Compare commits

..

1 Commits

Author SHA1 Message Date
46a6dac3df Fix quantity ordered scope for SQLite compatibility
Replace MySQL-specific LPAD() with SQLite's format() for zero-padded
row numbering, and skip CAST(... AS BINARY) on SQLite where string
comparisons are already binary by default.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-10 18:34:06 +00:00
7 changed files with 26 additions and 54 deletions

View File

@@ -1,10 +1,6 @@
class User::ProfilesController < Devise::RegistrationsController class User::ProfilesController < Devise::RegistrationsController
def destroy def destroy
if current_user.sole_admin? # TODO: Disallow/disable deletion for last admin account; update :edit view
redirect_back fallback_location: edit_user_registration_path,
alert: t(".sole_admin")
return
end
super super
end end

View File

@@ -63,10 +63,16 @@ class Quantity < ApplicationRecord
scope :ordered, ->(root: nil, include_root: true) { scope :ordered, ->(root: nil, include_root: true) {
numbered = Arel::Table.new('numbered') numbered = Arel::Table.new('numbered')
path_expr = if connection.adapter_name =~ /mysql/i
numbered.cast(numbered[:child_number], 'BINARY')
else
numbered[:child_number]
end
self.model.with(numbered: numbered(:parent_id, :name)).with_recursive(arel_table.name => [ self.model.with(numbered: numbered(:parent_id, :name)).with_recursive(arel_table.name => [
numbered.project( numbered.project(
numbered[Arel.star], numbered[Arel.star],
numbered.cast(numbered[:child_number], 'BINARY').as('path') path_expr.as('path')
).where(numbered[root && include_root ? :id : :parent_id].eq(root)), ).where(numbered[root && include_root ? :id : :parent_id].eq(root)),
numbered.project( numbered.project(
numbered[Arel.star], numbered[Arel.star],
@@ -80,20 +86,25 @@ class Quantity < ApplicationRecord
# be merged with :ordered # be merged with :ordered
# https://gist.github.com/ProGM/c6df08da14708dcc28b5ca325df37ceb#extending-arel # https://gist.github.com/ProGM/c6df08da14708dcc28b5ca325df37ceb#extending-arel
scope :numbered, ->(parent_column, order_column) { scope :numbered, ->(parent_column, order_column) {
select( row_num = Arel::Nodes::NamedFunction.new('ROW_NUMBER', [])
arel_table[Arel.star], .over(Arel::Nodes::Window.new.partition(parent_column).order(order_column))
child_number = if connection.adapter_name =~ /mysql/i
Arel::Nodes::NamedFunction.new( Arel::Nodes::NamedFunction.new(
'LPAD', 'LPAD',
[ [
Arel::Nodes::NamedFunction.new('ROW_NUMBER', []) row_num,
.over(Arel::Nodes::Window.new.partition(parent_column).order(order_column)),
Arel::SelectManager.new.project( Arel::SelectManager.new.project(
Arel::Nodes::NamedFunction.new('LENGTH', [Arel.star.count]) Arel::Nodes::NamedFunction.new('LENGTH', [Arel.star.count])
).from(arel_table), ).from(arel_table),
Arel::Nodes.build_quoted('0') Arel::Nodes.build_quoted('0')
], ]
).as('child_number')
) )
else
Arel::Nodes::NamedFunction.new('format', [Arel::Nodes.build_quoted('%09d'), row_num])
end
select(arel_table[Arel.star], child_number.as('child_number'))
} }
def to_s def to_s

View File

@@ -29,11 +29,4 @@ class User < ApplicationRecord
def at_least(status) def at_least(status)
User.statuses[self.status] >= User.statuses[status] User.statuses[self.status] >= User.statuses[status]
end end
# Returns true when this user is the only admin account in the system.
# Used to block actions that would leave the application without an admin
# (account deletion, status demotion).
def sole_admin?
admin? && !User.admin.where.not(id: id).exists?
end
end end

View File

@@ -4,8 +4,9 @@
<% end %> <% end %>
<div class="rightside-area buttongrid"> <div class="rightside-area buttongrid">
<%= image_button_to_if !current_user.sole_admin?, t('.delete'), 'account-remove-outline', <%#= TODO: Disallow/disable deletion for last admin account, image_button_to_if %>
user_registration_path, form_class: 'tools-area', method: :delete, data: {turbo: false}, <%= image_button_to t('.delete'), 'account-remove-outline', user_registration_path,
form_class: 'tools-area', method: :delete, data: {turbo: false},
onclick: {confirm: t('.confirm_delete')} %> onclick: {confirm: t('.confirm_delete')} %>
</div> </div>

View File

@@ -162,9 +162,6 @@ en:
New password: New password:
<br><em>leave blank to keep unchanged</em> <br><em>leave blank to keep unchanged</em>
%{password_length_hint_html} %{password_length_hint_html}
registrations:
destroy:
sole_admin: You cannot delete the only admin account.
actions: Actions actions: Actions
add: Add add: Add
apply: Apply apply: Apply

View File

@@ -1,18 +0,0 @@
require "test_helper"
class RegistrationsControllerTest < ActionDispatch::IntegrationTest
test "sole admin cannot delete account" do
sign_in users(:admin)
delete user_registration_path
assert_redirected_to edit_user_registration_path
assert_equal t("registrations.destroy.sole_admin"), flash[:alert]
assert User.exists?(users(:admin).id)
end
test "non-admin can delete account" do
sign_in users(:alice)
assert_difference ->{ User.count }, -1 do
delete user_registration_path
end
end
end

View File

@@ -182,8 +182,8 @@ class UsersTest < ApplicationSystemTestCase
assert_title 'Access is forbidden to this page (403)' assert_title 'Access is forbidden to this page (403)'
end end
test "delete profile" do test 'delete profile' do
user = sign_in user: users.reject(&:admin?).select(&:confirmed?).sample user = sign_in
# TODO: remove condition after root_url changed to different path than # TODO: remove condition after root_url changed to different path than
# profile in routes.rb # profile in routes.rb
unless has_current_path?(edit_user_registration_path) unless has_current_path?(edit_user_registration_path)
@@ -196,15 +196,7 @@ class UsersTest < ApplicationSystemTestCase
assert_text t("devise.registrations.destroyed") assert_text t("devise.registrations.destroyed")
end end
test "sole admin cannot delete profile" do test 'index forbidden for non admin' do
sign_in user: users(:admin)
unless has_current_path?(edit_user_registration_path)
first(:link_or_button, users(:admin).email).click
end
assert find(:button, t("users.registrations.edit.delete"))[:disabled]
end
test "index forbidden for non admin" do
sign_in user: users.reject(&:admin?).select(&:confirmed?).sample sign_in user: users.reject(&:admin?).select(&:confirmed?).sample
visit users_path visit users_path
assert_title "Access is forbidden to this page (403)" assert_title "Access is forbidden to this page (403)"