mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-05-03 01:14:27 +09:00
30fe6ab121
This adds the ability to ban a user by their IP address. When an admin is viewing a user profile, a new "Ban user" button is present. Clicking on that will: - Create a ban on the IP addresses that were tracked for that user's sessions - Remove all the messages authored by that user - Log the user out immediately In addition, that user will no longer be shown in most user lists in the app. They are still shown to admins, in account settings. Viewing their profile from there will now show a "Remove ban" button which can be used to restore their access (it doesn't restore their messages though -- those are already gone -- it just removes the blocks so they can log in again).
33 lines
943 B
Ruby
33 lines
943 B
Ruby
require "test_helper"
|
|
|
|
class BlockBannedRequestsTest < ActionDispatch::IntegrationTest
|
|
setup do
|
|
sign_in :david
|
|
@room = rooms(:watercooler)
|
|
|
|
Ban.create!(user: users(:kevin), ip_address: "203.0.113.1")
|
|
end
|
|
|
|
test "POST requests from banned IPs are blocked with 429" do
|
|
post room_messages_url(@room),
|
|
params: { message: { body: "Test", client_message_id: "test-123" } },
|
|
headers: { "REMOTE_ADDR" => "203.0.113.1" }
|
|
|
|
assert_response :too_many_requests
|
|
end
|
|
|
|
test "POST requests from non-banned IPs are allowed" do
|
|
post room_messages_url(@room, format: :turbo_stream),
|
|
params: { message: { body: "Test", client_message_id: "test-123" } },
|
|
headers: { "REMOTE_ADDR" => "203.0.113.99" }
|
|
|
|
assert_response :success
|
|
end
|
|
|
|
test "GET requests from banned IPs are allowed" do
|
|
get room_messages_url(@room), headers: { "REMOTE_ADDR" => "203.0.113.1" }
|
|
|
|
assert_response :success
|
|
end
|
|
end
|