require 'spec_helper'

describe OrganizationUsersController do

  describe 'DELETE #destroy' do
    let!(:organization) { create(:organization) }
    let!(:user) { create(:user) }
    let!(:organization_user) do
      create(:organization_user, {
        user: user,
        organization: organization,
        admin: false
      })
    end

    let!(:admin) { create(:user) }
    let!(:organization_admin) do
      create(:organization_user, {
        user: admin,
        organization: organization,
        admin: true
      })
    end

    before do
      request.env["HTTP_REFERER"] = "http://example.com/back"
      subject.stub(:current_user).and_return(admin)
    end

    it 'deletes contributors' do
      expect {
        delete :destroy, id: organization_user.id, organization_id: organization.id
      }.to change(OrganizationUser, :count).by(-1)
    end

    it "fails to delete contributors outside of the admin's organization" do
      other_organization_user = create(:organization_user)

      expect {
        delete :destroy, id: other_organization_user.id,
          organization_id: organization.id
      }.to_not change(OrganizationUser, :count)
    end

    it 'fails if the current_user is not an admin of that organization' do
      other_user = create(:user)
      subject.stub(:current_user).and_return(other_user)

      expect {
        delete :destroy, id: organization_user.id,
          organization_id: organization.id
      }.to_not change(OrganizationUser, :count)
    end

    it 'fails if the current_user is the only remaining organization admin' do
      expect {
        delete :destroy, id: organization_admin.id,
          organization_id: organization.id
      }.to_not change(OrganizationUser, :count)
    end

  end

end

require 'spec_helper'

describe OrganizationUsersController do

  describe 'DELETE #destroy' do
    let!(:organization) { create(:organization) }
    let!(:user) { create(:user) }
    let!(:organization_user) do
      create(:organization_user, {
        user: user,
        organization: organization,
        admin: false
      })
    end

    before do
      request.env["HTTP_REFERER"] = "http://example.com/back"
      subject.stub(:current_user).and_return(user)
    end

    it 'allows authorized users to delete contributors' do
      allow_any_instance_of(OrganizationUserAuthorizer).to receive(:destroy?) { true }

      expect {
        delete :destroy, id: organization_user.id, organization_id: organization.id
      }.to change(OrganizationUser, :count).by(-1)
    end

    it 'does not allow unauthorized users to delete contributors' do
      allow_any_instance_of(OrganizationUserAuthorizer).to receive(:destroy?) { false }

      expect {
        delete :destroy, id: organization_user.id, organization_id: organization.id
      }.to_not change(OrganizationUser, :count)
    end

    it 'authorizes that the logged-in users can remove the contributor' do
      expect_any_instance_of(OrganizationUserAuthorizer).to receive(:destroy?)

      delete :destroy, id: organization_user.id, organization_id: organization.id
    end

  end

end

Refactor contributor removal controller specs
Refactor contributor removal controller specs

We adopt the style used in the OrganizationInvitation controller tests,
which only assert that we:

  1. authorize the resource
  2. assert the behavior when a user is and is not authorized to perform
     a given action
