Enable support users to download user details

app/controllers/users_controller.rb

@@ -10,6 +10,17 @@ class UsersController < ApplicationController
     redirect_to users_organisation_path(current_user.organisation) unless current_user.support?
 
     @pagy, @users = pagy(User.all.where(active: true))
+
+    respond_to do |format|
+      format.html
+      format.csv do
+        if current_user.support?
+          send_data @users.to_csv, filename: "users-#{Time.zone.now}.csv"
+        else
+          head :unauthorized
+        end
+      end
+    end
   end
 
   def show; end

app/models/user.rb

@@ -96,4 +96,22 @@ class User < ApplicationRecord
       %w[status years user]
     end
   end
+
+  def organisation_name
+    organisation.name
+  end
+
+  def self.download_attributes
+    %w[id email name organisation_name role old_user_id is_dpo is_key_contact active sign_in_count last_sign_in_at]
+  end
+
+  def self.to_csv
+    CSV.generate(headers: true) do |csv|
+      csv << download_attributes
+
+      all.find_each do |record|
+        csv << self.download_attributes.map { |attr| record.public_send(attr) }
+      end
+    end
+  end
 end

app/views/users/index.html.erb

@@ -12,6 +12,9 @@
     <span class="govuk-!-margin-right-4">
       <strong><%= @pagy.count %></strong><span style="font-weight: normal"> total users</span>
     </span>
+    <% if current_user.support? %>
+      <%= govuk_link_to "Download (CSV)", "/users.csv", type: "text/csv" %>
+    <% end %>
   <% end %>
   <%= table.head do |head| %>
     <%= head.row do |row| %>

spec/requests/users_controller_spec.rb

@@ -348,6 +348,28 @@ RSpec.describe UsersController, type: :request do
         follow_redirect!
         expect(path).to match("/organisations/#{user.organisation.id}/users")
       end
+
+      it "does not show the download csv link" do
+        expect(page).not_to have_link("Download (CSV)", href: "/users.csv")
+      end
+    end
+
+    describe "CSV download" do
+      let(:headers) { { "Accept" => "text/csv" } }
+      let(:user) { FactoryBot.create(:user) }
+
+      let!(:other_user) { FactoryBot.create(:user, organisation: user.organisation, name: "User 2") }
+      let!(:inactive_user) { FactoryBot.create(:user, organisation: user.organisation, active: false, name: "User 3") }
+      let!(:other_org_user) { FactoryBot.create(:user, name: "User 4") }
+
+      before do
+        sign_in user
+        get "/users", headers:, params: {}
+      end
+
+      it "returns 401 unauthorized" do
+        expect(response).to have_http_status(:unauthorized)
+      end
     end
 
     describe "#show" do
@@ -728,6 +750,40 @@ RSpec.describe UsersController, type: :request do
       it "shows the pagination count" do
         expect(page).to have_content("3 total users")
       end
+
+      it "shows the download csv link" do
+        expect(page).to have_link("Download (CSV)", href: "/users.csv")
+      end
+    end
+
+    describe "CSV download" do
+      let(:headers) { { "Accept" => "text/csv" } }
+      let(:user) { FactoryBot.create(:user, :support) }
+
+      let!(:other_user) { FactoryBot.create(:user, organisation: user.organisation, name: "User 2") }
+      let!(:inactive_user) { FactoryBot.create(:user, organisation: user.organisation, active: false, name: "User 3") }
+      let!(:other_org_user) { FactoryBot.create(:user, name: "User 4") }
+
+      before do
+        sign_in user
+        get "/users", headers:, params: {}
+      end
+
+      it "downloads a CSV file with headers" do
+        csv = CSV.parse(response.body)
+        expect(csv.first.second).to eq("email")
+        expect(csv.second.first).to eq(user.id.to_s)
+      end
+
+      it "downloads all users" do
+        csv = CSV.parse(response.body)
+        expect(csv.count).to eq(4)
+      end
+
+      it "downloads organisation names rather than ids" do
+        csv = CSV.parse(response.body)
+        expect(csv.second[3]).to eq("#{user.organisation.name}")
+      end
     end
 
     describe "#show" do