| Request ID | +User | +Created at | +Action | +
|---|---|---|---|
| <%= request.id %> | ++ <%= link_to request.user.name, admin_user_path(request.user) %> + | +<%= request.created_at.to_fs(:long) %> | ++ <%= render 'close_account_form', { user: request.user } %> + | +
No users have requested to close their accounts.
+ <% end %> +If you no longer wish to use your WhatDoTheyKnow account, you can ask us to close your account.
+ +Closing your account will:
+ +Closing your account will prevent you from logging in. If you have any requests that are ongoing, you will not be able to send any follow up messages to public authorities.
+ +<%= form_with url: users_close_account_path, method: :post do |form| %> ++ <%= form.check_box :confirm, class: "checkbox" %> + I understand that closing my account will mean that I will not be able to login or follow up on my requests, and that this cannot be undone. +
+ + <%= form.submit "Close my account", class: "button alert", data: { confirm: "Are you sure you want to close your account?" } %> +<% end %> diff --git a/config/routes.rb b/config/routes.rb index dae9301879..97e23da32f 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -309,6 +309,9 @@ def matches?(request) get 'email_alerts/disable/:token', to: 'email_alerts#destroy', as: :disable_email_alerts + + get 'close_account', to: 'close_account#new', as: :close_account + post 'close_account', to: 'close_account#create' end namespace :users, path: 'profile' do @@ -710,6 +713,7 @@ def matches?(request) get 'active', :on => :collection get 'banned', :on => :collection get 'closed', :on => :collection + get 'account_closure_requests', :on => :collection get 'show_bounce_message', :on => :member post 'clear_bounce', :on => :member post 'clear_profile_photo', :on => :member diff --git a/db/migrate/20230718062820_create_account_closure_requests.rb b/db/migrate/20230718062820_create_account_closure_requests.rb new file mode 100644 index 0000000000..32dc89e10a --- /dev/null +++ b/db/migrate/20230718062820_create_account_closure_requests.rb @@ -0,0 +1,8 @@ +class CreateAccountClosureRequests < ActiveRecord::Migration[7.0] + def change + create_table :account_closure_requests do |t| + t.references :user, null: false, foreign_key: true + t.timestamps + end + end +end diff --git a/spec/controllers/admin_user_controller_spec.rb b/spec/controllers/admin_user_controller_spec.rb index ed2e47d478..a81368ce2f 100644 --- a/spec/controllers/admin_user_controller_spec.rb +++ b/spec/controllers/admin_user_controller_spec.rb @@ -449,4 +449,25 @@ }.to change(ActsAsXapian::ActsAsXapianJob, :count).by(1) end end + + describe "GET #account_closure_requests" do + it "assigns @account_closure_requests with open account" do + user_with_closed_account = FactoryBot.create(:user, closed_at: Time.now) + user_with_open_account = FactoryBot.create(:user) + request_for_closed_account = FactoryBot.create( + :account_closure_request, + user: user_with_closed_account + ) + request_for_open_account = FactoryBot.create( + :account_closure_request, + user: user_with_open_account + ) + + get :account_closure_requests + + expect( + assigns(:account_closure_requests) + ).to eq([request_for_open_account]) + end + end end diff --git a/spec/controllers/users/close_account_controller_spec.rb b/spec/controllers/users/close_account_controller_spec.rb new file mode 100644 index 0000000000..7e58f0db04 --- /dev/null +++ b/spec/controllers/users/close_account_controller_spec.rb @@ -0,0 +1,46 @@ +# spec/controllers/users/close_account_controller_spec.rb +require 'spec_helper' + +RSpec.describe Users::CloseAccountController, type: :controller do + describe "POST #create" do + let(:user) { FactoryBot.create(:user) } + + before do + sign_in user + end + + after do + user.account_closure_request&.destroy + end + + it "shows the user a confirmation page" do + get :new + assert_response :success + expect(response).to render_template(:new) + end + + it "asks the user to check the confirmation checkbox" do + post :create, params: { confirm: "0" } + assert_response :redirect + expect(response).to redirect_to(users_close_account_path) + expect(flash[:error]).to eq("You must confirm that you want to close your account") + end + + it "creates a record of the user's request to close their account" do + post :create, params: { confirm: "1" } + + user.reload + expect(user.account_closure_request).to be_present + + # Check email has been sent + expect(ActionMailer::Base.deliveries.count).to eq(1) + email = ActionMailer::Base.deliveries.last + expect(email.to).to eq([user.email]) + expect(email.subject).to eq("Your account closure request on #{site_name}") + + assert_response :redirect + expect(response).to redirect_to(root_path) + expect(flash[:notice]).to eq("Your account closure request has been received. We will be in touch.") + end + end +end diff --git a/spec/factories/account_closure_requests.rb b/spec/factories/account_closure_requests.rb new file mode 100644 index 0000000000..c2dbc6da5e --- /dev/null +++ b/spec/factories/account_closure_requests.rb @@ -0,0 +1,14 @@ +# == Schema Information +# Schema version: 20230718062820 +# +# Table name: account_closure_requests +# +# id :bigint not null, primary key +# user_id :bigint not null +# created_at :datetime not null +# updated_at :datetime not null +# +FactoryBot.define do + factory :account_closure_request do + end +end diff --git a/spec/integration/admin_user_account_closing_spec.rb b/spec/integration/admin_user_account_closing_spec.rb new file mode 100644 index 0000000000..74441a2123 --- /dev/null +++ b/spec/integration/admin_user_account_closing_spec.rb @@ -0,0 +1,43 @@ +require 'spec_helper' +require 'integration/alaveteli_dsl' + +RSpec.describe 'Admin Account Closure Requests' do + before do + allow(AlaveteliConfiguration).to receive(:skip_admin_auth).and_return(false) + + confirm(:admin_user) + @admin = login(:admin_user) + @user = FactoryBot.create(:user) + @account_closure_request = FactoryBot.create( + :account_closure_request, + user: @user + ) + end + + context 'viewing account closure requests' do + it 'displays link to "Account closure requests" on admin homepage' do + using_session(@admin) do + visit admin_general_index_path + expect(page).to have_link('Account closure requests') + end + end + + it 'can close an account from the "Account closure requests" page' do + using_session(@admin) do + expect(@user).to_not be_closed + + visit account_closure_requests_admin_users_path + within("tr#account-closure-request-#{@account_closure_request.id}") do + click_button 'Close' + end + expect(page).to have_text('The user account was closed.') + + @user.reload + expect(@user).to be_closed + + visit account_closure_requests_admin_users_path + expect(page).to_not have_text(@user.name) + end + end + end +end