7 files changed, 563 insertions, 0 deletions

diff --git a/test/models/concerns/rrule_humanizer_test.rb b/test/models/concerns/rrule_humanizer_test.rb
index 279ff73..d747171 100644
--- a/test/models/concerns/rrule_humanizer_test.rb
+++ b/test/models/concerns/rrule_humanizer_test.rb
@@ -47,6 +47,24 @@ class RruleHumanizerTest < ActiveSupport::TestCase
     assert_equal "Every second-to-last Thursday of the month", humanize("FREQ=MONTHLY;BYDAY=-2TH", :en)
   end
 
+  test "monthly selected weeks" do
+    assert_equal "Jeden ersten, zweiten und fünften Dienstag im Monat",
+      humanize("FREQ=MONTHLY;BYDAY=1TU,2TU,5TU")
+    assert_equal "Every first, second and fifth Tuesday of the month",
+      humanize("FREQ=MONTHLY;BYDAY=1TU,2TU,5TU", :en)
+  end
+
+  test "monthly fifth weekday" do
+    assert_equal "Jeden fünften Dienstag im Monat", humanize("FREQ=MONTHLY;BYDAY=5TU")
+    assert_equal "Every fifth Tuesday of the month", humanize("FREQ=MONTHLY;BYDAY=5TU", :en)
+  end
+
+  test "monthly weekday excluding one ordinal" do
+    rrule = "FREQ=MONTHLY;BYDAY=1TU,3TU,4TU,5TU"
+    assert_equal "Jeden Dienstag im Monat, außer dem zweiten Dienstag", humanize(rrule)
+    assert_equal "Every Tuesday of the month, except the second Tuesday", humanize(rrule, :en)
+  end
+
   test "monthly no byday" do
     assert_equal "Monatlich", humanize("FREQ=MONTHLY")
     assert_equal "Monthly", humanize("FREQ=MONTHLY", :en)
@@ -96,4 +114,11 @@ class RruleHumanizerTest < ActiveSupport::TestCase
   test "wday_abbr falls back to :de for an unrecognized locale" do
     assert_equal "Mo", RruleHumanizer.wday_abbr(Time.parse("2026-07-06"), :fr)
   end
+
+  test "monthly two selected weeks" do
+    assert_equal "Jeden ersten und dritten Dienstag im Monat",
+      humanize("FREQ=MONTHLY;BYDAY=1TU,3TU")
+    assert_equal "Every first and third Tuesday of the month",
+      humanize("FREQ=MONTHLY;BYDAY=1TU,3TU", :en)
+  end
 end
diff --git a/test/models/helpers/node_actions_helper_test.rb b/test/models/helpers/node_actions_helper_test.rb
new file mode 100644
index 0000000..1b72ec9
--- /dev/null
+++ b/test/models/helpers/node_actions_helper_test.rb
@@ -0,0 +1,146 @@
+require 'test_helper'
+
+class NodeActionsHelperTest < ActionView::TestCase
+  def setup
+    @original_locale = I18n.locale
+    I18n.locale = :en
+  end
+
+  def default_url_options
+    { :locale => nil }
+  end
+
+  def icon(_name, **)
+    '<svg class="stub-icon"></svg>'.html_safe
+  end
+
+  def teardown
+    I18n.locale = @original_locale
+  end
+
+  def entry action, metadata = {}, node: nil, user: nil, page: nil
+    NodeAction.create!(:node => node, :user => user, :page => page,
+                        :action => action, :occurred_at => Time.now,
+                        :metadata => { "username" => "quentin",
+                                       "human_readable_node_name" => "Subject" }.merge(metadata))
+  end
+
+  test "publish renders the revision sentence, not the titles" do
+    out = action_summary(entry("publish",
+      { "via" => "draft", "title" => { "from" => "Old", "to" => "New" } }))
+
+    assert_includes out, "quentin"
+    assert_includes out, "new revision"
+    assert_not_includes out, "Old"
+  end
+
+  test "first publish uses its own sentence" do
+    out = action_summary(entry("publish",
+      { "via" => "draft", "title" => { "from" => nil, "to" => "New" } }))
+
+    assert_includes out, "for the first time"
+  end
+
+  test "rollback publishes get the rollback sentence" do
+    out = action_summary(entry("publish",
+      { "via" => "revision", "title" => { "from" => "Now", "to" => "Then" } }))
+
+    assert_includes out, "rolled"
+  end
+
+  test "move renders the path pair" do
+    out = action_summary(entry("move",
+      { "path" => { "from" => "a/b", "to" => "a/c" } }))
+
+    assert_includes out, "a/b"
+    assert_includes out, "a/c"
+  end
+
+  test "unknown verbs degrade to a generic sentence, never an error" do
+    out = action_summary(entry("frobnicate"))
+
+    assert_includes out, "frobnicate"
+    assert_includes out, "quentin"
+  end
+
+  test "dead references render as plain names from metadata, no links" do
+    out = action_summary(entry("publish",
+      { "title" => { "from" => "Old", "to" => "New" } }))
+
+    assert_not_includes out, "<a "
+    assert_includes out, "Subject"
+  end
+
+  test "metadata values are escaped" do
+    out = action_summary(entry("publish",
+      { "human_readable_node_name" => "<b>bold</b>" }))
+
+    assert_not_includes out, "<b>"
+  end
+
+  test "live associations upgrade names to links" do
+    out = action_summary(entry("publish",
+      { "title" => { "from" => "Old", "to" => "New" } },
+      :user => users(:quentin)))
+
+    assert_includes out, "<a "
+  end
+
+  test "details are guarded off when nothing but an unchanged title is present" do
+    unchanged = entry("publish", { "title" => { "from" => "Same", "to" => "Same" } })
+    changed   = entry("publish", { "title" => { "from" => "Old",  "to" => "New" } })
+
+    assert_not action_details?(unchanged)
+    assert action_details?(changed)
+  end
+
+  test "first publish with a byline names the author" do
+    out = action_summary(entry("publish",
+      { "title" => { "from" => nil, "to" => "New" },
+        "author" => { "from" => nil, "to" => "quentin" } }))
+
+    assert_includes out, "author"
+  end
+
+  test "create entries with their flat title render and are guarded off details" do
+    e = entry("create", { "title" => "Initial", "path" => "a/b" })
+
+    assert_includes action_summary(e), "a/b"
+    assert_not action_details?(e)
+  end
+
+  test "trash, restore, and destroy render their paths" do
+    trash   = entry("trash",   { "path" => { "from" => "club/old", "to" => "trash/old" } })
+    restore = entry("restore_from_trash", { "path" => { "from" => "trash/old", "to" => "club/new" } })
+    doomed  = entry("destroy", { "path" => "trash/old" })
+
+    assert_includes action_summary(trash),   "club/old"
+    assert_includes action_summary(restore), "club/new"
+    assert_includes action_summary(doomed),  "trash/old"
+  end
+
+  test "revision lifecycle badges cover create, publish, rollback, and inference" do
+    created   = entry("create",  { "title" => "x", "path" => "a/b" })
+    published = entry("publish", { "via" => "draft",    "title" => { "from" => nil, "to" => "x" } })
+    restored  = entry("publish", { "via" => "revision", "title" => { "from" => "y", "to" => "x" } })
+    restored.update!(:inferred_from => "from_page_revision")
+
+    out = revision_lifecycle_badges([created, published, restored])
+
+    assert_includes out, "created"
+    assert_includes out, "published"
+    assert_includes out, "restored"
+    assert_includes out, "quentin"
+    assert_includes out, "node_action_inferred"
+    assert_includes out, "<span"
+    assert_not_includes out, "&lt;span"
+
+    assert_equal "", revision_lifecycle_badges(nil)
+  end
+
+  test "verb icons map known verbs, distinguish rollbacks, and fall back" do
+    assert_includes verb_icon(entry("trash", { "path" => { "from" => "a", "to" => "t/a" } })), "node_action_icon--trash"
+    assert_includes verb_icon(entry("publish", { "via" => "revision" })), "node_action_icon--history"
+    assert_includes verb_icon(entry("frobnicate")), "node_action_icon--circle-dashed"
+  end
+end
diff --git a/test/models/node_action_test.rb b/test/models/node_action_test.rb
index 24d8245..b177cca 100644
--- a/test/models/node_action_test.rb
+++ b/test/models/node_action_test.rb
@@ -18,6 +18,12 @@ class NodeActionTest < ActiveSupport::TestCase
     assert_equal({ :title => { "from" => nil, "to" => "Erstausgabe" } }, diff)
   end
 
+  test "first publish carries the byline when the page has one" do
+    diff = NodeAction.head_diff(nil, build_page(:user => users(:quentin)))
+
+    assert_equal({ "from" => nil, "to" => users(:quentin).login }, diff[:author])
+  end
+
   test "title pair is always present, even when unchanged" do
     diff = NodeAction.head_diff(build_page, build_page)
 
@@ -109,4 +115,14 @@ class NodeActionTest < ActiveSupport::TestCase
 
     assert_nil NodeAction.head_diff(old_page, new_page)[:translation_diff]
   end
+
+  test "record! passes provenance and historical timestamps through" do
+    long_ago = 2.years.ago
+    action = NodeAction.record!(:node => nil, :action => "publish",
+                                 :occurred_at => long_ago,
+                                 :inferred_from => "from_page_revision")
+
+    assert_equal "from_page_revision", action.inferred_from
+    assert_in_delta long_ago.to_f, action.occurred_at.to_f, 1.0
+  end
 end
diff --git a/test/models/node_test.rb b/test/models/node_test.rb
index c8e49e5..ab66f81 100644
--- a/test/models/node_test.rb
+++ b/test/models/node_test.rb
@@ -761,4 +761,105 @@ class NodeTest < ActiveSupport::TestCase
     assert_equal "Second",    action.metadata.dig("title", "from")
     assert_equal "First",     action.metadata.dig("title", "to")
   end
+
+  test "default_template_name rejects values not present in the template directory" do
+    node = Node.root.children.build(:slug => "template_guard_test",
+                                     :default_template_name => "../../layouts/admin")
+    assert_not node.valid?
+
+    node.default_template_name = "standard_template"
+    assert node.valid?
+  end
+
+  test "destroying a node with children is refused" do
+    parent = Node.root.children.create!(:slug => "destroy_guard_parent")
+    parent.children.create!(:slug => "destroy_guard_child")
+
+    assert_no_difference "Node.count" do
+      assert_not parent.destroy
+    end
+    assert parent.errors[:base].any?
+  end
+
+  test "destroying a childless node leaves no orphaned pages or asset links" do
+    node = create_node_with_published_page
+    page_ids = node.pages.pluck(:id)
+    asset = Asset.create!(:name => "destroy cascade probe",
+                          :upload_file_name    => "test_image.png",
+                          :upload_content_type => "image/png",
+                          :upload_file_size    => 49854,
+                          :upload_updated_at   => Time.current)
+    node.head.related_assets.create!(:asset_id => asset.id, :position => 1)
+
+    node.destroy
+
+    assert_equal 0, Page.where(:id => page_ids).count
+    assert_equal 0, RelatedAsset.where(:page_id => page_ids).count
+  end
+
+  test "destroying a node also removes its autosave page" do
+    node = create_node_with_published_page
+    node.lock_for_editing!(@user1)
+    node.autosave!({:title => "in flight"}, @user1)
+    autosave_id = node.autosave_id
+
+    node.destroy
+
+    assert_equal 0, Page.where(:id => autosave_id).count
+  end
+
+  test "Node.trash lazily creates the container exactly once" do
+    assert_difference "Node.count", 1 do
+      Node.trash
+    end
+    assert_no_difference "Node.count" do
+      assert_equal Node.trash, Node.trash
+    end
+    assert Node.trash.trash_node?
+    assert_not Node.trash.in_trash?
+    assert_equal "Trash", Globalize.with_locale(I18n.default_locale) { Node.trash.draft.title }
+  end
+
+  test "in_trash? walks the whole parent chain" do
+    child = Node.trash.children.create!(:slug => "trashed_thing")
+    grandchild = child.children.create!(:slug => "trashed_deeper")
+
+    assert child.in_trash?
+    assert grandchild.in_trash?
+    assert_not Node.root.children.create!(:slug => "living_thing").in_trash?
+  end
+
+  test "the reserved slug is refused for other root children, live and staged" do
+    Node.trash
+
+    assert_not Node.root.children.build(:slug => CccConventions::TRASH_SLUG).valid?
+    assert_not Node.root.children.build(:slug => "fine", :staged_slug => CccConventions::TRASH_SLUG).valid?
+    assert Node.trash.children.create!(:slug => "sub").children.build(:slug => CccConventions::TRASH_SLUG).valid?
+  end
+
+  test "the Trash node refuses rename, move, and destroy" do
+    trash = Node.trash
+    other = Node.root.children.create!(:slug => "not_the_trash")
+
+    trash.slug = "recycling"
+    assert_not trash.valid?
+
+    trash.reload.parent_id = other.id
+    assert_not trash.valid?
+
+    assert_no_difference "Node.count" do
+      assert_not trash.reload.destroy
+    end
+  end
+
+  test "a head cannot exist inside the Trash, and publishing there is refused" do
+    node = Node.trash.children.create!(:slug => "no_publish_here")
+    page = node.pages.create!
+
+    node.head = page
+    assert_not node.valid?
+
+    node.reload
+    assert_raises(ActiveRecord::RecordInvalid) { node.publish_draft! }
+  end
 end
diff --git a/test/models/node_trash_test.rb b/test/models/node_trash_test.rb
new file mode 100644
index 0000000..52069d7
--- /dev/null
+++ b/test/models/node_trash_test.rb
@@ -0,0 +1,168 @@
+require "test_helper"
+
+class NodeTrashTest < ActiveSupport::TestCase
+
+  def setup
+    @user1 = User.create!(:login => "trasher", :email => "t@example.com",
+                           :password => "foobar", :password_confirmation => "foobar")
+  end
+
+  test "trash! demotes the head into the draft slot when no draft exists" do
+    node = create_node_with_published_page
+    former_head = node.head
+
+    node.trash!(@user1)
+    node.reload
+
+    assert_nil node.head_id
+    assert_equal former_head, node.draft
+    assert node.in_trash?
+  end
+
+  test "trash! keeps an existing draft; the former head stays a plain revision" do
+    node = create_node_with_published_page
+    draft = find_or_create_draft(node, @user1)
+    former_head = node.head
+
+    node.trash!(@user1)
+    node.reload
+
+    assert_nil node.head_id
+    assert_equal draft, node.draft
+    assert_includes node.pages, former_head
+  end
+
+  test "trash! demotes descendant heads and counts them in the log entry" do
+    parent = create_node_with_published_page
+    child  = parent.children.create!(:slug => "trashed_child")
+    child.draft.update!(:title => "Child")
+    child.publish_draft!(@user1)
+
+    parent.trash!(@user1)
+
+    action = NodeAction.where(:action => "trash").last
+    assert_equal parent, action.node
+    assert_equal 2, action.metadata["demoted_heads"]
+    assert action.metadata["was_published"]
+    assert_nil child.reload.head_id
+    assert child.in_trash?
+  end
+
+  test "trash! logs one entry with the path pair and updates unique names" do
+    node = create_node_with_published_page
+    path_before = node.unique_name
+
+    assert_difference "NodeAction.count", 1 do
+      node.trash!(@user1)
+    end
+
+    action = NodeAction.last
+    assert_equal path_before, action.metadata.dig("path", "from")
+    assert_equal node.reload.unique_name, action.metadata.dig("path", "to")
+    assert action.metadata.dig("path", "to").start_with?(CccConventions::TRASH_SLUG)
+  end
+
+  test "trash! on an already trashed node is a logged-nothing no-op" do
+    node = create_node_with_published_page
+    node.trash!(@user1)
+
+    assert_no_difference "NodeAction.count" do
+      assert_nil node.reload.trash!(@user1)
+    end
+  end
+
+  test "restore_from_trash! reparents as drafts without republishing" do
+    node = create_node_with_published_page
+    node.trash!(@user1)
+    target = Node.root.children.create!(:slug => "restore_target")
+
+    node.reload.restore_from_trash!(target, @user1)
+    node.reload
+
+    assert_equal target, node.parent
+    assert_not node.in_trash?
+    assert_nil node.head_id
+    assert_not_nil node.draft_id
+    assert_equal "restore_from_trash", NodeAction.last.action
+  end
+
+  test "restore_from_trash! refuses targets inside the Trash and the Trash itself" do
+    node = create_node_with_published_page
+    node.trash!(@user1)
+    other_trashed = Node.trash.children.create!(:slug => "also_trashed")
+
+    assert_raises(ActiveRecord::RecordInvalid) { node.reload.restore_from_trash!(Node.trash, @user1) }
+    assert_raises(ActiveRecord::RecordInvalid) { node.reload.restore_from_trash!(other_trashed, @user1) }
+  end
+
+  test "destroy_from_trash! refuses nodes outside the Trash" do
+    node = create_node_with_published_page
+
+    assert_raises(ActiveRecord::RecordInvalid) { node.destroy_from_trash!(@user1) }
+    assert Node.exists?(node.id)
+  end
+
+  test "destroy_from_trash! removes the whole subtree bottom-up with one entry" do
+    parent = create_node_with_published_page
+    child = parent.children.create!(:slug => "doomed_child")
+    grandchild = child.children.create!(:slug => "doomed_grandchild")
+    page_ids = [parent, child, grandchild].flat_map { |n| n.pages.pluck(:id) }
+    parent.trash!(@user1)
+
+    assert_difference "NodeAction.count", 1 do
+      parent.reload.destroy_from_trash!(@user1)
+    end
+
+    assert_not Node.exists?(parent.id)
+    assert_not Node.exists?(child.id)
+    assert_not Node.exists?(grandchild.id)
+    assert_equal 0, Page.where(:id => page_ids).count
+
+    action = NodeAction.where(:action => "destroy").last
+    assert_equal 2, action.metadata["destroyed_descendants"]
+    assert_nil action.node_id
+  end
+
+  test "destroy_from_trash! logs an entry that survives the node" do
+    node = create_node_with_published_page
+    Globalize.with_locale(I18n.default_locale) { node.head.update!(:title => "Doomed") }
+    node.trash!(@user1)
+    final_path = node.reload.unique_name
+
+    node.destroy_from_trash!(@user1)
+
+    action = NodeAction.where(:action => "destroy").last
+    assert_nil action.node_id
+    assert_equal final_path, action.metadata["path"]
+    assert_equal "Doomed", action.subject_name
+    assert_equal @user1, action.user
+  end
+
+  test "suggested_restore_parent finds the old parent while it lives" do
+    parent = Node.root.children.create!(:slug => "old_home")
+    node = parent.children.create!(:slug => "comes_back")
+    node.trash!(@user1)
+
+    assert_equal parent, node.reload.suggested_restore_parent
+
+    parent.trash!(@user1)
+    assert_nil node.reload.suggested_restore_parent
+  end
+
+  test "suggested_restore_parent is root for trashed top-level nodes" do
+    node = Node.root.children.create!(:slug => "was_top_level")
+    node.trash!(@user1)
+
+    assert_equal Node.root, node.reload.suggested_restore_parent
+  end
+
+  test "trashed nodes and the Trash itself stay out of the drafts surfaces" do
+    Node.trash
+    node = create_node_with_published_page
+    node.trash!(@user1)
+
+    ids = Node.drafts_and_autosaves.pluck(:id)
+    assert_not_includes ids, Node.trash.id
+    assert_not_includes ids, node.id
+  end
+end
diff --git a/test/models/page_test.rb b/test/models/page_test.rb
index edb7c37..1f924f9 100644
--- a/test/models/page_test.rb
+++ b/test/models/page_test.rb
@@ -370,4 +370,39 @@ class PageTest < ActiveSupport::TestCase
     assert en_entry[:changed]
     refute en_entry[:exists_there]
   end
+
+  test "aggregate ignores order_by values outside the allowlist" do
+    sql = Page.aggregate(:order_by => "pages.id; DROP TABLE pages--").to_sql
+
+    assert_not_includes sql, "DROP"
+    assert_includes sql, "pages.id ASC"
+  end
+
+  test "aggregate accepts allowlisted order columns, bare or prefixed" do
+    assert_includes Page.aggregate(:order_by => "published_at").to_sql,
+                    "pages.published_at ASC"
+    assert_includes Page.aggregate(:order_by => "pages.published_at").to_sql,
+                    "pages.published_at ASC"
+  end
+
+  test "template_name rejects values not present in the template directory" do
+    page = Page.create!(:title => "Template guard")
+
+    page.template_name = "../../partials/_article"
+    assert_not page.valid?
+
+    page.template_name = "standard_template"
+    assert page.valid?
+
+    page.template_name = ""
+    assert page.valid?
+  end
+
+  test "a stale legacy template_name does not block unrelated saves" do
+    page = Page.create!(:title => "Stale template")
+    page.update_column(:template_name, "long_deleted_template")
+
+    page.reload
+    assert page.update(:abstract => "still saveable")
+  end
 end
diff --git a/test/models/user_test.rb b/test/models/user_test.rb
index 6e4d2d7..feccce2 100644
--- a/test/models/user_test.rb
+++ b/test/models/user_test.rb
@@ -54,6 +54,78 @@ class UserTest < ActiveSupport::TestCase
   def test_should_authenticate_user
     assert_equal users(:quentin), User.authenticate('quentin', 'monkey')
   end
+
+  def test_should_not_authenticate_wrong_password
+    assert_nil User.authenticate("quentin", "wrong password")
+  end
+
+  def test_should_not_authenticate_unknown_user
+    assert_nil User.authenticate("nosuchuser", "monkey")
+  end
+
+  def test_user_with_crypted_password_is_migrated_on_login
+    user = users(:quentin)
+
+    assert_nil user.password_digest
+
+    assert User.authenticate("quentin", "monkey")
+
+    user.reload
+
+    assert_not_nil user.password_digest
+    assert_nil user.crypted_password
+    assert_nil user.salt
+  end
+
+  def test_new_user_uses_password_digest
+    user = create_user
+
+    assert_not_nil user.password_digest
+    assert_nil user.crypted_password
+    assert_nil user.salt
+
+    assert_equal user, User.authenticate("quire", "quire69")
+  end
+
+  def test_legacy_user_is_migrated_on_login
+    user = users(:quentin)
+
+    assert_nil user.password_digest
+    assert_not_nil user.crypted_password
+    assert_not_nil user.salt
+
+    assert_equal user, User.authenticate("quentin", "monkey")
+
+    user.reload
+
+    assert_not_nil user.password_digest
+    assert_nil user.crypted_password
+    assert_nil user.salt
+  end
+
+  def test_migrated_user_authenticates_using_password_digest
+    user = users(:quentin)
+
+    # Trigger automatic migration.
+    assert_equal user, User.authenticate("quentin", "monkey")
+
+    user.reload
+
+    assert_not_nil user.password_digest
+    assert_nil user.crypted_password
+    assert_nil user.salt
+
+    # Second login should now use password_digest.
+    assert_equal user, User.authenticate("quentin", "monkey")
+  end
+
+  def test_migrated_user_can_be_updated_without_password
+    user = users(:quentin)
+    assert_equal user, User.authenticate("quentin", "monkey")
+    user.reload
+
+    assert user.update(:email => "quentin@example.org")
+  end
   
 protected
   def create_user(options = {})