Docker/Maybe
Docker/Maybe
1
0
Fork 0
mirror of https://github.com/maybe-finance/maybe.git synced 2025-07-19 13:19:39 +02:00
Code Issues Releases Activity Actions 1

fix: Only admins can generate invite codes (#1611)

Browse source 
* fix: Only admins can generate invite codes

* fix: raise error if user is not an admin when creating invite codesss
This commit is contained in:
Tony Vincent 2025-01-24 02:47:51 +01:00 • committed by GitHub
parent 0476f25952
commit 61321f6b16
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 22 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
app/controllers/invite_codes_controller.rb
View file

@ -6,6 +6,7 @@ class InviteCodesController < ApplicationController
end
def create
raise StandardError, "You are not allowed to generate invite codes" unless Current.user.admin?
InviteCode.generate!
redirect_back_or_to invite_codes_path, notice: "Code generated"
end

2
app/views/settings/hostings/_invite_code_settings.html.erb
View file

@ -7,7 +7,7 @@
<%= styled_form_with model: Setting.new, url: settings_hosting_path, method: :patch, data: { controller: "auto-submit-form", "auto-submit-form-trigger-event-value" => "blur" } do |form| %>
<div class="relative inline-block select-none">
<%= form.check_box :require_invite_for_signup, class: "sr-only peer", "data-auto-submit-form-target": "auto", "data-autosubmit-trigger-event": "input" %>
<%= form.check_box :require_invite_for_signup, class: "sr-only peer", "data-auto-submit-form-target": "auto", "data-autosubmit-trigger-event": "input", disabled: !Current.user.admin? %>
<%= form.label :require_invite_for_signup, "&nbsp;".html_safe, class: "maybe-switch" %>
</div>
<% end %>

20
test/controllers/invite_codes_controller_test.rb Normal file
View file

@ -0,0 +1,20 @@
require "test_helper"
class InviteCodesControllerTest < ActionDispatch::IntegrationTest
setup do
Rails.application.config.app_mode.stubs(:self_hosted?).returns(true)
end
test "admin can generate invite codes" do
sign_in users(:family_admin)
assert_difference("InviteCode.count") do
post invite_codes_url, params: {}
end
end
test "non-admin cannot generate invite codes" do
sign_in users(:family_member)
assert_raises(StandardError) { post invite_codes_url, params: {} }
end
end