Add user editing for moderators

app/controllers/settings/users_controller.rb

@@ -1,5 +1,6 @@
 class Settings::UsersController < ApplicationController
   before_action :get_user, except: [:index]
+  respond_to :html
 
   def index
     @users = policy_scope(Federails::Actor).where(entity_type: "User").where.not(entity_id: nil)
@@ -10,6 +11,18 @@ def show
     render layout: "settings"
   end
 
+  def edit
+    render layout: "settings"
+  end
+
+  def update
+    if @user.update(user_params)
+      redirect_to [:settings, @user], notice: t(".success")
+    else
+      render "edit", layout: "settings", status: :unprocessable_entity
+    end
+  end
+
   private
 
   def get_user
@@ -18,6 +31,10 @@ def get_user
   end
 
   def user_params
-    params.require(:user).permit
+    params.require(:user).permit(
+      :email,
+      :username,
+      role_ids: []
+    )
   end
 end

app/policies/user_policy.rb

@@ -33,7 +33,7 @@ def create?
   def update?
     one_of(
       user == record,
-      user&.is_administrator?
+      user&.is_moderator?
     )
   end
 

app/views/settings/users/_form.html.erb

@@ -0,0 +1,20 @@
+<%= form_with model: [:settings, user] do |form| %>
+
+  <%= text_input_row form, :username %>
+  <%= text_input_row form, :email %>
+
+  <div class="row mb-3 input-group">
+    <%= form.label :roles, class: "col-auto col-form-label" %>
+    <div class="form-control col-auto">
+      <%= form.collection_check_boxes :role_ids, Role.all, :id, :name do |b|
+            content_tag :div, class: "form-check" do
+              b.check_box(class: "form-check-input") +
+                b.label(class: "form-check-label")
+            end
+          end %>
+    </div>
+  </div>
+
+  <%= form.submit translate(".submit"), class: "btn btn-primary" %>
+
+<% end %>

app/views/settings/users/edit.html.erb

@@ -0,0 +1,3 @@
+<h3><%= t(".title", username: @user.username) %></h3>
+
+<%= render "form", user: @user %>

app/views/settings/users/show.html.erb

@@ -42,3 +42,5 @@
     <td><%= @user.roles.map(&:name).join(", ") %></td>
   </tr>
 </table>
+
+<%= link_to safe_join([icon("pencil", t("general.edit")), t("general.edit")], " "), edit_settings_user_path(@user), class: "btn btn-primary" if policy(@user).edit? %>

config/locales/settings/en.yml

@@ -69,6 +69,10 @@ en:
     update:
       success: Settings saved.
     users:
+      edit:
+        title: 'Edit user: %{username}'
+      form:
+        submit: Save
       index:
         description: View and edit registered user accounts.
         fediverse_address: Fediverse address
@@ -77,3 +81,5 @@ en:
         view: View
       show:
         title: 'User details: %{username}'
+      update:
+        success: User updated successfully.

config/routes.rb

@@ -34,7 +34,7 @@
   if SiteSettings.multiuser_enabled? || Rails.env.test?
     authenticate :user, lambda { |u| u.is_moderator? } do
       namespace :settings do
-        resources :users
+        resources :users, except: [:destroy]
       end
     end
     mount Federails::Engine => "/" if SiteSettings.federation_enabled? || Rails.env.test?

spec/requests/settings/users_spec.rb

@@ -2,18 +2,56 @@
 
 RSpec.describe "/settings/users", :multiuser do
   describe "GET /index", :as_moderator do
+    before { create(:user) }
+
     it "renders a successful response" do
-      create(:user)
       get "/settings/users"
       expect(response).to be_successful
     end
   end
 
   describe "GET /show", :as_moderator do
+    let(:user) { create(:user) }
+
     it "renders a successful response" do
-      user = create(:user)
       get "/settings/users/#{user.to_param}"
       expect(response).to be_successful
     end
   end
+
+  describe "GET /edit", :as_moderator do
+    let(:user) { create(:user) }
+
+    it "renders a successful response" do
+      get "/settings/users/#{user.to_param}/edit"
+      expect(response).to be_successful
+    end
+  end
+
+  describe "PATCH /update", :as_moderator do
+    let(:user) { create(:user) }
+
+    context "with valid parameters" do
+      it "updates the requested user" do # rubocop:todo RSpec/MultipleExpectations
+        attributes = attributes_for(:user)
+        patch "/settings/users/#{user.to_param}", params: {user: attributes}
+        user.reload
+        expect(user.email).to eq attributes[:email]
+        expect(user.username).to eq attributes[:username]
+      end
+
+      it "redirects to the user" do
+        patch "/settings/users/#{user.to_param}", params: {user: attributes_for(:user)}
+        user.reload
+        expect(response).to redirect_to("/settings/users/#{user.to_param}")
+      end
+    end
+
+    context "with invalid parameters" do
+      it "renders a response with 422 status (i.e. to display the 'edit' template)" do
+        patch "/settings/users/#{user.to_param}", params: {user: {email: "invalid"}}
+        expect(response).to have_http_status(:unprocessable_entity)
+      end
+    end
+  end
 end