = "https://secure.gravatar.com/avatar/#{gravatar_id}?s=#{size}"
     image_tag(gravatar_url, alt: user.name, class: "gravatar")
diff --git a/app/models/user.rb b/app/models/user.rb
@@ -7,7 +7,7 @@ class User < ApplicationRecord
                     format: { with: VALID_EMAIL_REGEX },
                     uniqueness: true
   has_secure_password
-  validates :password, presence: true, length: { minimum: 6 }
+  validates :password, presence: true, length: { minimum: 6 }, allow_nil: true
   # Returns the hash digest of the given string.
   def User.digest(string)
     cost = ActiveModel::SecurePassword.min_cost ? BCrypt::Engine::MIN_COST :
diff --git a/app/views/layouts/_header.html.erb b/app/views/layouts/_header.html.erb
@@ -5,8 +5,8 @@
             <button class="navbar-toggler" type="button" data-bs-toggle="collapse" data-bs-target="#navbarNavDropdown" aria-controls="navbarNavDropdown" aria-expanded="false" aria-label="Toggle navigation">
                 <span class="navbar-toggler-icon"></span>
             </button>
+            <span class="visually-hidden">Toggle navigation</span>
             <div class="collapse navbar-collapse" id="navbarNavDropdown">
-
                 <ul class="navbar-nav ms-auto">
                     <li class="nav-item">
                         <%= link_to "Home", root_path, class: "nav-link" %>
@@ -15,15 +15,14 @@
                         <%= link_to "Help", help_path, class: "nav-link" %>
                     </li>
                     <% if logged_in? %>
-                    <li><%= link_to "Users", '#', class: "nav-link" %></li>
+                    <li><%= link_to "Users", users_path, class: "nav-link" %></li>
                     <li class="dropdown nav-link">
-
                         <a href="#" id="account" class="dropdown-toggle" data-bs-toggle="dropdown">
                             Account <b class="caret"></b>
                         </a>
                         <ul id="dropdown-menu" class="dropdown-menu">
                             <li><%= link_to "Profile", current_user %></li>
-                            <li><%= link_to "Settings", '#' %></li>
+                            <li><%= link_to "Settings", edit_user_path(current_user) %></li>
                             <li class="divider"></li>
                             <li>
                                 <%= link_to "Log out", logout_path,
diff --git a/app/views/users/_user.html.erb b/app/views/users/_user.html.erb
@@ -0,0 +1,8 @@
+<li>
+    <%= gravatar_for user, size: 50 %>
+    <%= link_to user.name, user %>
+    <% if current_user.admin? && !current_user?(user) %>
+    | <%= link_to "delete", user, data: { "turbo-method": :delete,
+turbo_confirm: "You sure?" } %>
+    <% end %>
+</li>
diff --git a/app/views/users/edit.html.erb b/app/views/users/edit.html.erb
@@ -0,0 +1,22 @@
+<% provide(:title, "Edit user") %>
+<h1>Update your profile</h1>
+<div class="row">
+    <div class="col-md-6 offset-md-3">
+        <%= form_with(model: @user) do |f| %>
+        <%= render 'shared/error_messages' %>
+        <%= f.label :name %>
+        <%= f.text_field :name, class: 'form-control' %>
+        <%= f.label :email %>
+        <%= f.email_field :email, class: 'form-control' %>
+        <%= f.label :password %>
+        <%= f.password_field :password, class: 'form-control' %>
+        <%= f.label :password_confirmation, "Confirmation" %>
+        <%= f.password_field :password_confirmation, class: 'form-control' %>
+        <%= f.submit "Save changes", class: "btn btn-primary" %>
+        <% end %>
+        <div class="gravatar_edit">
+            <%= gravatar_for @user %>
+            <a href="https://gravatar.com/emails" target="_blank">change</a>
+        </div>
+    </div>
+</div>
diff --git a/app/views/users/index.html.erb b/app/views/users/index.html.erb
@@ -0,0 +1,7 @@
+<% provide(:title, 'All users') %>
+<h1>All users</h1>
+<%= will_paginate %>
+<ul class="users">
+<%= render @users %>
+</ul>
+<%= will_paginate %>
diff --git a/db/migrate/20250922053704_add_admin_to_users.rb b/db/migrate/20250922053704_add_admin_to_users.rb
@@ -0,0 +1,5 @@
+class AddAdminToUsers < ActiveRecord::Migration[8.0]
+  def change
+    add_column :users, :admin, :boolean, default: false
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
diff --git a/db/seeds.rb b/db/seeds.rb
@@ -1,9 +1,16 @@
-# This file should ensure the existence of records required to run the application in every environment (production,
-# development, test). The code here should be idempotent so that it can be executed at any point in every environment.
-# The data can then be loaded with the bin/rails db:seed command (or created alongside the database with db:setup).
-#
-# Example:
-#
-#   ["Action", "Comedy", "Drama", "Horror"].each do |genre_name|
-#     MovieGenre.find_or_create_by!(name: genre_name)
-#   end
+# Create a main sample user.
+User.create!(name: "Example User",
+             email: "example@railstutorial.org",
+             password: "foobar",
+             password_confirmation: "foobar",
+             admin: true)
+# Generate a bunch of additional users.
+99.times do |n|
+  name = Faker::Name.name
+  email = "example-#{n + 1}@railstutorial.org"
+  password = "password"
+  User.create!(name: name,
+               email: email,
+               password: password,
+               password_confirmation: password)
+end
diff --git a/test/controllers/users_controller_test.rb b/test/controllers/users_controller_test.rb
@@ -1,8 +1,60 @@
 require "test_helper"
 
 class UsersControllerTest < ActionDispatch::IntegrationTest
+  def setup
+    @user = users(:michael)
+    @other_user = users(:archer)
+  end
+
   test "should get new" do
     get signup_path
     assert_response :success
   end
+
+  test "should redirect index when not logged in" do
+    get users_path
+    assert_redirected_to login_url
+  end
+
+  test "should redirect edit when not logged in" do
+    get edit_user_path(@user)
+    assert_not flash.empty?
+    assert_redirected_to login_url
+  end
+  test "should redirect update when not logged in" do
+    patch user_path(@user), params: { user: { name: @user.name,
+                                             email: @user.email } }
+    assert_not flash.empty?
+    assert_redirected_to login_url
+  end
+
+  test "should redirect edit when logged in as wrong user" do
+    log_in_as(@other_user)
+    get edit_user_path(@user)
+    assert flash.empty?
+    assert_redirected_to root_url
+  end
+  test "should redirect update when logged in as wrong user" do
+    log_in_as(@other_user)
+    patch user_path(@user), params: { user: { name: @user.name,
+                                             email: @user.email } }
+    assert flash.empty?
+    assert_redirected_to root_url
+  end
+
+  test "should redirect destroy when not logged in" do
+    assert_no_difference "User.count" do
+      delete user_path(@user)
+    end
+    assert_response :see_other
+    assert_redirected_to login_url
+  end
+  test "should redirect destroy when logged in as a non-admin" do
+    log_in_as(@other_user)
+    assert_no_difference "User.count" do
+      delete user_path(@user)
+    end
+    assert_response :see_other
+    assert_redirected_to root_url
+  end
 end
diff --git a/test/fixtures/users.yml b/test/fixtures/users.yml
@@ -3,4 +3,27 @@
 michael:
   name: Michael Example
   email: michael@example.com
-  password_digest: <%= User.digest('password') %>
+  password_digest: <%= User.digest('password') %>
+  admin: true
+
+archer:
+  name: Sterling Archer
+  email: duchess@example.gov
+  password_digest: <%= User.digest('password') %>
+
+lana:
+  name: Lana Kane
+  email: hands@example.gov
+  password_digest: <%= User.digest('password') %>
+
+malory:
+  name: Malory Archer
+  email: boss@example.gov
+  password_digest: <%= User.digest('password') %>
+
+<% 30.times do |n| %>
+user_<%= n %>:
+  name: <%= "User #{n}" %>
+  email: <%= "user-#{n}@example.com" %>
+  password_digest: <%= User.digest('password') %>
+<% end %>
diff --git a/test/integration/users_edit_test.rb b/test/integration/users_edit_test.rb
diff --git a/test/integration/users_index_test.rb b/test/integration/users_index_test.rb
