test: add tests for approval ui

test/mv_web/plugs/check_page_permission_test.exs

@@ -212,6 +212,72 @@ defmodule MvWeb.Plugs.CheckPagePermissionTest do
     end
   end
 
+  describe "join_requests routes (approval UI, Step 2)" do
+    test "normal_user can access /join_requests" do
+      user = Fixtures.user_with_role_fixture("normal_user")
+      conn = conn_with_user("/join_requests", user) |> CheckPagePermission.call([])
+
+      refute conn.halted
+    end
+
+    test "normal_user can access /join_requests/:id" do
+      request = Fixtures.submitted_join_request_fixture()
+      user = Fixtures.user_with_role_fixture("normal_user")
+      conn = conn_with_user("/join_requests/#{request.id}", user) |> CheckPagePermission.call([])
+
+      refute conn.halted
+    end
+
+    test "read_only cannot access /join_requests" do
+      user = Fixtures.user_with_role_fixture("read_only")
+      conn = conn_with_user("/join_requests", user) |> CheckPagePermission.call([])
+
+      assert conn.halted
+      assert redirected_to(conn) == "/users/#{user.id}"
+    end
+
+    test "read_only cannot access /join_requests/:id" do
+      request = Fixtures.submitted_join_request_fixture()
+      user = Fixtures.user_with_role_fixture("read_only")
+      conn = conn_with_user("/join_requests/#{request.id}", user) |> CheckPagePermission.call([])
+
+      assert conn.halted
+      assert redirected_to(conn) == "/users/#{user.id}"
+    end
+
+    test "own_data cannot access /join_requests" do
+      user = Fixtures.user_with_role_fixture("own_data")
+      conn = conn_with_user("/join_requests", user) |> CheckPagePermission.call([])
+
+      assert conn.halted
+      assert redirected_to(conn) == "/users/#{user.id}"
+    end
+
+    test "own_data cannot access /join_requests/:id" do
+      request = Fixtures.submitted_join_request_fixture()
+      user = Fixtures.user_with_role_fixture("own_data")
+      conn = conn_with_user("/join_requests/#{request.id}", user) |> CheckPagePermission.call([])
+
+      assert conn.halted
+      assert redirected_to(conn) == "/users/#{user.id}"
+    end
+
+    test "admin can access /join_requests" do
+      user = Fixtures.user_with_role_fixture("admin")
+      conn = conn_with_user("/join_requests", user) |> CheckPagePermission.call([])
+
+      refute conn.halted
+    end
+
+    test "admin can access /join_requests/:id" do
+      request = Fixtures.submitted_join_request_fixture()
+      user = Fixtures.user_with_role_fixture("admin")
+      conn = conn_with_user("/join_requests/#{request.id}", user) |> CheckPagePermission.call([])
+
+      refute conn.halted
+    end
+  end
+
   describe "error handling" do
     test "user with no role is denied" do
       user = Fixtures.user_with_role_fixture("admin")
@@ -429,6 +495,22 @@ defmodule MvWeb.Plugs.CheckPagePermissionTest do
       conn = get(conn, "/admin/roles/#{id}/edit")
       assert redirected_to(conn) == "/users/#{user.id}"
     end
+
+    @tag role: :member
+    test "GET /join_requests redirects to user profile", %{conn: conn, current_user: user} do
+      conn = get(conn, "/join_requests")
+      assert redirected_to(conn) == "/users/#{user.id}"
+    end
+
+    @tag role: :member
+    test "GET /join_requests/:id redirects to user profile", %{
+      conn: conn,
+      current_user: user
+    } do
+      request = Fixtures.submitted_join_request_fixture()
+      conn = get(conn, "/join_requests/#{request.id}")
+      assert redirected_to(conn) == "/users/#{user.id}"
+    end
   end
 
   describe "integration: Mitglied (own_data) can access allowed paths via full router" do
@@ -713,15 +795,37 @@ defmodule MvWeb.Plugs.CheckPagePermissionTest do
       conn = get(conn, "/admin/roles/#{id}")
       assert redirected_to(conn) == "/users/#{user.id}"
     end
+
+    @tag role: :read_only
+    test "GET /join_requests redirects to user profile", %{conn: conn, current_user: user} do
+      conn = get(conn, "/join_requests")
+      assert redirected_to(conn) == "/users/#{user.id}"
+    end
+
+    @tag role: :read_only
+    test "GET /join_requests/:id redirects to user profile", %{
+      conn: conn,
+      current_user: user
+    } do
+      request = Fixtures.submitted_join_request_fixture()
+      conn = get(conn, "/join_requests/#{request.id}")
+      assert redirected_to(conn) == "/users/#{user.id}"
+    end
   end
 
-  # normal_user (Kassenwart): allowed /, /members, /members/new, /members/:id, /members/:id/edit, /groups, /groups/:slug
+  # normal_user (Kassenwart): allowed /, /members, /members/new, /members/:id, /members/:id/edit, /groups, /groups/:slug, /join_requests
   describe "integration: normal_user (Kassenwart) allowed paths via full router" do
     setup %{conn: conn, current_user: current_user} do
       member = Mv.Fixtures.member_fixture()
       group = Mv.Fixtures.group_fixture()
+      join_request = Fixtures.submitted_join_request_fixture()
 
-      {:ok, conn: conn, current_user: current_user, member_id: member.id, group_slug: group.slug}
+      {:ok,
+       conn: conn,
+       current_user: current_user,
+       member_id: member.id,
+       group_slug: group.slug,
+       join_request_id: join_request.id}
     end
 
     @tag role: :normal_user
@@ -804,6 +908,18 @@ defmodule MvWeb.Plugs.CheckPagePermissionTest do
       conn = get(conn, "/users/#{user.id}/show/edit")
       assert conn.status == 200
     end
+
+    @tag role: :normal_user
+    test "GET /join_requests returns 200", %{conn: conn} do
+      conn = get(conn, "/join_requests")
+      assert conn.status == 200
+    end
+
+    @tag role: :normal_user
+    test "GET /join_requests/:id returns 200", %{conn: conn, join_request_id: id} do
+      conn = get(conn, "/join_requests/#{id}")
+      assert conn.status == 200
+    end
   end
 
   describe "integration: normal_user denied paths via full router" do