Add role management validation to prevent removal of the last admin

- Introduced a new error, `CannotRemoveLastAdmin`, to handle attempts to downgrade the last admin user in the system. - Updated `RoleService` to check the number of admin users before allowing a role change that would remove the last admin. - Enhanced unit tests to verify the new behavior, ensuring that attempts to downgrade the last admin correctly propagate the failure. - Updated API documentation to reflect the new validation logic and its implications for role management.
2026-07-14 23:53:20 +03:00
parent 940577d8cd
commit f14daa3df1
8 changed files with 312 additions and 2 deletions
@@ -1,4 +1,5 @@
 using NSubstitute;
+using PnvPanel.Application.Admin.Roles;
 using PnvPanel.Application.Admin.Support;
 using PnvPanel.Application.Common.Interfaces;
 using PnvPanel.Application.Common.Models;
@@ -56,7 +57,12 @@ public class ApproveRoleRequestCommandHandlerTests
            .ChangeUserRoleAsync(userId, newRoleId, Arg.Any<CancellationToken>());
        await _telegramNotifier
            .Received(1)
-            .NotifyUserAsync(userId, Arg.Any<string>(), Arg.Any<string?>(), Arg.Any<CancellationToken>());
+            .NotifyUserAsync(
+                userId,
+                Arg.Any<string>(),
+                Arg.Any<string?>(),
+                Arg.Any<CancellationToken>()
+            );
    }

    [Fact]
@@ -123,4 +129,72 @@ public class ApproveRoleRequestCommandHandlerTests
        Assert.False(result.IsSuccess);
        Assert.Equal(SupportErrors.NotRoleRequest, result.Error);
    }
+
+    [Fact]
+    public async Task Handle_WhenTicketIsOwnedByAdmin_StillApproves()
+    {
+        // Одобрить свою же заявку можно — единственный реальный риск (снять admin с последнего
+        // администратора) ловит RoleService.ChangeUserRoleAsync, а не этот хендлер (см. соседний тест).
+        using var dbContext = InMemoryDbContextFactory.Create();
+        var adminId = Guid.NewGuid();
+        var roleId = Guid.NewGuid();
+        var ticket = SupportTicket.CreateRoleRequestForExistingRole(adminId, roleId);
+        dbContext.SupportTickets.Add(ticket);
+        await dbContext.SaveChangesAsync(CancellationToken.None);
+
+        _roleService
+            .ChangeUserRoleAsync(adminId, roleId, Arg.Any<CancellationToken>())
+            .Returns(Result.Success());
+
+        var currentUser = FakeCurrentUser.Authenticated(adminId, "admin");
+        var handler = new ApproveRoleRequestCommandHandler(
+            dbContext,
+            _roleService,
+            _notifier,
+            _telegramNotifier,
+            currentUser
+        );
+
+        var result = await handler.Handle(
+            new ApproveRoleRequestCommand(ticket.Id),
+            CancellationToken.None
+        );
+
+        Assert.True(result.IsSuccess);
+        Assert.Equal(TicketStatus.Resolved, ticket.Status);
+    }
+
+    [Fact]
+    public async Task Handle_WhenRoleServiceRefusesLastAdminDowngrade_PropagatesFailure()
+    {
+        using var dbContext = InMemoryDbContextFactory.Create();
+        var adminId = Guid.NewGuid();
+        var roleId = Guid.NewGuid();
+        var ticket = SupportTicket.CreateRoleRequestForExistingRole(adminId, roleId);
+        dbContext.SupportTickets.Add(ticket);
+        await dbContext.SaveChangesAsync(CancellationToken.None);
+
+        _roleService
+            .ChangeUserRoleAsync(adminId, roleId, Arg.Any<CancellationToken>())
+            .Returns(Result.Failure(RoleErrors.CannotRemoveLastAdmin));
+
+        var currentUser = FakeCurrentUser.Authenticated(adminId, "admin");
+        var handler = new ApproveRoleRequestCommandHandler(
+            dbContext,
+            _roleService,
+            _notifier,
+            _telegramNotifier,
+            currentUser
+        );
+
+        var result = await handler.Handle(
+            new ApproveRoleRequestCommand(ticket.Id),
+            CancellationToken.None
+        );
+
+        Assert.False(result.IsSuccess);
+        Assert.Equal(RoleErrors.CannotRemoveLastAdmin, result.Error);
+        // Тикет остаётся Open — можно повторить попытку после назначения второго админа.
+        Assert.Equal(TicketStatus.Open, ticket.Status);
+    }
 }