Fix bug when removing sudoers rights to non-currently admin users

lib/redmine_sudo/hooks.rb

@@ -7,6 +7,7 @@ class Hooks < Redmine::Hook::ViewListener
   class ModelHook < Redmine::Hook::Listener
     def after_plugins_loaded(_context = {})
       require_relative 'user_patch'
+      require_relative 'users_controller_patch'
     end
   end
 end

lib/redmine_sudo/user_patch.rb

@@ -16,7 +16,7 @@ def update_admin!(value)
   end
 end
 
-class User
-  prepend RedmineSudo::UserPatch
+class User < Principal
+  include RedmineSudo::UserPatch
   before_save :update_sudoer
 end

lib/redmine_sudo/users_controller_patch.rb

@@ -0,0 +1,20 @@
+require_dependency 'users_controller'
+
+module RedmineSudo
+  module UsersControllerPatch
+    extend ActiveSupport::Concern
+
+    def update_sudoer
+      if @user.present? && params[:user][:admin] == '0'
+        @user.admin = false
+        @user.sudoer = false
+      end
+    end
+
+  end
+end
+
+class UsersController
+  include RedmineSudo::UsersControllerPatch
+  append_before_action :update_sudoer, :only => [:update]
+end

spec/controllers/users_controller_spec.rb

@@ -0,0 +1,55 @@
+require 'spec_helper'
+
+describe UsersController, type: :controller do
+  render_views
+  fixtures :users
+
+  let!(:user_7) { User.find(7) }
+
+  before do
+    @controller = UsersController.new
+    @request = ActionDispatch::TestRequest.create
+    @response = ActionDispatch::TestResponse.new
+    User.current = nil
+    @request.session[:user_id] = 1 # permissions admin
+  end
+
+  describe "POST update" do
+    it "gives both sudoer and admin roles when selecting the option in user form" do
+      user_7.update_attribute(:admin, false)
+      expect(user_7).to_not be_admin
+      expect(user_7).to_not be_sudoer
+
+      patch :update, :params => { :id => 7, :user => { admin: '1', mail: "[email protected]" } }
+
+      user_7.reload
+      expect(user_7).to be_admin
+      expect(user_7).to be_sudoer
+    end
+
+    it "removes both sudoer and admin roles when deselecting the option in user form" do
+      user_7.update_attribute(:admin, true)
+      expect(user_7).to be_admin
+      expect(user_7).to be_sudoer
+
+      patch :update, :params => { :id => 7, :user => { admin: '0', mail: "[email protected]" } }
+
+      user_7.reload
+      expect(user_7).to_not be_admin
+      expect(user_7).to_not be_sudoer
+    end
+
+    it "removes both sudoer and admin roles even when user is not currently admin" do
+      user_7.update(admin: false, sudoer: true)
+      expect(user_7).to_not be_admin
+      expect(user_7).to be_sudoer
+
+      patch :update, :params => { :id => 7, :user => { admin: '0', mail: "[email protected]" } }
+
+      user_7.reload
+      expect(user_7).to_not be_admin
+      expect(user_7).to_not be_sudoer
+    end
+  end
+
+end