10 files changed, 416 insertions, 14 deletions

diff --git a/test/controllers/content_controller_test.rb b/test/controllers/content_controller_test.rb
index e8bc55f..2449a0c 100644
--- a/test/controllers/content_controller_test.rb
+++ b/test/controllers/content_controller_test.rb
@@ -73,8 +73,7 @@ class ContentControllerTest < ActionController::TestCase
   def test_nonexistant_custom_template_defaults_to_standard_template
     new_node = create_node_under_root "fnord"
     draft = find_or_create_draft(new_node, @user1)
-    draft.template_name = "huchibu"
-    draft.save
+    draft.update_column(:template_name, "huchibu")
     new_node.publish_draft!
     
     get :render_page, params: { :locale => 'de', :page_path => ["fnord"] }
diff --git a/test/controllers/node_actions_controller_test.rb b/test/controllers/node_actions_controller_test.rb
new file mode 100644
index 0000000..8bc68ec
--- /dev/null
+++ b/test/controllers/node_actions_controller_test.rb
@@ -0,0 +1,51 @@
+require 'test_helper'
+
+class NodeActionsControllerTest < ActionController::TestCase
+
+  def setup
+    login_as :quentin
+  end
+
+  def logged_node slug, title
+    node = Node.root.children.create!(:slug => slug)
+    Globalize.with_locale(I18n.default_locale) { node.draft.update!(:title => title) }
+    node
+  end
+
+  test "index renders" do
+    get :index
+    assert_response :success
+  end
+
+  test "index filters by node" do
+    node_a = logged_node("log_filter_a", "Alpha Subject")
+    node_b = logged_node("log_filter_b", "Beta Subject")
+    NodeAction.record!(:node => node_a, :action => "create", :user => users(:quentin))
+    NodeAction.record!(:node => node_b, :action => "create", :user => users(:quentin))
+
+    get :index, params: { :node_id => node_a.id }
+
+    assert_response :success
+    assert_includes    @response.body, "Alpha Subject"
+    assert_not_includes @response.body, "Beta Subject"
+  end
+
+  test "index filters by user" do
+    node = logged_node("log_filter_user", "Gamma Subject")
+    NodeAction.record!(:node => node, :action => "create", :user => users(:quentin))
+
+    get :index, params: { :user_id => users(:quentin).id }
+    assert_includes @response.body, "Gamma Subject"
+
+    other = User.where.not(:id => users(:quentin).id).first
+    get :index, params: { :user_id => other.id }
+    assert_not_includes @response.body, "Gamma Subject"
+  end
+
+  test "index requires login" do
+    session[:user_id] = nil
+    @controller.instance_variable_set(:@current_user, nil)
+    get :index
+    assert_response :redirect
+  end
+end
diff --git a/test/controllers/nodes_controller_test.rb b/test/controllers/nodes_controller_test.rb
index 5b66bd3..b0d7416 100644
--- a/test/controllers/nodes_controller_test.rb
+++ b/test/controllers/nodes_controller_test.rb
@@ -140,7 +140,7 @@ class NodesControllerTest < ActionController::TestCase
       :page => {
         :title => "Hello",
         :body => "There",
-        :template_name => "Foobar"
+        :template_name => "title_only"
       }
     }
 
@@ -148,7 +148,17 @@ class NodesControllerTest < ActionController::TestCase
     test_node.reload
     assert_equal "Hello", test_node.head.title
     assert_equal "There", test_node.head.body
-    assert_equal "Foobar", test_node.head.template_name
+    assert_equal "title_only", test_node.head.template_name
+  end
+
+  def test_update_rejects_a_template_name_not_on_disk
+    test_node = Node.root.children.create! :slug => "test_node"
+    login_as :quentin
+    put :update, params: { :id => test_node.id,
+                           :page => { :title => "Hello", :template_name => "Foobar" } }
+
+    test_node.reload
+    assert_not_equal "Foobar", test_node.draft&.template_name
   end
 
   test "publish draft with staged_slug unqueal slug" do
diff --git a/test/fixtures/nodes.yml b/test/fixtures/nodes.yml
index 9ca325e..e94f10f 100644
--- a/test/fixtures/nodes.yml
+++ b/test/fixtures/nodes.yml
@@ -2,8 +2,6 @@
 
 root:
   id: 1
-  lft: 1
-  rgt: 10
   parent_id:
   slug:
   unique_name:
@@ -11,8 +9,6 @@ root:
 
 first_child:
   id: 2
-  lft: 2
-  rgt: 3
   parent_id: 1
   draft_id: 100
   slug: first_child
@@ -20,8 +16,6 @@ first_child:
 
 second_child:
   id: 3
-  lft: 4
-  rgt: 5
   parent_id: 1
   draft_id: 101
   slug: second_child
@@ -29,8 +23,6 @@ second_child:
   
 third_child:
   id: 4
-  lft: 6
-  rgt: 7
   parent_id: 1
   draft_id: 102
   slug: third_child
@@ -38,8 +30,6 @@ third_child:
   
 fourth_child:
   id: 5
-  lft: 8
-  rgt: 9
   parent_id: 1
   slug: fourth_child
   unique_name: fourth_child
diff --git a/test/models/concerns/rrule_humanizer_test.rb b/test/models/concerns/rrule_humanizer_test.rb
index 279ff73..d747171 100644
--- a/test/models/concerns/rrule_humanizer_test.rb
+++ b/test/models/concerns/rrule_humanizer_test.rb
@@ -47,6 +47,24 @@ class RruleHumanizerTest < ActiveSupport::TestCase
     assert_equal "Every second-to-last Thursday of the month", humanize("FREQ=MONTHLY;BYDAY=-2TH", :en)
   end
 
+  test "monthly selected weeks" do
+    assert_equal "Jeden ersten, zweiten und fünften Dienstag im Monat",
+      humanize("FREQ=MONTHLY;BYDAY=1TU,2TU,5TU")
+    assert_equal "Every first, second and fifth Tuesday of the month",
+      humanize("FREQ=MONTHLY;BYDAY=1TU,2TU,5TU", :en)
+  end
+
+  test "monthly fifth weekday" do
+    assert_equal "Jeden fünften Dienstag im Monat", humanize("FREQ=MONTHLY;BYDAY=5TU")
+    assert_equal "Every fifth Tuesday of the month", humanize("FREQ=MONTHLY;BYDAY=5TU", :en)
+  end
+
+  test "monthly weekday excluding one ordinal" do
+    rrule = "FREQ=MONTHLY;BYDAY=1TU,3TU,4TU,5TU"
+    assert_equal "Jeden Dienstag im Monat, außer dem zweiten Dienstag", humanize(rrule)
+    assert_equal "Every Tuesday of the month, except the second Tuesday", humanize(rrule, :en)
+  end
+
   test "monthly no byday" do
     assert_equal "Monatlich", humanize("FREQ=MONTHLY")
     assert_equal "Monthly", humanize("FREQ=MONTHLY", :en)
@@ -96,4 +114,11 @@ class RruleHumanizerTest < ActiveSupport::TestCase
   test "wday_abbr falls back to :de for an unrecognized locale" do
     assert_equal "Mo", RruleHumanizer.wday_abbr(Time.parse("2026-07-06"), :fr)
   end
+
+  test "monthly two selected weeks" do
+    assert_equal "Jeden ersten und dritten Dienstag im Monat",
+      humanize("FREQ=MONTHLY;BYDAY=1TU,3TU")
+    assert_equal "Every first and third Tuesday of the month",
+      humanize("FREQ=MONTHLY;BYDAY=1TU,3TU", :en)
+  end
 end
diff --git a/test/models/helpers/node_actions_helper_test.rb b/test/models/helpers/node_actions_helper_test.rb
new file mode 100644
index 0000000..5244c19
--- /dev/null
+++ b/test/models/helpers/node_actions_helper_test.rb
@@ -0,0 +1,107 @@
+require 'test_helper'
+
+class NodeActionsHelperTest < ActionView::TestCase
+  def setup
+    @original_locale = I18n.locale
+    I18n.locale = :en
+  end
+
+  def default_url_options
+    { :locale => nil }
+  end
+
+  def teardown
+    I18n.locale = @original_locale
+  end
+
+  def entry action, metadata = {}, node: nil, user: nil, page: nil
+    NodeAction.create!(:node => node, :user => user, :page => page,
+                        :action => action, :occurred_at => Time.now,
+                        :metadata => { "username" => "quentin",
+                                       "human_readable_node_name" => "Subject" }.merge(metadata))
+  end
+
+  test "publish renders the revision sentence, not the titles" do
+    out = action_summary(entry("publish",
+      { "via" => "draft", "title" => { "from" => "Old", "to" => "New" } }))
+
+    assert_includes out, "quentin"
+    assert_includes out, "new revision"
+    assert_not_includes out, "Old"
+  end
+
+  test "first publish uses its own sentence" do
+    out = action_summary(entry("publish",
+      { "via" => "draft", "title" => { "from" => nil, "to" => "New" } }))
+
+    assert_includes out, "for the first time"
+  end
+
+  test "rollback publishes get the rollback sentence" do
+    out = action_summary(entry("publish",
+      { "via" => "revision", "title" => { "from" => "Now", "to" => "Then" } }))
+
+    assert_includes out, "rolled"
+  end
+
+  test "move renders the path pair" do
+    out = action_summary(entry("move",
+      { "path" => { "from" => "a/b", "to" => "a/c" } }))
+
+    assert_includes out, "a/b"
+    assert_includes out, "a/c"
+  end
+
+  test "unknown verbs degrade to a generic sentence, never an error" do
+    out = action_summary(entry("frobnicate"))
+
+    assert_includes out, "frobnicate"
+    assert_includes out, "quentin"
+  end
+
+  test "dead references render as plain names from metadata, no links" do
+    out = action_summary(entry("publish",
+      { "title" => { "from" => "Old", "to" => "New" } }))
+
+    assert_not_includes out, "<a "
+    assert_includes out, "Subject"
+  end
+
+  test "metadata values are escaped" do
+    out = action_summary(entry("publish",
+      { "human_readable_node_name" => "<b>bold</b>" }))
+
+    assert_not_includes out, "<b>"
+  end
+
+  test "live associations upgrade names to links" do
+    out = action_summary(entry("publish",
+      { "title" => { "from" => "Old", "to" => "New" } },
+      :user => users(:quentin)))
+
+    assert_includes out, "<a "
+  end
+
+  test "details are guarded off when nothing but an unchanged title is present" do
+    unchanged = entry("publish", { "title" => { "from" => "Same", "to" => "Same" } })
+    changed   = entry("publish", { "title" => { "from" => "Old",  "to" => "New" } })
+
+    assert_not action_details?(unchanged)
+    assert action_details?(changed)
+  end
+
+  test "first publish with a byline names the author" do
+    out = action_summary(entry("publish",
+      { "title" => { "from" => nil, "to" => "New" },
+        "author" => { "from" => nil, "to" => "quentin" } }))
+
+    assert_includes out, "author"
+  end
+
+  test "create entries with their flat title render and are guarded off details" do
+    e = entry("create", { "title" => "Initial", "path" => "a/b" })
+
+    assert_includes action_summary(e), "a/b"
+    assert_not action_details?(e)
+  end
+end
diff --git a/test/models/node_action_test.rb b/test/models/node_action_test.rb
index 24d8245..b177cca 100644
--- a/test/models/node_action_test.rb
+++ b/test/models/node_action_test.rb
@@ -18,6 +18,12 @@ class NodeActionTest < ActiveSupport::TestCase
     assert_equal({ :title => { "from" => nil, "to" => "Erstausgabe" } }, diff)
   end
 
+  test "first publish carries the byline when the page has one" do
+    diff = NodeAction.head_diff(nil, build_page(:user => users(:quentin)))
+
+    assert_equal({ "from" => nil, "to" => users(:quentin).login }, diff[:author])
+  end
+
   test "title pair is always present, even when unchanged" do
     diff = NodeAction.head_diff(build_page, build_page)
 
@@ -109,4 +115,14 @@ class NodeActionTest < ActiveSupport::TestCase
 
     assert_nil NodeAction.head_diff(old_page, new_page)[:translation_diff]
   end
+
+  test "record! passes provenance and historical timestamps through" do
+    long_ago = 2.years.ago
+    action = NodeAction.record!(:node => nil, :action => "publish",
+                                 :occurred_at => long_ago,
+                                 :inferred_from => "from_page_revision")
+
+    assert_equal "from_page_revision", action.inferred_from
+    assert_in_delta long_ago.to_f, action.occurred_at.to_f, 1.0
+  end
 end
diff --git a/test/models/node_test.rb b/test/models/node_test.rb
index c8e49e5..3fb2d23 100644
--- a/test/models/node_test.rb
+++ b/test/models/node_test.rb
@@ -761,4 +761,104 @@ class NodeTest < ActiveSupport::TestCase
     assert_equal "Second",    action.metadata.dig("title", "from")
     assert_equal "First",     action.metadata.dig("title", "to")
   end
+
+  test "default_template_name rejects values not present in the template directory" do
+    node = Node.root.children.build(:slug => "template_guard_test",
+                                     :default_template_name => "../../layouts/admin")
+    assert_not node.valid?
+
+    node.default_template_name = "standard_template"
+    assert node.valid?
+  end
+
+  test "destroying a node with children is refused" do
+    parent = Node.root.children.create!(:slug => "destroy_guard_parent")
+    parent.children.create!(:slug => "destroy_guard_child")
+
+    assert_no_difference "Node.count" do
+      assert_not parent.destroy
+    end
+    assert parent.errors[:base].any?
+  end
+
+  test "destroying a childless node leaves no orphaned pages or asset links" do
+    node = create_node_with_published_page
+    page_ids = node.pages.pluck(:id)
+    asset = Asset.create!(:name => "destroy cascade probe",
+                          :upload_file_name    => "test_image.png",
+                          :upload_content_type => "image/png",
+                          :upload_file_size    => 49854,
+                          :upload_updated_at   => Time.current)
+    node.head.related_assets.create!(:asset_id => asset.id, :position => 1)
+
+    node.destroy
+
+    assert_equal 0, Page.where(:id => page_ids).count
+    assert_equal 0, RelatedAsset.where(:page_id => page_ids).count
+  end
+
+  test "destroying a node also removes its autosave page" do
+    node = create_node_with_published_page
+    node.lock_for_editing!(@user1)
+    node.autosave!({:title => "in flight"}, @user1)
+    autosave_id = node.autosave_id
+
+    node.destroy
+
+    assert_equal 0, Page.where(:id => autosave_id).count
+  end
+
+  test "Node.trash lazily creates the container exactly once" do
+    assert_difference "Node.count", 1 do
+      Node.trash
+    end
+    assert_no_difference "Node.count" do
+      assert_equal Node.trash, Node.trash
+    end
+    assert Node.trash.trash_node?
+    assert_not Node.trash.in_trash?
+  end
+
+  test "in_trash? walks the whole parent chain" do
+    child = Node.trash.children.create!(:slug => "trashed_thing")
+    grandchild = child.children.create!(:slug => "trashed_deeper")
+
+    assert child.in_trash?
+    assert grandchild.in_trash?
+    assert_not Node.root.children.create!(:slug => "living_thing").in_trash?
+  end
+
+  test "the reserved slug is refused for other root children, live and staged" do
+    Node.trash
+
+    assert_not Node.root.children.build(:slug => CccConventions::TRASH_SLUG).valid?
+    assert_not Node.root.children.build(:slug => "fine", :staged_slug => CccConventions::TRASH_SLUG).valid?
+    assert Node.trash.children.create!(:slug => "sub").children.build(:slug => CccConventions::TRASH_SLUG).valid?
+  end
+
+  test "the Trash node refuses rename, move, and destroy" do
+    trash = Node.trash
+    other = Node.root.children.create!(:slug => "not_the_trash")
+
+    trash.slug = "recycling"
+    assert_not trash.valid?
+
+    trash.reload.parent_id = other.id
+    assert_not trash.valid?
+
+    assert_no_difference "Node.count" do
+      assert_not trash.reload.destroy
+    end
+  end
+
+  test "a head cannot exist inside the Trash, and publishing there is refused" do
+    node = Node.trash.children.create!(:slug => "no_publish_here")
+    page = node.pages.create!
+
+    node.head = page
+    assert_not node.valid?
+
+    node.reload
+    assert_raises(ActiveRecord::RecordInvalid) { node.publish_draft! }
+  end
 end
diff --git a/test/models/page_test.rb b/test/models/page_test.rb
index edb7c37..58794d5 100644
--- a/test/models/page_test.rb
+++ b/test/models/page_test.rb
@@ -370,4 +370,36 @@ class PageTest < ActiveSupport::TestCase
     assert en_entry[:changed]
     refute en_entry[:exists_there]
   end
+
+  test "aggregate ignores order_by values outside the allowlist" do
+    sql = Page.aggregate(:order_by => "pages.id; DROP TABLE pages--").to_sql
+
+    assert_not_includes sql, "DROP"
+    assert_includes sql, "pages.id ASC"
+  end
+
+  test "aggregate accepts allowlisted order columns, bare or prefixed" do
+    assert_includes Page.aggregate(:order_by => "published_at").to_sql,
+                    "pages.published_at ASC"
+    assert_includes Page.aggregate(:order_by => "pages.published_at").to_sql,
+                    "pages.published_at ASC"
+  end
+
+  test "template_name rejects values not present in the template directory" do
+    page = Page.create!(:title => "Template guard")
+
+    page.template_name = "../../partials/_article"
+    assert_not page.valid?
+
+    page.template_name = "standard_template"
+    assert page.valid?
+  end
+
+  test "a stale legacy template_name does not block unrelated saves" do
+    page = Page.create!(:title => "Stale template")
+    page.update_column(:template_name, "long_deleted_template")
+
+    page.reload
+    assert page.update(:abstract => "still saveable")
+  end
 end
diff --git a/test/models/user_test.rb b/test/models/user_test.rb
index 6e4d2d7..feccce2 100644
--- a/test/models/user_test.rb
+++ b/test/models/user_test.rb
@@ -54,6 +54,78 @@ class UserTest < ActiveSupport::TestCase
   def test_should_authenticate_user
     assert_equal users(:quentin), User.authenticate('quentin', 'monkey')
   end
+
+  def test_should_not_authenticate_wrong_password
+    assert_nil User.authenticate("quentin", "wrong password")
+  end
+
+  def test_should_not_authenticate_unknown_user
+    assert_nil User.authenticate("nosuchuser", "monkey")
+  end
+
+  def test_user_with_crypted_password_is_migrated_on_login
+    user = users(:quentin)
+
+    assert_nil user.password_digest
+
+    assert User.authenticate("quentin", "monkey")
+
+    user.reload
+
+    assert_not_nil user.password_digest
+    assert_nil user.crypted_password
+    assert_nil user.salt
+  end
+
+  def test_new_user_uses_password_digest
+    user = create_user
+
+    assert_not_nil user.password_digest
+    assert_nil user.crypted_password
+    assert_nil user.salt
+
+    assert_equal user, User.authenticate("quire", "quire69")
+  end
+
+  def test_legacy_user_is_migrated_on_login
+    user = users(:quentin)
+
+    assert_nil user.password_digest
+    assert_not_nil user.crypted_password
+    assert_not_nil user.salt
+
+    assert_equal user, User.authenticate("quentin", "monkey")
+
+    user.reload
+
+    assert_not_nil user.password_digest
+    assert_nil user.crypted_password
+    assert_nil user.salt
+  end
+
+  def test_migrated_user_authenticates_using_password_digest
+    user = users(:quentin)
+
+    # Trigger automatic migration.
+    assert_equal user, User.authenticate("quentin", "monkey")
+
+    user.reload
+
+    assert_not_nil user.password_digest
+    assert_nil user.crypted_password
+    assert_nil user.salt
+
+    # Second login should now use password_digest.
+    assert_equal user, User.authenticate("quentin", "monkey")
+  end
+
+  def test_migrated_user_can_be_updated_without_password
+    user = users(:quentin)
+    assert_equal user, User.authenticate("quentin", "monkey")
+    user.reload
+
+    assert user.update(:email => "quentin@example.org")
+  end
   
 protected
   def create_user(options = {})