From be1c780189e4c3b932ea571e476e1a7011b2ab85 Mon Sep 17 00:00:00 2001
From: baarkerlounger <db@slothlife.xyz>
Date: Fri, 13 May 2022 11:39:52 +0100
Subject: [PATCH] Enable support users to invite users to any organisation

---
 app/controllers/users_controller.rb    | 16 ++++++++++++++--
 app/views/users/new.html.erb           | 13 +++++++++++++
 spec/requests/users_controller_spec.rb | 19 ++++++++++++++++---
 3 files changed, 43 insertions(+), 5 deletions(-)

diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index 574960ec4..bdde9113b 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -51,7 +51,7 @@ class UsersController < ApplicationController
       user = User.create(user_params.merge(org_params).merge(password_params))
       if user.persisted?
         user.send_reset_password_instructions
-        redirect_to users_organisation_path(current_user.organisation)
+        redirect_to created_user_redirect_path
       else
         @resource.errors.add :email, I18n.t("validations.email.taken")
         render :new, status: :unprocessable_entity
@@ -83,6 +83,8 @@ private
   end
 
   def org_params
+    return {} if current_user.support?
+
     { organisation: current_user.organisation }
   end
 
@@ -93,8 +95,18 @@ private
       else
         params.require(:user).permit(:email, :name, :password, :password_confirmation)
       end
-    elsif current_user.data_coordinator? || current_user.support?
+    elsif current_user.data_coordinator?
       params.require(:user).permit(:email, :name, :role, :is_dpo, :is_key_contact)
+    elsif current_user.support?
+      params.require(:user).permit(:email, :name, :role, :is_dpo, :is_key_contact, :organisation_id)
+    end
+  end
+
+  def created_user_redirect_path
+    if current_user.support?
+      users_path
+    else
+      users_organisation_path(current_user.organisation)
     end
   end
 
diff --git a/app/views/users/new.html.erb b/app/views/users/new.html.erb
index a84f0d634..980281f11 100644
--- a/app/views/users/new.html.erb
+++ b/app/views/users/new.html.erb
@@ -26,6 +26,19 @@
         spellcheck: "false",
         value: @resource.email %>
 
+      <% if current_user.support? %>
+        <% null_option = [OpenStruct.new(id: "", name: "Select an option")] %>
+        <% organisations = Organisation.all.map { |org| OpenStruct.new(id: org.id, name: org.name) } %>
+        <% answer_options = null_option + organisations %>
+
+          <%= f.govuk_collection_select :organisation_id,
+            answer_options,
+            :id,
+            :name,
+            label: { text: "Organisation", size: "m" },
+            options: { disabled: [""], selected: "" } %>
+      <% end %>
+
       <% roles = current_user.assignable_roles.map { |key, _| OpenStruct.new(id: key, name: key.to_s.humanize) } %>
 
       <%= f.govuk_collection_radio_buttons :role,
diff --git a/spec/requests/users_controller_spec.rb b/spec/requests/users_controller_spec.rb
index ef193a1bc..26f9c24c5 100644
--- a/spec/requests/users_controller_spec.rb
+++ b/spec/requests/users_controller_spec.rb
@@ -1071,12 +1071,15 @@ RSpec.describe UsersController, type: :request do
     end
 
     describe "#create" do
+      let(:organisation) { FactoryBot.create(:organisation) }
+      let(:email) { "new_user@example.com" }
       let(:params) do
         {
           "user": {
             name: "new user",
-            email: "new_user@example.com",
+            email:,
             role: "data_coordinator",
+            organisation_id: organisation.id,
           },
         }
       end
@@ -1090,9 +1093,14 @@ RSpec.describe UsersController, type: :request do
         expect { request }.to change(User, :count).by(1)
       end
 
-      it "redirects back to organisation users page" do
+      it "adds the user to the correct organisation" do
         request
-        expect(response).to redirect_to("/organisations/#{user.organisation.id}/users")
+        expect(User.find_by(email:).organisation).to eq(organisation)
+      end
+
+      it "redirects back to users page" do
+        request
+        expect(response).to redirect_to("/users")
       end
 
       context "when the email is already taken" do
@@ -1133,6 +1141,11 @@ RSpec.describe UsersController, type: :request do
         get "/users/new"
         expect(page).to have_field("user-role-support-field")
       end
+
+      it "can assign organisation to the new user" do
+        get "/users/new"
+        expect(page).to have_field("user-organisation-id-field")
+      end
     end
   end