14 files changed, 936 insertions, 27 deletions

diff --git a/test/controllers/content_controller_test.rb b/test/controllers/content_controller_test.rb
index e8bc55f..9731d08 100644
--- a/test/controllers/content_controller_test.rb
+++ b/test/controllers/content_controller_test.rb
@@ -73,8 +73,7 @@ class ContentControllerTest < ActionController::TestCase
   def test_nonexistant_custom_template_defaults_to_standard_template
     new_node = create_node_under_root "fnord"
     draft = find_or_create_draft(new_node, @user1)
-    draft.template_name = "huchibu"
-    draft.save
+    draft.update_column(:template_name, "huchibu")
     new_node.publish_draft!
     
     get :render_page, params: { :locale => 'de', :page_path => ["fnord"] }
@@ -105,6 +104,16 @@ class ContentControllerTest < ActionController::TestCase
     assert_response :success
     File.write("/tmp/no_fill_response.html", @response.body)
   end
+
+  test "render_gallery renders for a published page" do
+    node = Node.root.children.create!(:slug => "gallery_render_test")
+    Globalize.with_locale(I18n.default_locale) { node.draft.update!(:title => "Galerie") }
+    node.publish_draft!
+
+    get :render_gallery, params: { :page_path => "gallery_render_test", :locale => "de" }
+
+    assert_response :success
+  end
   
   protected
   
diff --git a/test/controllers/csp_reports_controller_test.rb b/test/controllers/csp_reports_controller_test.rb
new file mode 100644
index 0000000..7dd8c9e
--- /dev/null
+++ b/test/controllers/csp_reports_controller_test.rb
@@ -0,0 +1,8 @@
+require 'test_helper'
+
+class CspReportsControllerTest < ActionController::TestCase
+  test "accepts anonymous reports without CSRF" do
+    post :create, body: '{"csp-report":{"violated-directive":"script-src"}}'
+    assert_response :no_content
+  end
+end
diff --git a/test/controllers/node_actions_controller_test.rb b/test/controllers/node_actions_controller_test.rb
new file mode 100644
index 0000000..8bc68ec
--- /dev/null
+++ b/test/controllers/node_actions_controller_test.rb
@@ -0,0 +1,51 @@
+require 'test_helper'
+
+class NodeActionsControllerTest < ActionController::TestCase
+
+  def setup
+    login_as :quentin
+  end
+
+  def logged_node slug, title
+    node = Node.root.children.create!(:slug => slug)
+    Globalize.with_locale(I18n.default_locale) { node.draft.update!(:title => title) }
+    node
+  end
+
+  test "index renders" do
+    get :index
+    assert_response :success
+  end
+
+  test "index filters by node" do
+    node_a = logged_node("log_filter_a", "Alpha Subject")
+    node_b = logged_node("log_filter_b", "Beta Subject")
+    NodeAction.record!(:node => node_a, :action => "create", :user => users(:quentin))
+    NodeAction.record!(:node => node_b, :action => "create", :user => users(:quentin))
+
+    get :index, params: { :node_id => node_a.id }
+
+    assert_response :success
+    assert_includes    @response.body, "Alpha Subject"
+    assert_not_includes @response.body, "Beta Subject"
+  end
+
+  test "index filters by user" do
+    node = logged_node("log_filter_user", "Gamma Subject")
+    NodeAction.record!(:node => node, :action => "create", :user => users(:quentin))
+
+    get :index, params: { :user_id => users(:quentin).id }
+    assert_includes @response.body, "Gamma Subject"
+
+    other = User.where.not(:id => users(:quentin).id).first
+    get :index, params: { :user_id => other.id }
+    assert_not_includes @response.body, "Gamma Subject"
+  end
+
+  test "index requires login" do
+    session[:user_id] = nil
+    @controller.instance_variable_set(:@current_user, nil)
+    get :index
+    assert_response :redirect
+  end
+end
diff --git a/test/controllers/nodes_controller_test.rb b/test/controllers/nodes_controller_test.rb
index 9da9514..ddc4565 100644
--- a/test/controllers/nodes_controller_test.rb
+++ b/test/controllers/nodes_controller_test.rb
@@ -140,7 +140,7 @@ class NodesControllerTest < ActionController::TestCase
       :page => {
         :title => "Hello",
         :body => "There",
-        :template_name => "Foobar"
+        :template_name => "title_only"
       }
     }
 
@@ -148,7 +148,17 @@ class NodesControllerTest < ActionController::TestCase
     test_node.reload
     assert_equal "Hello", test_node.head.title
     assert_equal "There", test_node.head.body
-    assert_equal "Foobar", test_node.head.template_name
+    assert_equal "title_only", test_node.head.template_name
+  end
+
+  def test_update_rejects_a_template_name_not_on_disk
+    test_node = Node.root.children.create! :slug => "test_node"
+    login_as :quentin
+    put :update, params: { :id => test_node.id,
+                           :page => { :title => "Hello", :template_name => "Foobar" } }
+
+    test_node.reload
+    assert_not_equal "Foobar", test_node.draft&.template_name
   end
 
   test "publish draft with staged_slug unqueal slug" do
@@ -417,11 +427,11 @@ class NodesControllerTest < ActionController::TestCase
   test "show never renders a destroy link for events" do
     login_as :quentin
     node = create_node_with_published_page
-    Event.create!(node_id: node.id, start_time: Time.now, end_time: Time.now + 1.hour)
+    event = Event.create!(node_id: node.id, start_time: Time.now, end_time: Time.now + 1.hour)
 
     get :show, params: { id: node.id }
     assert_response :success
-    assert_select "form.button_to.destructive", count: 0
+    assert_select "form[action=?]", event_path(event), count: 0
   end
 
   test "reverting from nodes#show returns to the show page, not the editor, even if a draft remains" do
@@ -469,7 +479,8 @@ class NodesControllerTest < ActionController::TestCase
     login_as :quentin
     get :show, params: { :id => node.id }
     assert_response :success
-    assert_select "form.destructive", :count => 0
+    assert_select "form[action=?]", revert_node_path(node), count: 0
+    assert_select "form[action=?]", trash_node_path(node), count: 1
   end
 
   test "drafts includes a never-published node with only a draft" do
@@ -647,4 +658,103 @@ class NodesControllerTest < ActionController::TestCase
     assert_select ".sitemap_node_actions", :text => /Create Child/
     assert_select ".sitemap_node_actions", :text => /Revisions/, :count => 0
   end
+
+  test "create logs a create NodeAction with path and title" do
+    login_as :quentin
+
+    assert_difference "NodeAction.count" do
+      post :create, params: { :kind => "generic", :title => "Brand New", :parent_id => Node.root.id }
+    end
+
+    action = NodeAction.last
+    assert_equal "create",               action.action
+    assert_equal users(:quentin),        action.user
+    assert_equal Node.last,              action.node
+    assert_equal "Brand New",            action.metadata["title"]
+    assert_equal Node.last.unique_name,  action.metadata["path"]
+  end
+
+  test "trash moves the node and redirects to the Trash" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "trash_me")
+
+    put :trash, params: { :id => node.id }
+
+    assert_redirected_to trashed_nodes_path
+    assert node.reload.in_trash?
+  end
+
+  test "trashing the Trash node itself is refused" do
+    login_as :quentin
+
+    put :trash, params: { :id => Node.trash.id }
+
+    assert_redirected_to node_path(Node.trash)
+    assert flash[:error].present?
+  end
+
+  test "restore_from_trash reparents to the given parent" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "restore_me")
+    node.trash!(users(:quentin))
+    target = Node.root.children.create!(:slug => "restore_home")
+
+    put :restore_from_trash, params: { :id => node.id, :parent_id => target.id }
+
+    assert_redirected_to node_path(node)
+    assert_equal target, node.reload.parent
+  end
+
+  test "destroy refuses a node outside the Trash" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "not_deletable_here")
+
+    delete :destroy, params: { :id => node.id }
+
+    assert Node.exists?(node.id)
+    assert flash[:error].present?
+  end
+
+  test "destroy deletes a trashed node and redirects to the Trash" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "deletable")
+    node.trash!(users(:quentin))
+
+    delete :destroy, params: { :id => node.id }
+
+    assert_not Node.exists?(node.id)
+    assert_redirected_to trashed_nodes_path
+  end
+
+  test "trash lists trashed subtree roots" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "listed_in_trash")
+    node.trash!(users(:quentin))
+
+    get :trashed
+    assert_response :success
+    assert_select "a[href=?]", node_path(node)
+  end
+
+  test "trashed rows carry provenance and a delete for childless roots" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "provenance_test")
+    node.trash!(users(:quentin))
+
+    get :trashed
+    assert_select "td", /quentin/
+    assert_select "form[action=?]", node_path(node), count: 1
+  end
+
+test "show annotates history rows with their lifecycle" do
+    login_as :quentin
+    node = Node.root.children.create!(:slug => "history_annotation_test")
+    Globalize.with_locale(I18n.default_locale) { node.draft.update!(:title => "Annotated") }
+    node.publish_draft!(users(:quentin))
+
+    get :show, params: { :id => node.id }
+
+    assert_response :success
+    assert_select "span.revision_lifecycle", /quentin/
+  end
 end
diff --git a/test/controllers/page_translations_controller_test.rb b/test/controllers/page_translations_controller_test.rb
index 82f8bce..feaacd0 100644
--- a/test/controllers/page_translations_controller_test.rb
+++ b/test/controllers/page_translations_controller_test.rb
@@ -83,18 +83,15 @@ class PageTranslationsControllerTest < ActionController::TestCase
     assert_equal "in progress", Globalize.with_locale(:en) { node.autosave.title }
   end
 
-  test "destroy logs a translation_destroy NodeAction" do
+  test "destroy removes the translation, logs nothing, and redirects" do
     login_as :quentin
     node = Node.root.children.create!(:slug => "translation_destroy_log_test")
     Globalize.with_locale(:en) { node.draft.update!(:title => "English title") }
 
-    delete :destroy, params: { :node_id => node.id, :translation_locale => "en" }
+    assert_no_difference "NodeAction.count" do
+      delete :destroy, params: { :node_id => node.id, :translation_locale => "en" }
+    end
 
-    action = NodeAction.last
-    assert_equal node, action.node
-    assert_equal "en", action.locale
-    assert_equal "translation_destroy", action.action
-    assert_equal users(:quentin), action.user
     assert_redirected_to node_path(node)
   end
 end
diff --git a/test/fixtures/nodes.yml b/test/fixtures/nodes.yml
index 9ca325e..e94f10f 100644
--- a/test/fixtures/nodes.yml
+++ b/test/fixtures/nodes.yml
@@ -2,8 +2,6 @@
 
 root:
   id: 1
-  lft: 1
-  rgt: 10
   parent_id:
   slug:
   unique_name:
@@ -11,8 +9,6 @@ root:
 
 first_child:
   id: 2
-  lft: 2
-  rgt: 3
   parent_id: 1
   draft_id: 100
   slug: first_child
@@ -20,8 +16,6 @@ first_child:
 
 second_child:
   id: 3
-  lft: 4
-  rgt: 5
   parent_id: 1
   draft_id: 101
   slug: second_child
@@ -29,8 +23,6 @@ second_child:
   
 third_child:
   id: 4
-  lft: 6
-  rgt: 7
   parent_id: 1
   draft_id: 102
   slug: third_child
@@ -38,8 +30,6 @@ third_child:
   
 fourth_child:
   id: 5
-  lft: 8
-  rgt: 9
   parent_id: 1
   slug: fourth_child
   unique_name: fourth_child
diff --git a/test/integration/csp_header_test.rb b/test/integration/csp_header_test.rb
new file mode 100644
index 0000000..73707ed
--- /dev/null
+++ b/test/integration/csp_header_test.rb
@@ -0,0 +1,12 @@
+require 'test_helper'
+
+class CspHeaderTest < ActionDispatch::IntegrationTest
+  test "public responses carry the report-only CSP header with a nonce" do
+    get "/"
+
+    header = response.headers["Content-Security-Policy-Report-Only"]
+    assert header.present?
+    assert_includes header, "script-src"
+    assert_includes header, "nonce-"
+  end
+end
diff --git a/test/models/concerns/rrule_humanizer_test.rb b/test/models/concerns/rrule_humanizer_test.rb
index 279ff73..d747171 100644
--- a/test/models/concerns/rrule_humanizer_test.rb
+++ b/test/models/concerns/rrule_humanizer_test.rb
@@ -47,6 +47,24 @@ class RruleHumanizerTest < ActiveSupport::TestCase
     assert_equal "Every second-to-last Thursday of the month", humanize("FREQ=MONTHLY;BYDAY=-2TH", :en)
   end
 
+  test "monthly selected weeks" do
+    assert_equal "Jeden ersten, zweiten und fünften Dienstag im Monat",
+      humanize("FREQ=MONTHLY;BYDAY=1TU,2TU,5TU")
+    assert_equal "Every first, second and fifth Tuesday of the month",
+      humanize("FREQ=MONTHLY;BYDAY=1TU,2TU,5TU", :en)
+  end
+
+  test "monthly fifth weekday" do
+    assert_equal "Jeden fünften Dienstag im Monat", humanize("FREQ=MONTHLY;BYDAY=5TU")
+    assert_equal "Every fifth Tuesday of the month", humanize("FREQ=MONTHLY;BYDAY=5TU", :en)
+  end
+
+  test "monthly weekday excluding one ordinal" do
+    rrule = "FREQ=MONTHLY;BYDAY=1TU,3TU,4TU,5TU"
+    assert_equal "Jeden Dienstag im Monat, außer dem zweiten Dienstag", humanize(rrule)
+    assert_equal "Every Tuesday of the month, except the second Tuesday", humanize(rrule, :en)
+  end
+
   test "monthly no byday" do
     assert_equal "Monatlich", humanize("FREQ=MONTHLY")
     assert_equal "Monthly", humanize("FREQ=MONTHLY", :en)
@@ -96,4 +114,11 @@ class RruleHumanizerTest < ActiveSupport::TestCase
   test "wday_abbr falls back to :de for an unrecognized locale" do
     assert_equal "Mo", RruleHumanizer.wday_abbr(Time.parse("2026-07-06"), :fr)
   end
+
+  test "monthly two selected weeks" do
+    assert_equal "Jeden ersten und dritten Dienstag im Monat",
+      humanize("FREQ=MONTHLY;BYDAY=1TU,3TU")
+    assert_equal "Every first and third Tuesday of the month",
+      humanize("FREQ=MONTHLY;BYDAY=1TU,3TU", :en)
+  end
 end
diff --git a/test/models/helpers/node_actions_helper_test.rb b/test/models/helpers/node_actions_helper_test.rb
new file mode 100644
index 0000000..1b72ec9
--- /dev/null
+++ b/test/models/helpers/node_actions_helper_test.rb
@@ -0,0 +1,146 @@
+require 'test_helper'
+
+class NodeActionsHelperTest < ActionView::TestCase
+  def setup
+    @original_locale = I18n.locale
+    I18n.locale = :en
+  end
+
+  def default_url_options
+    { :locale => nil }
+  end
+
+  def icon(_name, **)
+    '<svg class="stub-icon"></svg>'.html_safe
+  end
+
+  def teardown
+    I18n.locale = @original_locale
+  end
+
+  def entry action, metadata = {}, node: nil, user: nil, page: nil
+    NodeAction.create!(:node => node, :user => user, :page => page,
+                        :action => action, :occurred_at => Time.now,
+                        :metadata => { "username" => "quentin",
+                                       "human_readable_node_name" => "Subject" }.merge(metadata))
+  end
+
+  test "publish renders the revision sentence, not the titles" do
+    out = action_summary(entry("publish",
+      { "via" => "draft", "title" => { "from" => "Old", "to" => "New" } }))
+
+    assert_includes out, "quentin"
+    assert_includes out, "new revision"
+    assert_not_includes out, "Old"
+  end
+
+  test "first publish uses its own sentence" do
+    out = action_summary(entry("publish",
+      { "via" => "draft", "title" => { "from" => nil, "to" => "New" } }))
+
+    assert_includes out, "for the first time"
+  end
+
+  test "rollback publishes get the rollback sentence" do
+    out = action_summary(entry("publish",
+      { "via" => "revision", "title" => { "from" => "Now", "to" => "Then" } }))
+
+    assert_includes out, "rolled"
+  end
+
+  test "move renders the path pair" do
+    out = action_summary(entry("move",
+      { "path" => { "from" => "a/b", "to" => "a/c" } }))
+
+    assert_includes out, "a/b"
+    assert_includes out, "a/c"
+  end
+
+  test "unknown verbs degrade to a generic sentence, never an error" do
+    out = action_summary(entry("frobnicate"))
+
+    assert_includes out, "frobnicate"
+    assert_includes out, "quentin"
+  end
+
+  test "dead references render as plain names from metadata, no links" do
+    out = action_summary(entry("publish",
+      { "title" => { "from" => "Old", "to" => "New" } }))
+
+    assert_not_includes out, "<a "
+    assert_includes out, "Subject"
+  end
+
+  test "metadata values are escaped" do
+    out = action_summary(entry("publish",
+      { "human_readable_node_name" => "<b>bold</b>" }))
+
+    assert_not_includes out, "<b>"
+  end
+
+  test "live associations upgrade names to links" do
+    out = action_summary(entry("publish",
+      { "title" => { "from" => "Old", "to" => "New" } },
+      :user => users(:quentin)))
+
+    assert_includes out, "<a "
+  end
+
+  test "details are guarded off when nothing but an unchanged title is present" do
+    unchanged = entry("publish", { "title" => { "from" => "Same", "to" => "Same" } })
+    changed   = entry("publish", { "title" => { "from" => "Old",  "to" => "New" } })
+
+    assert_not action_details?(unchanged)
+    assert action_details?(changed)
+  end
+
+  test "first publish with a byline names the author" do
+    out = action_summary(entry("publish",
+      { "title" => { "from" => nil, "to" => "New" },
+        "author" => { "from" => nil, "to" => "quentin" } }))
+
+    assert_includes out, "author"
+  end
+
+  test "create entries with their flat title render and are guarded off details" do
+    e = entry("create", { "title" => "Initial", "path" => "a/b" })
+
+    assert_includes action_summary(e), "a/b"
+    assert_not action_details?(e)
+  end
+
+  test "trash, restore, and destroy render their paths" do
+    trash   = entry("trash",   { "path" => { "from" => "club/old", "to" => "trash/old" } })
+    restore = entry("restore_from_trash", { "path" => { "from" => "trash/old", "to" => "club/new" } })
+    doomed  = entry("destroy", { "path" => "trash/old" })
+
+    assert_includes action_summary(trash),   "club/old"
+    assert_includes action_summary(restore), "club/new"
+    assert_includes action_summary(doomed),  "trash/old"
+  end
+
+  test "revision lifecycle badges cover create, publish, rollback, and inference" do
+    created   = entry("create",  { "title" => "x", "path" => "a/b" })
+    published = entry("publish", { "via" => "draft",    "title" => { "from" => nil, "to" => "x" } })
+    restored  = entry("publish", { "via" => "revision", "title" => { "from" => "y", "to" => "x" } })
+    restored.update!(:inferred_from => "from_page_revision")
+
+    out = revision_lifecycle_badges([created, published, restored])
+
+    assert_includes out, "created"
+    assert_includes out, "published"
+    assert_includes out, "restored"
+    assert_includes out, "quentin"
+    assert_includes out, "node_action_inferred"
+    assert_includes out, "<span"
+    assert_not_includes out, "&lt;span"
+
+    assert_equal "", revision_lifecycle_badges(nil)
+  end
+
+  test "verb icons map known verbs, distinguish rollbacks, and fall back" do
+    assert_includes verb_icon(entry("trash", { "path" => { "from" => "a", "to" => "t/a" } })), "node_action_icon--trash"
+    assert_includes verb_icon(entry("publish", { "via" => "revision" })), "node_action_icon--history"
+    assert_includes verb_icon(entry("frobnicate")), "node_action_icon--circle-dashed"
+  end
+end
diff --git a/test/models/node_action_test.rb b/test/models/node_action_test.rb
new file mode 100644
index 0000000..b177cca
--- /dev/null
+++ b/test/models/node_action_test.rb
@@ -0,0 +1,128 @@
+require "test_helper"
+
+class NodeActionTest < ActiveSupport::TestCase
+
+  # Standalone pages, no node -- same pattern autosave relies on.
+  # Default-locale attributes are written pinned, never ambient.
+  def build_page en: nil, **attrs
+    page = Globalize.with_locale(I18n.default_locale) do
+      Page.create!({ :title => "Titel" }.merge(attrs))
+    end
+    page.translations.create!({ :locale => "en" }.merge(en)) if en
+    page.reload
+  end
+
+  test "first publish yields exactly the title pair, from nil" do
+    diff = NodeAction.head_diff(nil, build_page(:title => "Erstausgabe"))
+
+    assert_equal({ :title => { "from" => nil, "to" => "Erstausgabe" } }, diff)
+  end
+
+  test "first publish carries the byline when the page has one" do
+    diff = NodeAction.head_diff(nil, build_page(:user => users(:quentin)))
+
+    assert_equal({ "from" => nil, "to" => users(:quentin).login }, diff[:author])
+  end
+
+  test "title pair is always present, even when unchanged" do
+    diff = NodeAction.head_diff(build_page, build_page)
+
+    assert_equal "Titel", diff[:title]["from"]
+    assert_equal "Titel", diff[:title]["to"]
+  end
+
+  test "author pair present only when the byline changed" do
+    u1, u2 = users(:quentin), users(:aaron)
+
+    assert_nil NodeAction.head_diff(build_page(:user => u1), build_page(:user => u1))[:author]
+
+    changed = NodeAction.head_diff(build_page(:user => u1), build_page(:user => u2))
+    assert_equal({ "from" => u1.login, "to" => u2.login }, changed[:author])
+  end
+
+  test "tags pair present only when the tag set changed" do
+    old_page = build_page; old_page.tag_list = "alpha, beta";  old_page.save!
+    new_page = build_page; new_page.tag_list = "beta, gamma"; new_page.save!
+
+    diff = NodeAction.head_diff(old_page.reload, new_page.reload)
+    assert_equal %w[alpha beta],  diff[:tags]["from"]
+    assert_equal %w[beta gamma], diff[:tags]["to"]
+
+    same = NodeAction.head_diff(old_page, old_page)
+    assert_nil same[:tags]
+  end
+
+  test "template_changed flag only when true" do
+    old_page = build_page(:template_name => "standard_template")
+
+    assert NodeAction.head_diff(old_page, build_page(:template_name => "update"))[:template_changed]
+    assert_nil NodeAction.head_diff(old_page, build_page(:template_name => "standard_template"))[:template_changed]
+  end
+
+  test "assets_changed flag when the attached set differs" do
+    asset = Asset.create!(:name => "diff probe",
+                          :upload_file_name    => "test_image.png",
+                          :upload_content_type => "image/png",
+                          :upload_file_size    => 49854,
+                          :upload_updated_at   => Time.current)
+    old_page, new_page = build_page, build_page
+    new_page.related_assets.create!(:asset_id => asset.id, :position => 1)
+
+
+    diff = NodeAction.head_diff(old_page, new_page.reload)
+    assert diff[:assets_changed]
+    assert_nil NodeAction.head_diff(old_page, old_page)[:assets_changed]
+  end
+
+  test "default-locale abstract and body changes become flags, only when true" do
+    diff = NodeAction.head_diff(build_page(:abstract => "a"), build_page(:abstract => "b"))
+
+    assert diff[:abstract_changed]
+    assert_nil diff[:body_changed]
+  end
+
+  test "added locale carries status and the new title" do
+    diff = NodeAction.head_diff(build_page, build_page(en: { :title => "English" }))
+
+    entry = diff[:translation_diff]["en"]
+    assert_equal "added", entry["status"]
+    assert_equal({ "from" => nil, "to" => "English" }, entry["title"])
+  end
+
+  test "removed locale keeps the vanished title" do
+    diff = NodeAction.head_diff(build_page(en: { :title => "English" }), build_page)
+
+    entry = diff[:translation_diff]["en"]
+    assert_equal "removed", entry["status"]
+    assert_equal "English", entry["title"]["from"]
+    assert_nil entry["title"]["to"]
+  end
+
+  test "changed locale carries only what actually differs" do
+    old_page = build_page(en: { :title => "Same", :body => "old" })
+    new_page = build_page(en: { :title => "Same", :body => "new" })
+
+    entry = NodeAction.head_diff(old_page, new_page)[:translation_diff]["en"]
+    assert_equal "changed", entry["status"]
+    assert_nil entry["title"]
+    assert entry["body_changed"]
+    assert_nil entry["abstract_changed"]
+  end
+
+  test "untouched locales are absent; identical pages yield no translation_diff at all" do
+    old_page = build_page(en: { :title => "Same" })
+    new_page = build_page(en: { :title => "Same" })
+
+    assert_nil NodeAction.head_diff(old_page, new_page)[:translation_diff]
+  end
+
+  test "record! passes provenance and historical timestamps through" do
+    long_ago = 2.years.ago
+    action = NodeAction.record!(:node => nil, :action => "publish",
+                                 :occurred_at => long_ago,
+                                 :inferred_from => "from_page_revision")
+
+    assert_equal "from_page_revision", action.inferred_from
+    assert_in_delta long_ago.to_f, action.occurred_at.to_f, 1.0
+  end
+end
diff --git a/test/models/node_test.rb b/test/models/node_test.rb
index 022fff6..ab66f81 100644
--- a/test/models/node_test.rb
+++ b/test/models/node_test.rb
@@ -633,6 +633,7 @@ class NodeTest < ActiveSupport::TestCase
     assert_equal node.head, action.page
     assert_equal @user1, action.user
     assert_equal "publish", action.action
+    assert_equal "draft", action.metadata["via"]
   end
 
   test "publish_draft! called with no user logs no actor, not a guessed one" do
@@ -692,7 +693,7 @@ class NodeTest < ActiveSupport::TestCase
     assert_equal count_before, NodeAction.count
   end
 
-  test "publish_draft! records the title's from/to in metadata" do
+  test "publish_draft! records the title diff in metadata" do
     node = create_node_with_published_page
     Globalize.with_locale(:de) { node.head.update!(:title => "Original Title") }
     find_or_create_draft(node, @user1)
@@ -701,7 +702,164 @@ class NodeTest < ActiveSupport::TestCase
     node.publish_draft!(@user1)
 
     action = NodeAction.last
-    assert_equal "Original Title", action.metadata["from"]
-    assert_equal "New Title", action.metadata["to"]
+    assert_equal "draft",          action.metadata["via"]
+    assert_equal "Original Title", action.metadata.dig("title", "from")
+    assert_equal "New Title",      action.metadata.dig("title", "to")
+  end
+
+  test "publishing a staged slug change logs a move with the path pair" do
+    node = create_node_with_published_page
+    path_before = node.unique_name
+    node.staged_slug = "moved-#{node.slug}"
+    node.save!
+    publish_count_before = NodeAction.where(:action => "publish").count
+
+    node.publish_draft!(@user1)
+
+    node.reload
+    assert_not_equal path_before, node.unique_name
+
+    action = NodeAction.where(:action => "move").last
+    assert_equal node,             action.node
+    assert_equal @user1,           action.user
+    assert_equal path_before,      action.metadata.dig("path", "from")
+    assert_equal node.unique_name, action.metadata.dig("path", "to")
+
+    # No draft was pending: path change alone must not fabricate a publish.
+    assert_equal publish_count_before, NodeAction.where(:action => "publish").count
+  end
+
+  test "publishing a draft together with a staged move logs two entries" do
+    node = create_node_with_published_page
+    find_or_create_draft(node, @user1)
+    node.staged_slug = "relocated-#{node.slug}"
+    node.save!
+
+    assert_difference "NodeAction.count", 2 do
+      node.publish_draft!(@user1)
+    end
+
+    assert_equal %w[move publish],
+                 NodeAction.order(:id).last(2).map(&:action).sort
+  end
+
+  test "restore_revision! logs a publish via revision" do
+    node = create_node_with_published_page
+    Globalize.with_locale(:de) { node.head.update!(:title => "First") }
+    first_head = node.head
+    find_or_create_draft(node, @user1)
+    Globalize.with_locale(:de) { node.draft.update!(:title => "Second") }
+    node.publish_draft!(@user1)
+
+    node.restore_revision!(first_head.revision, @user1)
+
+    action = NodeAction.last
+    assert_equal "publish",   action.action
+    assert_equal "revision",  action.metadata["via"]
+    assert_equal first_head,  action.page
+    assert_equal @user1,      action.user
+    assert_equal "Second",    action.metadata.dig("title", "from")
+    assert_equal "First",     action.metadata.dig("title", "to")
+  end
+
+  test "default_template_name rejects values not present in the template directory" do
+    node = Node.root.children.build(:slug => "template_guard_test",
+                                     :default_template_name => "../../layouts/admin")
+    assert_not node.valid?
+
+    node.default_template_name = "standard_template"
+    assert node.valid?
+  end
+
+  test "destroying a node with children is refused" do
+    parent = Node.root.children.create!(:slug => "destroy_guard_parent")
+    parent.children.create!(:slug => "destroy_guard_child")
+
+    assert_no_difference "Node.count" do
+      assert_not parent.destroy
+    end
+    assert parent.errors[:base].any?
+  end
+
+  test "destroying a childless node leaves no orphaned pages or asset links" do
+    node = create_node_with_published_page
+    page_ids = node.pages.pluck(:id)
+    asset = Asset.create!(:name => "destroy cascade probe",
+                          :upload_file_name    => "test_image.png",
+                          :upload_content_type => "image/png",
+                          :upload_file_size    => 49854,
+                          :upload_updated_at   => Time.current)
+    node.head.related_assets.create!(:asset_id => asset.id, :position => 1)
+
+    node.destroy
+
+    assert_equal 0, Page.where(:id => page_ids).count
+    assert_equal 0, RelatedAsset.where(:page_id => page_ids).count
+  end
+
+  test "destroying a node also removes its autosave page" do
+    node = create_node_with_published_page
+    node.lock_for_editing!(@user1)
+    node.autosave!({:title => "in flight"}, @user1)
+    autosave_id = node.autosave_id
+
+    node.destroy
+
+    assert_equal 0, Page.where(:id => autosave_id).count
+  end
+
+  test "Node.trash lazily creates the container exactly once" do
+    assert_difference "Node.count", 1 do
+      Node.trash
+    end
+    assert_no_difference "Node.count" do
+      assert_equal Node.trash, Node.trash
+    end
+    assert Node.trash.trash_node?
+    assert_not Node.trash.in_trash?
+    assert_equal "Trash", Globalize.with_locale(I18n.default_locale) { Node.trash.draft.title }
+  end
+
+  test "in_trash? walks the whole parent chain" do
+    child = Node.trash.children.create!(:slug => "trashed_thing")
+    grandchild = child.children.create!(:slug => "trashed_deeper")
+
+    assert child.in_trash?
+    assert grandchild.in_trash?
+    assert_not Node.root.children.create!(:slug => "living_thing").in_trash?
+  end
+
+  test "the reserved slug is refused for other root children, live and staged" do
+    Node.trash
+
+    assert_not Node.root.children.build(:slug => CccConventions::TRASH_SLUG).valid?
+    assert_not Node.root.children.build(:slug => "fine", :staged_slug => CccConventions::TRASH_SLUG).valid?
+    assert Node.trash.children.create!(:slug => "sub").children.build(:slug => CccConventions::TRASH_SLUG).valid?
+  end
+
+  test "the Trash node refuses rename, move, and destroy" do
+    trash = Node.trash
+    other = Node.root.children.create!(:slug => "not_the_trash")
+
+    trash.slug = "recycling"
+    assert_not trash.valid?
+
+    trash.reload.parent_id = other.id
+    assert_not trash.valid?
+
+    assert_no_difference "Node.count" do
+      assert_not trash.reload.destroy
+    end
+  end
+
+  test "a head cannot exist inside the Trash, and publishing there is refused" do
+    node = Node.trash.children.create!(:slug => "no_publish_here")
+    page = node.pages.create!
+
+    node.head = page
+    assert_not node.valid?
+
+    node.reload
+    assert_raises(ActiveRecord::RecordInvalid) { node.publish_draft! }
   end
 end
diff --git a/test/models/node_trash_test.rb b/test/models/node_trash_test.rb
new file mode 100644
index 0000000..52069d7
--- /dev/null
+++ b/test/models/node_trash_test.rb
@@ -0,0 +1,168 @@
+require "test_helper"
+
+class NodeTrashTest < ActiveSupport::TestCase
+
+  def setup
+    @user1 = User.create!(:login => "trasher", :email => "t@example.com",
+                           :password => "foobar", :password_confirmation => "foobar")
+  end
+
+  test "trash! demotes the head into the draft slot when no draft exists" do
+    node = create_node_with_published_page
+    former_head = node.head
+
+    node.trash!(@user1)
+    node.reload
+
+    assert_nil node.head_id
+    assert_equal former_head, node.draft
+    assert node.in_trash?
+  end
+
+  test "trash! keeps an existing draft; the former head stays a plain revision" do
+    node = create_node_with_published_page
+    draft = find_or_create_draft(node, @user1)
+    former_head = node.head
+
+    node.trash!(@user1)
+    node.reload
+
+    assert_nil node.head_id
+    assert_equal draft, node.draft
+    assert_includes node.pages, former_head
+  end
+
+  test "trash! demotes descendant heads and counts them in the log entry" do
+    parent = create_node_with_published_page
+    child  = parent.children.create!(:slug => "trashed_child")
+    child.draft.update!(:title => "Child")
+    child.publish_draft!(@user1)
+
+    parent.trash!(@user1)
+
+    action = NodeAction.where(:action => "trash").last
+    assert_equal parent, action.node
+    assert_equal 2, action.metadata["demoted_heads"]
+    assert action.metadata["was_published"]
+    assert_nil child.reload.head_id
+    assert child.in_trash?
+  end
+
+  test "trash! logs one entry with the path pair and updates unique names" do
+    node = create_node_with_published_page
+    path_before = node.unique_name
+
+    assert_difference "NodeAction.count", 1 do
+      node.trash!(@user1)
+    end
+
+    action = NodeAction.last
+    assert_equal path_before, action.metadata.dig("path", "from")
+    assert_equal node.reload.unique_name, action.metadata.dig("path", "to")
+    assert action.metadata.dig("path", "to").start_with?(CccConventions::TRASH_SLUG)
+  end
+
+  test "trash! on an already trashed node is a logged-nothing no-op" do
+    node = create_node_with_published_page
+    node.trash!(@user1)
+
+    assert_no_difference "NodeAction.count" do
+      assert_nil node.reload.trash!(@user1)
+    end
+  end
+
+  test "restore_from_trash! reparents as drafts without republishing" do
+    node = create_node_with_published_page
+    node.trash!(@user1)
+    target = Node.root.children.create!(:slug => "restore_target")
+
+    node.reload.restore_from_trash!(target, @user1)
+    node.reload
+
+    assert_equal target, node.parent
+    assert_not node.in_trash?
+    assert_nil node.head_id
+    assert_not_nil node.draft_id
+    assert_equal "restore_from_trash", NodeAction.last.action
+  end
+
+  test "restore_from_trash! refuses targets inside the Trash and the Trash itself" do
+    node = create_node_with_published_page
+    node.trash!(@user1)
+    other_trashed = Node.trash.children.create!(:slug => "also_trashed")
+
+    assert_raises(ActiveRecord::RecordInvalid) { node.reload.restore_from_trash!(Node.trash, @user1) }
+    assert_raises(ActiveRecord::RecordInvalid) { node.reload.restore_from_trash!(other_trashed, @user1) }
+  end
+
+  test "destroy_from_trash! refuses nodes outside the Trash" do
+    node = create_node_with_published_page
+
+    assert_raises(ActiveRecord::RecordInvalid) { node.destroy_from_trash!(@user1) }
+    assert Node.exists?(node.id)
+  end
+
+  test "destroy_from_trash! removes the whole subtree bottom-up with one entry" do
+    parent = create_node_with_published_page
+    child = parent.children.create!(:slug => "doomed_child")
+    grandchild = child.children.create!(:slug => "doomed_grandchild")
+    page_ids = [parent, child, grandchild].flat_map { |n| n.pages.pluck(:id) }
+    parent.trash!(@user1)
+
+    assert_difference "NodeAction.count", 1 do
+      parent.reload.destroy_from_trash!(@user1)
+    end
+
+    assert_not Node.exists?(parent.id)
+    assert_not Node.exists?(child.id)
+    assert_not Node.exists?(grandchild.id)
+    assert_equal 0, Page.where(:id => page_ids).count
+
+    action = NodeAction.where(:action => "destroy").last
+    assert_equal 2, action.metadata["destroyed_descendants"]
+    assert_nil action.node_id
+  end
+
+  test "destroy_from_trash! logs an entry that survives the node" do
+    node = create_node_with_published_page
+    Globalize.with_locale(I18n.default_locale) { node.head.update!(:title => "Doomed") }
+    node.trash!(@user1)
+    final_path = node.reload.unique_name
+
+    node.destroy_from_trash!(@user1)
+
+    action = NodeAction.where(:action => "destroy").last
+    assert_nil action.node_id
+    assert_equal final_path, action.metadata["path"]
+    assert_equal "Doomed", action.subject_name
+    assert_equal @user1, action.user
+  end
+
+  test "suggested_restore_parent finds the old parent while it lives" do
+    parent = Node.root.children.create!(:slug => "old_home")
+    node = parent.children.create!(:slug => "comes_back")
+    node.trash!(@user1)
+
+    assert_equal parent, node.reload.suggested_restore_parent
+
+    parent.trash!(@user1)
+    assert_nil node.reload.suggested_restore_parent
+  end
+
+  test "suggested_restore_parent is root for trashed top-level nodes" do
+    node = Node.root.children.create!(:slug => "was_top_level")
+    node.trash!(@user1)
+
+    assert_equal Node.root, node.reload.suggested_restore_parent
+  end
+
+  test "trashed nodes and the Trash itself stay out of the drafts surfaces" do
+    Node.trash
+    node = create_node_with_published_page
+    node.trash!(@user1)
+
+    ids = Node.drafts_and_autosaves.pluck(:id)
+    assert_not_includes ids, Node.trash.id
+    assert_not_includes ids, node.id
+  end
+end
diff --git a/test/models/page_test.rb b/test/models/page_test.rb
index edb7c37..1f924f9 100644
--- a/test/models/page_test.rb
+++ b/test/models/page_test.rb
@@ -370,4 +370,39 @@ class PageTest < ActiveSupport::TestCase
     assert en_entry[:changed]
     refute en_entry[:exists_there]
   end
+
+  test "aggregate ignores order_by values outside the allowlist" do
+    sql = Page.aggregate(:order_by => "pages.id; DROP TABLE pages--").to_sql
+
+    assert_not_includes sql, "DROP"
+    assert_includes sql, "pages.id ASC"
+  end
+
+  test "aggregate accepts allowlisted order columns, bare or prefixed" do
+    assert_includes Page.aggregate(:order_by => "published_at").to_sql,
+                    "pages.published_at ASC"
+    assert_includes Page.aggregate(:order_by => "pages.published_at").to_sql,
+                    "pages.published_at ASC"
+  end
+
+  test "template_name rejects values not present in the template directory" do
+    page = Page.create!(:title => "Template guard")
+
+    page.template_name = "../../partials/_article"
+    assert_not page.valid?
+
+    page.template_name = "standard_template"
+    assert page.valid?
+
+    page.template_name = ""
+    assert page.valid?
+  end
+
+  test "a stale legacy template_name does not block unrelated saves" do
+    page = Page.create!(:title => "Stale template")
+    page.update_column(:template_name, "long_deleted_template")
+
+    page.reload
+    assert page.update(:abstract => "still saveable")
+  end
 end
diff --git a/test/models/user_test.rb b/test/models/user_test.rb
index 6e4d2d7..feccce2 100644
--- a/test/models/user_test.rb
+++ b/test/models/user_test.rb
@@ -54,6 +54,78 @@ class UserTest < ActiveSupport::TestCase
   def test_should_authenticate_user
     assert_equal users(:quentin), User.authenticate('quentin', 'monkey')
   end
+
+  def test_should_not_authenticate_wrong_password
+    assert_nil User.authenticate("quentin", "wrong password")
+  end
+
+  def test_should_not_authenticate_unknown_user
+    assert_nil User.authenticate("nosuchuser", "monkey")
+  end
+
+  def test_user_with_crypted_password_is_migrated_on_login
+    user = users(:quentin)
+
+    assert_nil user.password_digest
+
+    assert User.authenticate("quentin", "monkey")
+
+    user.reload
+
+    assert_not_nil user.password_digest
+    assert_nil user.crypted_password
+    assert_nil user.salt
+  end
+
+  def test_new_user_uses_password_digest
+    user = create_user
+
+    assert_not_nil user.password_digest
+    assert_nil user.crypted_password
+    assert_nil user.salt
+
+    assert_equal user, User.authenticate("quire", "quire69")
+  end
+
+  def test_legacy_user_is_migrated_on_login
+    user = users(:quentin)
+
+    assert_nil user.password_digest
+    assert_not_nil user.crypted_password
+    assert_not_nil user.salt
+
+    assert_equal user, User.authenticate("quentin", "monkey")
+
+    user.reload
+
+    assert_not_nil user.password_digest
+    assert_nil user.crypted_password
+    assert_nil user.salt
+  end
+
+  def test_migrated_user_authenticates_using_password_digest
+    user = users(:quentin)
+
+    # Trigger automatic migration.
+    assert_equal user, User.authenticate("quentin", "monkey")
+
+    user.reload
+
+    assert_not_nil user.password_digest
+    assert_nil user.crypted_password
+    assert_nil user.salt
+
+    # Second login should now use password_digest.
+    assert_equal user, User.authenticate("quentin", "monkey")
+  end
+
+  def test_migrated_user_can_be_updated_without_password
+    user = users(:quentin)
+    assert_equal user, User.authenticate("quentin", "monkey")
+    user.reload
+
+    assert user.update(:email => "quentin@example.org")
+  end
   
 protected
   def create_user(options = {})