Trello: https://trello.com/c/caETStGa This is a step on the journey to move the edit user page to use the GOV.UK Design System. The new design calls for separate pages for different operations on a user and this is the next one. Unlike in commits like this one [1] where we first split out the new page and then separatly moved the new page to use the Design System, here I've created the new page using the Design System in one go, because there wasn't really any markup in the "edit user" page to extract. The new `app/views/users/two_step_verification_resets/edit.html.erb` template is based on other similar pages which we've recently extracted, e.g. `app/views/users/organisations/edit.html.erb`, although obviously in this case there aren't any form fields; only a button. Previously the "Reset 2-step verification" link on the "edit user" page was enhanced by UJS to prompt the user with a confirmation dialog and then submit a PATCH HTTP request to the controller. Since you now have to click the "Reset 2-step verification" link on the "edit user" page AND then click the "Reset 2-step verification" button on the new page, I don't think we need the confirmation dialog any more. However, I've used the `destructive` option on the button component to indicate that some information is lost when you click it. All this means we no longer need to use UJS for this operation which is a plus for two reasons: (a) UJS is deprecated in Rails v7.0 and we're about to upgrade to Rails v7.1; and (b) this functionality did not work without JS enabled which was an accessibility issue. The new `Users::TwoStepVerificationResetsController` is closely based on the relevant bits of code from `UsersController`. I'm using `UserPolicy#reset_2sv?` for the authorization in the new `Users::TwoStepVerificationResetsController`, because that's what was being used for the `UsersController#reset_2sv` action that we're replacing. You could argue that the old UJS-enhanced "Reset 2-step verification" link was only visible on the "edit user" page if `UserPolicy#edit?` returned `true`, but given that you can't navigate to the new form without going via the "edit user" page, using that policy seems unnecessary. Doing this makes me think @chrisroos might have been right to suggest that we only need a single call to `authorize @user, :<predicate-method>?` in the `authorize_user` methods on the other controllers in the `Users` namespace, but I'm going to leave that for now. There weren't any tests in `UsersControllerTest` for this behaviour, so I had to write `Users::TwoStepVerificationResetsControllerTest` from scratch, but I based it closely on other similar controller tests. Luckily there were a couple of integration tests (`test/integration/managing_two_step_verification_test.rb` & `test/integration/mandate_2sv_for_organisation_test.rb`) covering the behaviour which I've been able to fixup to work with the new UI. Rather than creating a combinatorial explosion of tests in `Users::TwoStepVerificationResetsControllerTest` relating to whether a user with all the different roles can edit another user with all the different roles, I've resorted to stubbing `UserPolicy.new` and relevant predicate methods on the `UserPolicy` instance. Although this is a bit ugly, since `UserPolicy` is thoroughly tested in `UserPolicyTest`, it seems like a pragmatic option. [1]: 899a8a1

Commits

Commits on Nov 23, 2023

Use User#exempt_from_2sv? in user form fields partial

Use user instance variable vs f.object in form_fields partial

Extract page for resetting user's 2SV

Move policy check nearer functionality in user form_fields

Tidy indentation & whitespace on edit user page

Rename initiating_superadmin -> initiator in User#reset_2sv!

Avoid hanging indent in test for User#reset_2sv!