sm-user-plugin/admin_users_test.go

package user

import (
	"net/http"
	"reflect"
	"strconv"
	"strings"
	"testing"
	"time"

	"git.golem15.com/golem15/sm-user-plugin/classes"
	"git.golem15.com/golem15/sm-user-plugin/controllers"
	"git.golem15.com/golem15/sm-user-plugin/models"
	"git.golem15.com/golem15/summercms/modules/backpack"
	"git.golem15.com/golem15/summercms/modules/compass"
	"git.golem15.com/golem15/summercms/modules/pact"
)

const (
	privilegedMemberForbidden       = "This user belongs to a privileged group. You do not have permission to change their email or password. Nothing was saved."
	privilegedMemberDeleteForbidden = "Users who belong to a privileged group cannot be deleted without the permission to manage privileged groups. Nothing was deleted."
)

// TestAdminUsersTracer drives the Users screen end to end: navigation and
// permission gating, the list schema, row states, search, the three filters
// and an update.
func TestAdminUsersTracer(t *testing.T) {
	// The permission catalog: the four Winter codes default to the developer
	// role, the privileged-groups code to no role at all.
	var codes []string
	for _, permission := range (&Plugin{}).Permissions() {
		role := "-"
		if len(permission.Roles) == 1 {
			role = permission.Roles[0]
		}
		codes = append(codes, permission.Code+"@"+role)
		if permission.Tab != "golem15.user::lang.plugin.tab" || !strings.HasPrefix(permission.Label, "golem15.user::lang.plugin.") {
			t.Fatalf("permission %+v", permission)
		}
	}
	if want := []string{
		"golem15.users.access_users@developer", "golem15.users.access_groups@developer",
		"golem15.users.access_settings@developer", "golem15.users.impersonate_user@developer",
		classes.PermissionManagePrivilegedGroups + "@-",
	}; !reflect.DeepEqual(codes, want) || classes.PermissionManagePrivilegedGroups != permManagePrivileged {
		t.Fatalf("permissions = %v", codes)
	}

	env := newAdminEnv(t)
	token := env.admin(t, permAccessUsers)
	stranger := env.admin(t)

	// Navigation lists the item only for an administrator who may open it.
	var nav []struct {
		Code       string `json:"code"`
		Order      int    `json:"order"`
		Controller string `json:"controller"`
		SideMenu   []struct {
			Code string `json:"code"`
		} `json:"sideMenu"`
	}
	adminInto(t, env.expect(t, http.StatusOK, http.MethodGet, adminAPI("/navigation"), token, nil), &nav)
	if len(nav) != 1 || nav[0].Code != "user" || nav[0].Order != 555 || nav[0].Controller != "golem15.user.users" ||
		len(nav[0].SideMenu) != 1 || nav[0].SideMenu[0].Code != "users" {
		t.Fatalf("navigation = %+v", nav)
	}
	nav = nil
	adminInto(t, env.expect(t, http.StatusOK, http.MethodGet, adminAPI("/navigation"), stranger, nil), &nav)
	if len(nav) != 0 {
		t.Fatalf("navigation without the permission = %+v", nav)
	}
	for _, path := range []string{adminAPI(adminUsersPath), adminAPI(adminUsersPath + "/schema/list"), adminAPI(adminUsersPath + "/schema/form")} {
		rec := env.expect(t, http.StatusForbidden, http.MethodGet, path, stranger, nil)
		if code := adminDecode(t, rec).Error.Code; code != "forbidden" {
			t.Fatalf("%s code = %q", path, code)
		}
	}
	env.expect(t, http.StatusUnauthorized, http.MethodGet, adminAPI(adminUsersPath), "", nil)

	// The list schema: exactly the ported columns and filters. There is no
	// login-name column (D-18) and no guest column (D-03).
	var schema struct {
		RecordURL string `json:"recordUrl"`
		Columns   []struct {
			Key        string `json:"key"`
			Invisible  bool   `json:"invisible"`
			Searchable bool   `json:"searchable"`
			Type       string `json:"type"`
		} `json:"columns"`
		Filters []struct {
			Name   string `json:"name"`
			Type   string `json:"type"`
			Scope  string `json:"scope"`
			Column string `json:"column"`
		} `json:"filters"`
		Messages map[string]map[string]string `json:"messages"`
	}
	adminInto(t, env.expect(t, http.StatusOK, http.MethodGet, adminAPI(adminUsersPath+"/schema/list"), token, nil), &schema)
	var columns, invisible, searchable, filters []string
	for _, column := range schema.Columns {
		columns = append(columns, column.Key)
		if column.Invisible {
			invisible = append(invisible, column.Key)
		}
		if column.Searchable {
			searchable = append(searchable, column.Key)
		}
	}
	for _, filter := range schema.Filters {
		filters = append(filters, filter.Name+":"+filter.Type+":"+filter.Scope+filter.Column)
	}
	if want := []string{"id", "name", "surname", "email", "created_at", "last_seen", "created_ip_address", "last_ip_address"}; !reflect.DeepEqual(columns, want) {
		t.Fatalf("columns = %v, want %v", columns, want)
	}
	if want := []string{"id", "surname", "created_ip_address", "last_ip_address"}; !reflect.DeepEqual(invisible, want) {
		t.Fatalf("invisible columns = %v, want %v", invisible, want)
	}
	if want := []string{"name", "surname", "email", "created_ip_address", "last_ip_address"}; !reflect.DeepEqual(searchable, want) {
		t.Fatalf("searchable columns = %v, want %v", searchable, want)
	}
	if want := []string{"groups:scope:filterByGroup", "created_date:daterange:created_at", "activated:switch:is_activated"}; !reflect.DeepEqual(filters, want) {
		t.Fatalf("filters = %v, want %v", filters, want)
	}
	for key, want := range map[string]string{
		"empty":            "No users match this view. Clear the filters, or add one with New User.",
		"rowStateDeleted":  "Deactivated",
		"rowStateNegative": "Banned",
		"rowStateDisabled": "Not activated",
	} {
		if got := schema.Messages[key]["other"]; got != want {
			t.Fatalf("list message %s = %q", key, got)
		}
	}

	// Seed: every user of this test shares one marker in the surname, which
	// is searchable and not shown.
	marker := "tracer" + adminStamp()
	seed := func(label string, mutate func(*models.User)) *models.User {
		return env.seedUser(t, label, func(u *models.User) {
			u.Surname = &marker
			if mutate != nil {
				mutate(u)
			}
		})
	}
	active := seed("active", nil)
	deactivated := seed("deactivated", nil)
	banned := seed("banned", nil)
	inactive := seed("inactive", func(u *models.User) { u.IsActivated = false })
	old := seed("old", nil)
	if err := env.gdb.Exec(`UPDATE users SET deleted_at = NOW() WHERE id = ?`, deactivated.ID).Error; err != nil {
		t.Fatal(err)
	}
	if err := env.gdb.Exec(`INSERT INTO user_throttle (user_id, ip_address, is_banned) VALUES (?, NULL, TRUE)`, banned.ID).Error; err != nil {
		t.Fatal(err)
	}
	if err := env.gdb.Exec(`UPDATE users SET created_at = '2020-06-15 12:00:00+00' WHERE id = ?`, old.ID).Error; err != nil {
		t.Fatal(err)
	}
	group := env.seedGroup(t, "Tracer group "+marker, "tracer-"+marker)
	env.join(t, active, group)
	env.join(t, deactivated, group)

	// Search by the invisible surname finds all five, deactivated included,
	// with their row states; the rows carry no surname and no secret.
	page := env.users(t, token, "search="+marker)
	if page.Total != 5 {
		t.Fatalf("search total = %d: %s", page.Total, page.Raw)
	}
	for _, user := range []*models.User{active, deactivated, banned, inactive, old} {
		row := page.row(user.ID)
		if row == nil {
			t.Fatalf("user %d missing from the list: %s", user.ID, page.Raw)
		}
		for _, hidden := range []string{"surname", "created_ip_address", "last_ip_address", "permissions", "is_activated"} {
			if _, ok := row[hidden]; ok {
				t.Fatalf("list row carries %s: %v", hidden, row)
			}
		}
		for _, shown := range []string{"id", "name", "email", "created_at", "last_seen"} {
			if _, ok := row[shown]; !ok {
				t.Fatalf("list row lacks %s: %v", shown, row)
			}
		}
	}
	assertNoSecret(t, page.Raw)
	for id, want := range map[uint][]string{
		active.ID:      nil,
		deactivated.ID: {"deleted"},
		banned.ID:      {"negative"},
		inactive.ID:    {"disabled"},
	} {
		if got := page.states(id); !reflect.DeepEqual(got, want) {
			t.Fatalf("row states of %d = %v, want %v", id, got, want)
		}
	}

	// The groups filter keeps the group's members; its choices are the groups.
	gid := strconv.FormatUint(uint64(group.ID), 10)
	members := env.users(t, token, "search="+marker+"&filter[groups]="+gid)
	if members.Total != 2 || !members.has(active.ID) || !members.has(deactivated.ID) {
		t.Fatalf("group filter = %s", members.Raw)
	}
	var options []struct {
		Value string `json:"value"`
		Label string `json:"label"`
	}
	adminInto(t, env.expect(t, http.StatusOK, http.MethodGet, adminAPI(adminUsersPath+"/filters/groups/options"), token, nil), &options)
	found := false
	for _, option := range options {
		if option.Value == gid && option.Label == group.Name {
			found = true
		}
	}
	if !found {
		t.Fatalf("group %s missing from the filter options: %+v", gid, options)
	}
	env.expect(t, http.StatusForbidden, http.MethodGet, adminAPI(adminUsersPath+"/filters/groups/options"), stranger, nil)

	// The date range and the activated switch.
	ranged := env.users(t, token, "search="+marker+"&filter[created_date]=2020-06-01..2020-06-30")
	if ranged.Total != 1 || !ranged.has(old.ID) {
		t.Fatalf("date range filter = %s", ranged.Raw)
	}
	notActivated := env.users(t, token, "search="+marker+"&filter[activated]=false")
	if notActivated.Total != 1 || !notActivated.has(inactive.ID) {
		t.Fatalf("activated=false filter = %s", notActivated.Raw)
	}
	activated := env.users(t, token, "search="+marker+"&filter[activated]=true")
	if activated.Total != 4 || activated.has(inactive.ID) {
		t.Fatalf("activated=true filter = %s", activated.Raw)
	}

	// An update of name and email persists and returns no secret.
	renamed := "renamed-" + marker + "@example.test"
	rec := env.expect(t, http.StatusOK, http.MethodPut, userPath(active.ID, ""), token, map[string]any{"name": "Renamed", "email": renamed})
	assertNoSecret(t, rec.Body.String())
	if got := env.reload(t, active.ID); got.Email != renamed || got.Name == nil || *got.Name != "Renamed" {
		t.Fatalf("update did not persist: %+v", got)
	}
	// The stored hash survives an update that does not name a password.
	if got := env.reload(t, active.ID); got.Password != active.Password {
		t.Fatal("an update without a password changed the stored hash")
	}
	// A name-only update needs no password (the admin rules replace the
	// register rules).
	env.expect(t, http.StatusOK, http.MethodPut, userPath(active.ID, ""), token, map[string]any{"name": "Renamed again", "email": renamed})

	// A deactivated user can be shown and updated and stays deactivated.
	show := env.expect(t, http.StatusOK, http.MethodGet, userPath(deactivated.ID, ""), token, nil)
	assertNoSecret(t, show.Body.String())
	before := env.reload(t, deactivated.ID)
	env.expect(t, http.StatusOK, http.MethodPut, userPath(deactivated.ID, ""), token, map[string]any{"name": "Still gone", "email": deactivated.Email})
	after := env.reload(t, deactivated.ID)
	if !after.DeletedAt.Valid || !after.DeletedAt.Time.Equal(before.DeletedAt.Time) || after.Name == nil || *after.Name != "Still gone" {
		t.Fatalf("deactivated user after update = %+v", after)
	}

	// Validation failures answer 422 and mark the field.
	dup := env.expect(t, http.StatusUnprocessableEntity, http.MethodPut, userPath(banned.ID, ""), token, map[string]any{"name": "Dup", "email": renamed})
	if details := adminDecode(t, dup).Error.Details; len(details["email"]) == 0 {
		t.Fatalf("duplicate email details = %v", details)
	}
	bad := env.expect(t, http.StatusUnprocessableEntity, http.MethodPut, userPath(banned.ID, ""), token, map[string]any{"name": "Bad", "email": "nope"})
	if details := adminDecode(t, bad).Error.Details; len(details["email"]) == 0 {
		t.Fatalf("invalid email details = %v", details)
	}
	if got := env.reload(t, banned.ID); got.Email != banned.Email {
		t.Fatal("a refused update changed the email")
	}

	// Protected columns are never written from a body.
	env.expect(t, http.StatusOK, http.MethodPut, userPath(inactive.ID, ""), token, map[string]any{
		"name": "Still inactive", "email": inactive.Email, "is_activated": true, "password": "forged-password-1", "permissions": map[string]int{"x": 1},
	})
	if got := env.reload(t, inactive.ID); got.IsActivated || got.Password != inactive.Password {
		t.Fatalf("a body wrote a protected column: %+v", got)
	}

	// Writes need the permission too.
	env.expect(t, http.StatusForbidden, http.MethodPut, userPath(active.ID, ""), stranger, map[string]any{"name": "Nope", "email": renamed})
}

// TestAdminPrivilegedMember covers the takeover guard (D-30): the email of a
// member of a privileged group, and the delete of such a user, need
// golem15.users.manage_privileged_groups on top of
// golem15.users.access_users.
func TestAdminPrivilegedMember(t *testing.T) {
	env := newAdminEnv(t)
	limited := env.admin(t, permAccessUsers)
	manager := env.admin(t, permAccessUsers, permManagePrivileged)

	stamp := adminStamp()
	// The default privileged list is [admin]; several groups may carry the code.
	adminGroup := env.seedGroup(t, "Admins "+stamp, "admin")
	ordinaryCode := "ordinary-" + stamp
	ordinary := env.seedGroup(t, "Ordinary "+stamp, ordinaryCode)
	uncoded := env.seedGroup(t, "Uncoded "+stamp, "")

	member := env.seedUser(t, "member", nil)
	env.join(t, member, adminGroup, ordinary)
	plain := env.seedUser(t, "plain", nil)
	env.join(t, plain, ordinary, uncoded)
	gone := env.seedUser(t, "gone", nil)
	env.join(t, gone, adminGroup)
	if err := env.gdb.Exec(`UPDATE users SET deleted_at = NOW() WHERE id = ?`, gone.ID).Error; err != nil {
		t.Fatal(err)
	}

	assertRefused := func(body map[string]any, id uint, fields ...string) {
		t.Helper()
		rec := env.expect(t, http.StatusForbidden, http.MethodPut, userPath(id, ""), limited, body)
		answer := adminDecode(t, rec)
		if answer.Error.Code != "forbidden" || answer.Error.Message != privilegedMemberForbidden {
			t.Fatalf("refusal = %s", rec.Body.String())
		}
		if len(answer.Error.Details) != len(fields) {
			t.Fatalf("refusal details = %v, want fields %v", answer.Error.Details, fields)
		}
		for _, field := range fields {
			if got := answer.Error.Details[field]; len(got) != 1 || got[0] != privilegedMemberForbidden {
				t.Fatalf("refusal details[%s] = %v", field, got)
			}
		}
	}
	unchanged := func(original *models.User) {
		t.Helper()
		got := env.reload(t, original.ID)
		if got == nil {
			t.Fatalf("user %d is gone", original.ID)
		}
		if got.Email != original.Email || !reflect.DeepEqual(got.Name, original.Name) || got.Password != original.Password ||
			got.DeletedAt.Valid != original.DeletedAt.Valid {
			t.Fatalf("user %d changed: %+v", original.ID, got)
		}
	}
	gone = env.reload(t, gone.ID)

	// An email change on a privileged member is refused as a whole: the name
	// in the same body is not saved either.
	assertRefused(map[string]any{"name": "Taken over", "email": "takeover-" + stamp + "@example.test"}, member.ID, "email")
	unchanged(member)
	// A deactivated privileged member is protected the same way.
	assertRefused(map[string]any{"name": "Taken over", "email": "takeover-gone-" + stamp + "@example.test"}, gone.ID, "email")
	unchanged(gone)

	// The stored email sent back unchanged with a new name is an ordinary update.
	env.expect(t, http.StatusOK, http.MethodPut, userPath(member.ID, ""), limited, map[string]any{"name": "New name", "email": member.Email})
	if got := env.reload(t, member.ID); got.Name == nil || *got.Name != "New name" || got.Email != member.Email {
		t.Fatalf("name-only update of a privileged member = %+v", got)
	}
	member = env.reload(t, member.ID)

	// The delete of a privileged member is refused and nothing changes.
	for _, target := range []*models.User{member, gone} {
		rec := env.expect(t, http.StatusForbidden, http.MethodDelete, userPath(target.ID, ""), limited, nil)
		answer := adminDecode(t, rec)
		if answer.Error.Code != "forbidden" || answer.Error.Message != privilegedMemberDeleteForbidden || len(answer.Error.Details) != 0 {
			t.Fatalf("delete refusal = %s", rec.Body.String())
		}
		unchanged(target)
		if got := env.groupIDs(t, target.ID); len(got) == 0 {
			t.Fatalf("a refused delete removed the memberships of %d", target.ID)
		}
	}

	// A member of ordinary groups only, and of a group without a code, is
	// not protected.
	plainEmail := "plain-new-" + stamp + "@example.test"
	env.expect(t, http.StatusOK, http.MethodPut, userPath(plain.ID, ""), limited, map[string]any{"name": "Plain", "email": plainEmail})
	if got := env.reload(t, plain.ID); got.Email != plainEmail {
		t.Fatalf("ordinary member email = %q", got.Email)
	}

	// With the permission both refused requests succeed.
	memberEmail := "member-new-" + stamp + "@example.test"
	env.expect(t, http.StatusOK, http.MethodPut, userPath(member.ID, ""), manager, map[string]any{"name": "Managed", "email": memberEmail})
	if got := env.reload(t, member.ID); got.Email != memberEmail {
		t.Fatalf("manager email change = %q", got.Email)
	}

	// The delete is permanent, so the refusal must leave everything that
	// hangs off the member in place: throttle rows, memberships, the avatar
	// row and its blob.
	env.seedThrottle(t, member, "203.0.113.7", false, nil)
	memberAvatar := env.seedAvatar(t, member)
	memberHangers := env.hangers(t, member)
	if memberHangers.Throttle != 1 || memberHangers.Groups != 2 || memberHangers.Files != 1 {
		t.Fatalf("member seed = %+v", memberHangers)
	}
	rec := env.expect(t, http.StatusForbidden, http.MethodDelete, userPath(member.ID, ""), limited, nil)
	if answer := adminDecode(t, rec); answer.Error.Message != privilegedMemberDeleteForbidden {
		t.Fatalf("delete refusal = %s", rec.Body.String())
	}
	if env.reload(t, member.ID) == nil || env.hangers(t, member) != memberHangers || !env.blobExists(t, memberAvatar) {
		t.Fatalf("a refused delete changed the member: %+v", env.hangers(t, member))
	}

	// A bulk delete with one privileged member in the selection is refused as
	// a whole: the two ordinary users and their rows stay as well.
	first := env.seedUser(t, "bulk-first", nil)
	second := env.seedUser(t, "bulk-second", nil)
	env.join(t, first, ordinary)
	env.seedThrottle(t, first, "", false, nil)
	firstAvatar := env.seedAvatar(t, first)
	firstHangers := env.hangers(t, first)
	// Ids are processed in ascending order, so the member (the lowest id) is
	// refused first; the reverse order is covered by the second selection.
	late := env.seedUser(t, "late-member", nil)
	env.join(t, late, adminGroup)
	for _, selection := range [][]*models.User{{member, first, second}, {first, second, late}} {
		rec = env.bulk(t, limited, "delete", selection...)
		if rec.Code != http.StatusForbidden || adminDecode(t, rec).Error.Message != privilegedMemberDeleteForbidden {
			t.Fatalf("bulk delete refusal = %d %s", rec.Code, rec.Body.String())
		}
		for _, user := range selection {
			if env.reload(t, user.ID) == nil {
				t.Fatalf("a refused bulk delete removed user %d", user.ID)
			}
		}
		if env.hangers(t, first) != firstHangers || env.hangers(t, member) != memberHangers ||
			!env.blobExists(t, firstAvatar) || !env.blobExists(t, memberAvatar) {
			t.Fatal("a refused bulk delete removed rows or blobs")
		}
	}

	// Deactivating a privileged member is not a permanent delete and needs
	// only the users permission; so does restoring them.
	if rec = env.bulk(t, limited, "deactivate", late); rec.Code != http.StatusOK {
		t.Fatalf("bulk deactivate of a privileged member = %d %s", rec.Code, rec.Body.String())
	}
	if got := env.reload(t, late.ID); got == nil || !got.DeletedAt.Valid {
		t.Fatalf("privileged member after deactivate = %+v", got)
	}
	if rec = env.bulk(t, limited, "restore", late); rec.Code != http.StatusOK {
		t.Fatalf("bulk restore of a privileged member = %d %s", rec.Code, rec.Body.String())
	}

	// With the permission the form delete and the bulk delete remove the
	// member for good, with the full cleanup.
	env.expect(t, http.StatusOK, http.MethodDelete, userPath(member.ID, ""), manager, nil)
	if env.reload(t, member.ID) != nil || env.hangers(t, member) != (hangers{}) || env.blobExists(t, memberAvatar) {
		t.Fatalf("manager delete left something of the member: %+v", env.hangers(t, member))
	}
	if rec = env.bulk(t, manager, "delete", first, second, late); rec.Code != http.StatusOK {
		t.Fatalf("manager bulk delete = %d %s", rec.Code, rec.Body.String())
	}
	for _, user := range []*models.User{first, second, late} {
		if env.reload(t, user.ID) != nil || env.hangers(t, user) != (hangers{}) {
			t.Fatalf("manager bulk delete left user %d: %+v", user.ID, env.hangers(t, user))
		}
	}
	if env.blobExists(t, firstAvatar) {
		t.Fatal("manager bulk delete left the avatar blob")
	}

	// The privileged list is config, read per request: with the ordinary
	// group's code in it the protection moves to that group's member, and the
	// admin group's member is no longer protected.
	moved := newAdminEnv(t, func(cfg *compass.Config) {
		if err := cfg.Set("golem15.user.privileged_groups", []string{ordinaryCode}); err != nil {
			t.Fatal(err)
		}
	})
	movedLimited := moved.admin(t, permAccessUsers)
	rec = moved.expect(t, http.StatusForbidden, http.MethodPut, userPath(plain.ID, ""), movedLimited, map[string]any{"name": "Plain", "email": "plain-moved-" + stamp + "@example.test"})
	if answer := adminDecode(t, rec); answer.Error.Message != privilegedMemberForbidden || len(answer.Error.Details["email"]) != 1 {
		t.Fatalf("moved refusal = %s", rec.Body.String())
	}
	if got := moved.reload(t, plain.ID); got.Email != plainEmail {
		t.Fatalf("a refused update changed the email to %q", got.Email)
	}
	goneEmail := "gone-moved-" + stamp + "@example.test"
	moved.expect(t, http.StatusOK, http.MethodPut, userPath(gone.ID, ""), movedLimited, map[string]any{"name": "Gone", "email": goneEmail})
	if got := moved.reload(t, gone.ID); got.Email != goneEmail || !got.DeletedAt.Valid {
		t.Fatalf("admin-group member under the moved list = %+v", got)
	}
	if strings.Contains(rec.Body.String(), adminHarnessSecret) {
		t.Fatal("a refusal carries the admin secret")
	}
}

// bulkAnswer is the data of a bulk action answer.
type bulkAnswer struct {
	Message  string `json:"message"`
	Affected int    `json:"affected"`
}

// TestAdminUserActions covers the five bulk actions, the three record
// actions and the preview status hint (D-11, D-14), and that none of them
// writes users_groups.
func TestAdminUserActions(t *testing.T) {
	env := newAdminEnv(t)
	token := env.admin(t, permAccessUsers)
	stranger := env.admin(t)

	// Nothing but the ported actions is offered: no impersonate, no guest.
	var schema struct {
		RecordURL   string `json:"recordUrl"`
		BulkActions []struct {
			Name    string `json:"name"`
			Label   string `json:"label"`
			Confirm string `json:"confirm"`
		} `json:"bulkActions"`
		ToolbarButtons []string `json:"toolbarButtons"`
	}
	adminInto(t, env.expect(t, http.StatusOK, http.MethodGet, adminAPI(adminUsersPath+"/schema/list"), token, nil), &schema)
	var bulkNames []string
	for _, action := range schema.BulkActions {
		bulkNames = append(bulkNames, action.Name)
		if action.Label == "" || strings.Contains(action.Label, "::") || strings.Contains(action.Confirm, "::") {
			t.Fatalf("bulk action copy is not translated: %+v", action)
		}
	}
	if want := []string{"delete", "activate", "deactivate", "restore", "ban", "unban"}; !reflect.DeepEqual(bulkNames, want) {
		t.Fatalf("bulk actions = %v, want %v", bulkNames, want)
	}
	if schema.RecordURL != "golem15/user/users/preview/:id" {
		t.Fatalf("recordUrl = %q", schema.RecordURL)
	}
	var registered []string
	for _, ctl := range controllers.AdminControllers(func() *backpack.App { return env.app }) {
		if ctl.ID() != "golem15.user.users" {
			continue
		}
		for _, action := range ctl.(pact.HasAdminRecordActions).AdminRecordActions() {
			registered = append(registered, action.Name)
		}
	}
	if want := []string{"activate", "unban", "unsuspend"}; !reflect.DeepEqual(registered, want) {
		t.Fatalf("record actions = %v, want %v", registered, want)
	}
	var form struct {
		Preview *struct {
			HeaderPartial string `json:"headerPartial"`
		} `json:"preview"`
		Fields []struct {
			Name    string `json:"name"`
			Context any    `json:"context"`
		} `json:"fields"`
		Messages map[string]map[string]string `json:"messages"`
	}
	adminInto(t, env.expect(t, http.StatusOK, http.MethodGet, adminAPI(adminUsersPath+"/schema/form"), token, nil), &form)
	if form.Preview == nil || form.Preview.HeaderPartial != "hint" || form.Messages["edit"]["other"] != "Update details" {
		t.Fatalf("form preview = %+v messages = %v", form.Preview, form.Messages["edit"])
	}
	previewOnly := map[string]bool{}
	for _, field := range form.Fields {
		if field.Context == "preview" {
			previewOnly[field.Name] = true
		}
	}
	if !previewOnly["created_ip_address"] || !previewOnly["last_ip_address"] || len(previewOnly) != 2 {
		t.Fatalf("preview-only fields = %v", previewOnly)
	}

	group := env.seedGroup(t, "Actions "+adminStamp(), "actions-"+adminStamp())
	seed := func(label string, mutate func(*models.User)) *models.User {
		user := env.seedUser(t, label, mutate)
		env.join(t, user, group)
		return user
	}
	notActive := func(u *models.User) { u.IsActivated = false }
	idleA, idleB, live := seed("idle-a", notActive), seed("idle-b", notActive), seed("live", nil)
	code := "pending-code"
	if err := env.gdb.Exec(`UPDATE users SET activation_code = ?, activation_code_issued_at = NOW() WHERE id = ?`, code, idleA.ID).Error; err != nil {
		t.Fatal(err)
	}
	everyone := []*models.User{idleA, idleB, live}
	memberships := func() map[uint][]uint {
		out := map[uint][]uint{}
		for _, user := range everyone {
			out[user.ID] = env.groupIDs(t, user.ID)
		}
		return out
	}
	before := memberships()
	untouched := func(step string) {
		t.Helper()
		if got := memberships(); !reflect.DeepEqual(got, before) {
			t.Fatalf("%s changed users_groups: %v, want %v", step, got, before)
		}
	}
	run := func(action string, users ...*models.User) bulkAnswer {
		t.Helper()
		rec := env.bulk(t, token, action, users...)
		if rec.Code != http.StatusOK {
			t.Fatalf("bulk %s = %d %s", action, rec.Code, rec.Body.String())
		}
		var answer bulkAnswer
		adminInto(t, rec, &answer)
		untouched("bulk " + action)
		return answer
	}

	// Activate skips the user who is already active and reports the count
	// without the fixed success phrase, which would overstate.
	if answer := run("activate", everyone...); answer.Affected != 2 || answer.Message != "" {
		t.Fatalf("bulk activate = %+v", answer)
	}
	for _, user := range everyone {
		got := env.reload(t, user.ID)
		if !got.IsActivated || (user.ID != live.ID && got.ActivatedAt == nil) || got.ActivationCode != nil {
			t.Fatalf("user %d after bulk activate = %+v", user.ID, got)
		}
	}
	if answer := run("activate", everyone...); answer.Affected != 0 || answer.Message != "" {
		t.Fatalf("second bulk activate = %+v", answer)
	}
	// When every selected user changes, the fixed phrase is the message.
	fresh := seed("fresh", notActive)
	everyone = append(everyone, fresh)
	before = memberships()
	if answer := run("activate", fresh); answer.Affected != 1 || answer.Message != "Successfully activated the selected users." {
		t.Fatalf("full bulk activate = %+v", answer)
	}

	// Deactivate is the soft delete; the users stay listed as deleted.
	if answer := run("deactivate", idleA, idleB); answer.Affected != 2 || answer.Message != "Successfully deactivated the selected users." {
		t.Fatalf("bulk deactivate = %+v", answer)
	}
	page := env.users(t, token, "search="+idleA.Email)
	if !reflect.DeepEqual(page.states(idleA.ID), []string{"deleted"}) {
		t.Fatalf("deactivated row = %s", page.Raw)
	}
	if got := env.reload(t, idleB.ID); !got.DeletedAt.Valid {
		t.Fatal("bulk deactivate did not set deleted_at")
	}
	if answer := run("deactivate", idleA, live); answer.Affected != 1 || answer.Message != "" {
		t.Fatalf("mixed bulk deactivate = %+v", answer)
	}
	// Restore brings them back.
	if answer := run("restore", idleA, idleB, live); answer.Affected != 3 || answer.Message != "Successfully restored the selected users." {
		t.Fatalf("bulk restore = %+v", answer)
	}
	for _, user := range []*models.User{idleA, idleB, live} {
		if got := env.reload(t, user.ID); got.DeletedAt.Valid {
			t.Fatalf("user %d is still deactivated", user.ID)
		}
	}
	// Activating a deactivated, not activated user restores them as well.
	sleeper := seed("sleeper", notActive)
	everyone = append(everyone, sleeper)
	before = memberships()
	run("deactivate", sleeper)
	if answer := run("activate", sleeper); answer.Affected != 1 {
		t.Fatalf("activate of a deactivated user = %+v", answer)
	}
	if got := env.reload(t, sleeper.ID); !got.IsActivated || got.DeletedAt.Valid {
		t.Fatalf("sleeper after activate = %+v", got)
	}

	// Ban refuses the login from any address and marks the row; unban lifts it.
	if status, _ := env.userLogin(t, live.Email, "correct-horse"); status != http.StatusOK {
		t.Fatalf("login before the ban = %d", status)
	}
	if answer := run("ban", live); answer.Affected != 1 || answer.Message != "Successfully banned the selected users." {
		t.Fatalf("bulk ban = %+v", answer)
	}
	for range 2 {
		if status, token := env.userLogin(t, live.Email, "correct-horse"); status != http.StatusUnauthorized || token != "" {
			t.Fatalf("banned login = %d", status)
		}
	}
	page = env.users(t, token, "search="+live.Email)
	if !reflect.DeepEqual(page.states(live.ID), []string{"negative"}) {
		t.Fatalf("banned row = %s", page.Raw)
	}
	if answer := run("ban", live, idleA); answer.Affected != 1 || answer.Message != "" {
		t.Fatalf("second bulk ban = %+v", answer)
	}
	if answer := run("unban", live, idleA, idleB); answer.Affected != 2 || answer.Message != "" {
		t.Fatalf("bulk unban = %+v", answer)
	}
	if status, _ := env.userLogin(t, live.Email, "correct-horse"); status != http.StatusOK {
		t.Fatalf("login after the unban = %d", status)
	}

	// Record actions are offered only while they apply.
	pending := seed("pending", notActive)
	everyone = append(everyone, pending)
	before = memberships()
	if got := env.offered(t, token, pending.ID); !reflect.DeepEqual(got, []string{"activate"}) {
		t.Fatalf("offered for a not activated user = %v", got)
	}
	if got := env.offered(t, token, live.ID); len(got) != 0 {
		t.Fatalf("offered for an ordinary user = %v", got)
	}
	act := func(status int, action string, user *models.User) string {
		t.Helper()
		rec := env.expect(t, status, http.MethodPost, userPath(user.ID, "/actions/"+action), token, map[string]any{})
		untouched("record " + action)
		if status != http.StatusOK {
			return ""
		}
		var answer struct {
			Message string `json:"message"`
		}
		adminInto(t, rec, &answer)
		return answer.Message
	}
	if message := act(http.StatusOK, "activate", pending); message != "User has been activated" {
		t.Fatalf("activate message = %q", message)
	}
	if got := env.reload(t, pending.ID); !got.IsActivated || got.ActivatedAt == nil {
		t.Fatalf("pending after activate = %+v", got)
	}
	act(http.StatusConflict, "activate", pending)
	act(http.StatusConflict, "unban", pending)
	act(http.StatusConflict, "unsuspend", pending)

	run("ban", pending)
	if got := env.offered(t, token, pending.ID); !reflect.DeepEqual(got, []string{"unban"}) {
		t.Fatalf("offered for a banned user = %v", got)
	}
	if message := act(http.StatusOK, "unban", pending); message != "User has been unbanned" {
		t.Fatalf("unban message = %q", message)
	}
	if got := env.offered(t, token, pending.ID); len(got) != 0 {
		t.Fatalf("offered after unban = %v", got)
	}

	// Suspended means suspended inside the window; an expired suspension
	// offers nothing and is not lifted by reading it.
	now, longAgo := time.Now(), time.Now().Add(-2*time.Hour)
	suspended := seed("suspended", nil)
	expired := seed("expired", nil)
	everyone = append(everyone, suspended, expired)
	before = memberships()
	env.seedThrottle(t, suspended, "203.0.113.9", false, &now)
	env.seedThrottle(t, expired, "203.0.113.9", false, &longAgo)
	if got := env.offered(t, token, suspended.ID); !reflect.DeepEqual(got, []string{"unsuspend"}) {
		t.Fatalf("offered for a suspended user = %v", got)
	}
	if got := env.offered(t, token, expired.ID); len(got) != 0 {
		t.Fatalf("offered for an expired suspension = %v", got)
	}
	var stillFlagged int64
	if err := env.gdb.Raw(`SELECT COUNT(*) FROM user_throttle WHERE user_id = ? AND is_suspended`, expired.ID).Scan(&stillFlagged).Error; err != nil || stillFlagged != 1 {
		t.Fatalf("reading an expired suspension changed it: %d %v", stillFlagged, err)
	}
	if message := act(http.StatusOK, "unsuspend", suspended); message != "User has been unsuspended." {
		t.Fatalf("unsuspend message = %q", message)
	}
	var row models.Throttle
	if err := env.gdb.Where("user_id = ?", suspended.ID).Take(&row).Error; err != nil || row.IsSuspended || row.SuspendedAt != nil || row.Attempts != 0 {
		t.Fatalf("throttle row after unsuspend = %+v err=%v", row, err)
	}
	act(http.StatusConflict, "unsuspend", suspended)

	// The preview hint: one callout, by precedence banned, deactivated, not
	// activated, suspended.
	hint := func(user *models.User) string {
		t.Helper()
		rec := env.expect(t, http.StatusOK, http.MethodGet, adminAPI(adminUsersPath+"/partials/hint?id="+strconv.FormatUint(uint64(user.ID), 10)), token, nil)
		return rec.Body.String()
	}
	worst := seed("worst", notActive)
	everyone = append(everyone, worst)
	before = memberships()
	env.seedThrottle(t, worst, "203.0.113.9", false, &now)
	if body := hint(worst); !strings.Contains(body, "User not activated!") || !strings.Contains(body, "summer-callout--warning") || strings.Contains(body, "suspended") {
		t.Fatalf("not activated beats suspended: %s", body)
	}
	run("deactivate", worst)
	if body := hint(worst); !strings.Contains(body, "User has deactivated their account") || !strings.Contains(body, "summer-callout--danger") || strings.Contains(body, "not activated") {
		t.Fatalf("deactivated beats not activated: %s", body)
	}
	run("ban", worst)
	if body := hint(worst); !strings.Contains(body, "User has been banned") || strings.Contains(body, "deactivated their account") {
		t.Fatalf("banned beats deactivated: %s", body)
	}
	lifted := seed("lifted", nil)
	everyone = append(everyone, lifted)
	before = memberships()
	env.seedThrottle(t, lifted, "203.0.113.9", false, &now)
	if body := hint(lifted); !strings.Contains(body, "User is temporarily suspended") || !strings.Contains(body, "summer-callout--warning") {
		t.Fatalf("suspended hint: %s", body)
	}
	if body := hint(live); strings.Contains(body, "summer-callout") {
		t.Fatalf("hint for an ordinary user: %s", body)
	}

	// Every action needs the users permission.
	if rec := env.bulk(t, stranger, "ban", live); rec.Code != http.StatusForbidden {
		t.Fatalf("bulk ban without the permission = %d", rec.Code)
	}
	env.expect(t, http.StatusForbidden, http.MethodPost, userPath(lifted.ID, "/actions/unsuspend"), stranger, map[string]any{})
	env.expect(t, http.StatusForbidden, http.MethodGet, adminAPI(adminUsersPath+"/partials/hint?id=1"), stranger, nil)
	if status, _ := env.userLogin(t, live.Email, "correct-horse"); status != http.StatusOK {
		t.Fatal("a refused ban changed the user")
	}
	// An undeclared action name is not run.
	if rec := env.bulk(t, token, "impersonate", live); rec.Code == http.StatusOK {
		t.Fatalf("an unknown bulk action answered %d", rec.Code)
	}
	if rec := env.call(t, http.MethodPost, userPath(live.ID, "/actions/impersonate"), token, map[string]any{}); rec.Code == http.StatusOK {
		t.Fatalf("an unknown record action answered %d", rec.Code)
	}
}

// TestAdminUserForceDelete covers the permanent delete (D-13): the form
// button and the bulk delete remove the user row with its throttle rows,
// group memberships and attachments, and the blobs after the commit.
func TestAdminUserForceDelete(t *testing.T) {
	env := newAdminEnv(t)
	token := env.admin(t, permAccessUsers)
	stranger := env.admin(t)
	group := env.seedGroup(t, "Delete "+adminStamp(), "delete-"+adminStamp())

	loaded := func(label string) (*models.User, string) {
		user := env.seedUser(t, label, nil)
		env.join(t, user, group)
		// The throttle foreign key has no ON DELETE: without the cleanup the
		// delete would fail on it.
		env.seedThrottle(t, user, "203.0.113.20", false, nil)
		env.seedThrottle(t, user, "", true, nil)
		return user, env.seedAvatar(t, user)
	}
	assertGone := func(user *models.User, key string) {
		t.Helper()
		if env.reload(t, user.ID) != nil {
			t.Fatalf("user %d still exists", user.ID)
		}
		if left := env.hangers(t, user); left != (hangers{}) {
			t.Fatalf("user %d left orphans: %+v", user.ID, left)
		}
		if env.blobExists(t, key) {
			t.Fatalf("user %d left its avatar blob", user.ID)
		}
	}

	// Without the permission nothing is deleted.
	victim, victimKey := loaded("victim")
	env.expect(t, http.StatusForbidden, http.MethodDelete, userPath(victim.ID, ""), stranger, nil)
	if rec := env.bulk(t, stranger, "delete", victim); rec.Code != http.StatusForbidden {
		t.Fatalf("bulk delete without the permission = %d", rec.Code)
	}
	if env.reload(t, victim.ID) == nil || env.hangers(t, victim) != (hangers{Throttle: 2, Groups: 1, Files: 1}) || !env.blobExists(t, victimKey) {
		t.Fatalf("a refused delete changed the user: %+v", env.hangers(t, victim))
	}

	// The form delete.
	env.expect(t, http.StatusOK, http.MethodDelete, userPath(victim.ID, ""), token, nil)
	assertGone(victim, victimKey)
	env.expect(t, http.StatusNotFound, http.MethodGet, userPath(victim.ID, ""), token, nil)

	// The bulk delete, with a deactivated user in the selection.
	one, oneKey := loaded("bulk-one")
	two, twoKey := loaded("bulk-two")
	bystander, bystanderKey := loaded("bystander")
	if err := env.gdb.Exec(`UPDATE users SET deleted_at = NOW() WHERE id = ?`, two.ID).Error; err != nil {
		t.Fatal(err)
	}
	rec := env.bulk(t, token, "delete", one, two)
	if rec.Code != http.StatusOK {
		t.Fatalf("bulk delete = %d %s", rec.Code, rec.Body.String())
	}
	var deleted struct {
		Deleted int `json:"deleted"`
	}
	adminInto(t, rec, &deleted)
	if deleted.Deleted != 2 {
		t.Fatalf("bulk delete count = %d", deleted.Deleted)
	}
	assertGone(one, oneKey)
	assertGone(two, twoKey)
	if env.reload(t, bystander.ID) == nil || env.hangers(t, bystander) != (hangers{Throttle: 2, Groups: 1, Files: 1}) || !env.blobExists(t, bystanderKey) {
		t.Fatal("the bulk delete touched a user outside the selection")
	}
	// The group itself is untouched.
	var groups int64
	if err := env.gdb.Raw(`SELECT COUNT(*) FROM user_groups WHERE id = ?`, group.ID).Scan(&groups).Error; err != nil || groups != 1 {
		t.Fatalf("the delete removed the group: %d %v", groups, err)
	}
}