5 files changed, 189 insertions, 14 deletions

diff --git a/test/controllers/content_controller_test.rb b/test/controllers/content_controller_test.rb
index e8bc55f..9731d08 100644
--- a/test/controllers/content_controller_test.rb
+++ b/test/controllers/content_controller_test.rb
@@ -73,8 +73,7 @@ class ContentControllerTest < ActionController::TestCase
   def test_nonexistant_custom_template_defaults_to_standard_template
     new_node = create_node_under_root "fnord"
     draft = find_or_create_draft(new_node, @user1)
-    draft.template_name = "huchibu"
-    draft.save
+    draft.update_column(:template_name, "huchibu")
     new_node.publish_draft!
     
     get :render_page, params: { :locale => 'de', :page_path => ["fnord"] }
@@ -105,6 +104,16 @@ class ContentControllerTest < ActionController::TestCase
     assert_response :success
     File.write("/tmp/no_fill_response.html", @response.body)
   end
+
+  test "render_gallery renders for a published page" do
+    node = Node.root.children.create!(:slug => "gallery_render_test")
+    Globalize.with_locale(I18n.default_locale) { node.draft.update!(:title => "Galerie") }
+    node.publish_draft!
+
+    get :render_gallery, params: { :page_path => "gallery_render_test", :locale => "de" }
+
+    assert_response :success
+  end
   
   protected
   
diff --git a/test/controllers/csp_reports_controller_test.rb b/test/controllers/csp_reports_controller_test.rb
new file mode 100644
index 0000000..7dd8c9e
--- /dev/null
+++ b/test/controllers/csp_reports_controller_test.rb
@@ -0,0 +1,8 @@
+require 'test_helper'
+
+class CspReportsControllerTest < ActionController::TestCase
+  test "accepts anonymous reports without CSRF" do
+    post :create, body: '{"csp-report":{"violated-directive":"script-src"}}'
+    assert_response :no_content
+  end
+end
diff --git a/test/controllers/node_actions_controller_test.rb b/test/controllers/node_actions_controller_test.rb
new file mode 100644
index 0000000..8bc68ec
--- /dev/null
+++ b/test/controllers/node_actions_controller_test.rb
@@ -0,0 +1,51 @@
+require 'test_helper'
+
+class NodeActionsControllerTest < ActionController::TestCase
+
+  def setup
+    login_as :quentin
+  end
+
+  def logged_node slug, title
+    node = Node.root.children.create!(:slug => slug)
+    Globalize.with_locale(I18n.default_locale) { node.draft.update!(:title => title) }
+    node
+  end
+
+  test "index renders" do
+    get :index
+    assert_response :success
+  end
+
+  test "index filters by node" do
+    node_a = logged_node("log_filter_a", "Alpha Subject")
+    node_b = logged_node("log_filter_b", "Beta Subject")
+    NodeAction.record!(:node => node_a, :action => "create", :user => users(:quentin))
+    NodeAction.record!(:node => node_b, :action => "create", :user => users(:quentin))
+
+    get :index, params: { :node_id => node_a.id }
+
+    assert_response :success
+    assert_includes    @response.body, "Alpha Subject"
+    assert_not_includes @response.body, "Beta Subject"
+  end
+
+  test "index filters by user" do
+    node = logged_node("log_filter_user", "Gamma Subject")
+    NodeAction.record!(:node => node, :action => "create", :user => users(:quentin))
+
+    get :index, params: { :user_id => users(:quentin).id }
+    assert_includes @response.body, "Gamma Subject"
+
+    other = User.where.not(:id => users(:quentin).id).first
+    get :index, params: { :user_id => other.id }
+    assert_not_includes @response.body, "Gamma Subject"
+  end
+
+  test "index requires login" do
+    session[:user_id] = nil
+    @controller.instance_variable_set(:@current_user, nil)
+    get :index
+    assert_response :redirect
+  end
+end
diff --git a/test/controllers/nodes_controller_test.rb b/test/controllers/nodes_controller_test.rb
index 9da9514..ddc4565 100644
--- a/test/controllers/nodes_controller_test.rb
+++ b/test/controllers/nodes_controller_test.rb
@@ -140,7 +140,7 @@ class NodesControllerTest < ActionController::TestCase
       :page => {
         :title => "Hello",
         :body => "There",
-        :template_name => "Foobar"
+        :template_name => "title_only"
       }
     }
 
@@ -148,7 +148,17 @@ class NodesControllerTest < ActionController::TestCase
     test_node.reload
     assert_equal "Hello", test_node.head.title
     assert_equal "There", test_node.head.body
-    assert_equal "Foobar", test_node.head.template_name
+    assert_equal "title_only", test_node.head.template_name
+  end
+
+  def test_update_rejects_a_template_name_not_on_disk
+    test_node = Node.root.children.create! :slug => "test_node"
+    login_as :quentin
+    put :update, params: { :id => test_node.id,
+                           :page => { :title => "Hello", :template_name => "Foobar" } }
+
+    test_node.reload
+    assert_not_equal "Foobar", test_node.draft&.template_name
   end
 
   test "publish draft with staged_slug unqueal slug" do
@@ -417,11 +427,11 @@ class NodesControllerTest < ActionController::TestCase
   test "show never renders a destroy link for events" do
     login_as :quentin
     node = create_node_with_published_page
-    Event.create!(node_id: node.id, start_time: Time.now, end_time: Time.now + 1.hour)
+    event = Event.create!(node_id: node.id, start_time: Time.now, end_time: Time.now + 1.hour)
 
     get :show, params: { id: node.id }
     assert_response :success
-    assert_select "form.button_to.destructive", count: 0
+    assert_select "form[action=?]", event_path(event), count: 0
   end
 
   test "reverting from nodes#show returns to the show page, not the editor, even if a draft remains" do
@@ -469,7 +479,8 @@ class NodesControllerTest < ActionController::TestCase
     login_as :quentin
     get :show, params: { :id => node.id }
     assert_response :success
-    assert_select "form.destructive", :count => 0
+    assert_select "form[action=?]", revert_node_path(node), count: 0
+    assert_select "form[action=?]", trash_node_path(node), count: 1
   end
 
   test "drafts includes a never-published node with only a draft" do
@@ -647,4 +658,103 @@ class NodesControllerTest < ActionController::TestCase
     assert_select ".sitemap_node_actions", :text => /Create Child/
     assert_select ".sitemap_node_actions", :text => /Revisions/, :count => 0
   end
+
+  test "create logs a create NodeAction with path and title" do
+    login_as :quentin
+
+    assert_difference "NodeAction.count" do
+      post :create, params: { :kind => "generic", :title => "Brand New", :parent_id => Node.root.id }
+    end
+
+    action = NodeAction.last
+    assert_equal "create",               action.action
+    assert_equal users(:quentin),        action.user
+    assert_equal Node.last,              action.node
+    assert_equal "Brand New",            action.metadata["title"]
+    assert_equal Node.last.unique_name,  action.metadata["path"]
+  end
+
+  test "trash moves the node and redirects to the Trash" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "trash_me")
+
+    put :trash, params: { :id => node.id }
+
+    assert_redirected_to trashed_nodes_path
+    assert node.reload.in_trash?
+  end
+
+  test "trashing the Trash node itself is refused" do
+    login_as :quentin
+
+    put :trash, params: { :id => Node.trash.id }
+
+    assert_redirected_to node_path(Node.trash)
+    assert flash[:error].present?
+  end
+
+  test "restore_from_trash reparents to the given parent" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "restore_me")
+    node.trash!(users(:quentin))
+    target = Node.root.children.create!(:slug => "restore_home")
+
+    put :restore_from_trash, params: { :id => node.id, :parent_id => target.id }
+
+    assert_redirected_to node_path(node)
+    assert_equal target, node.reload.parent
+  end
+
+  test "destroy refuses a node outside the Trash" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "not_deletable_here")
+
+    delete :destroy, params: { :id => node.id }
+
+    assert Node.exists?(node.id)
+    assert flash[:error].present?
+  end
+
+  test "destroy deletes a trashed node and redirects to the Trash" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "deletable")
+    node.trash!(users(:quentin))
+
+    delete :destroy, params: { :id => node.id }
+
+    assert_not Node.exists?(node.id)
+    assert_redirected_to trashed_nodes_path
+  end
+
+  test "trash lists trashed subtree roots" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "listed_in_trash")
+    node.trash!(users(:quentin))
+
+    get :trashed
+    assert_response :success
+    assert_select "a[href=?]", node_path(node)
+  end
+
+  test "trashed rows carry provenance and a delete for childless roots" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "provenance_test")
+    node.trash!(users(:quentin))
+
+    get :trashed
+    assert_select "td", /quentin/
+    assert_select "form[action=?]", node_path(node), count: 1
+  end
+
+test "show annotates history rows with their lifecycle" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "history_annotation_test")
+    Globalize.with_locale(I18n.default_locale) { node.draft.update!(:title => "Annotated") }
+    node.publish_draft!(users(:quentin))
+
+    get :show, params: { :id => node.id }
+
+    assert_response :success
+    assert_select "span.revision_lifecycle", /quentin/
+  end
 end
diff --git a/test/controllers/page_translations_controller_test.rb b/test/controllers/page_translations_controller_test.rb
index 82f8bce..feaacd0 100644
--- a/test/controllers/page_translations_controller_test.rb
+++ b/test/controllers/page_translations_controller_test.rb
@@ -83,18 +83,15 @@ class PageTranslationsControllerTest < ActionController::TestCase
     assert_equal "in progress", Globalize.with_locale(:en) { node.autosave.title }
   end
 
-  test "destroy logs a translation_destroy NodeAction" do
+  test "destroy removes the translation, logs nothing, and redirects" do
     login_as :quentin
     node = Node.root.children.create!(:slug => "translation_destroy_log_test")
     Globalize.with_locale(:en) { node.draft.update!(:title => "English title") }
 
-    delete :destroy, params: { :node_id => node.id, :translation_locale => "en" }
+    assert_no_difference "NodeAction.count" do
+      delete :destroy, params: { :node_id => node.id, :translation_locale => "en" }
+    end
 
-    action = NodeAction.last
-    assert_equal node, action.node
-    assert_equal "en", action.locale
-    assert_equal "translation_destroy", action.action
-    assert_equal users(:quentin), action.user
     assert_redirected_to node_path(node)
   end
 end