- <%= link_to "← Back to explore options", scenarios_path,
- class: "inline-block rounded-md border border-line bg-surface px-3 py-1.5 text-sm text-ink-soft hover:bg-canvas transition" %>
+ <% if viewing_on_behalf?(@scenario) %>
+ <%= link_to "← Back to all scenarios", admin_scenarios_path,
+ class: "inline-block rounded-md border border-line bg-surface px-3 py-1.5 text-sm text-ink-soft hover:bg-canvas transition" %>
+ <% else %>
+ <%= link_to "← Back to explore options", scenarios_path,
+ class: "inline-block rounded-md border border-line bg-surface px-3 py-1.5 text-sm text-ink-soft hover:bg-canvas transition" %>
+ <% end %>
+
+ <% if viewing_on_behalf?(@scenario) %>
+
+ Viewing <%= @scenario.user.display_name %>'s scenario as an admin. Changes you make are saved to their account.
+
+ <% end %>
<%= render "scenarios/names/name", scenario: @scenario %>
diff --git a/test/controllers/admin/scenarios_controller_test.rb b/test/controllers/admin/scenarios_controller_test.rb
index 47d9f9d..a19b5fb 100644
--- a/test/controllers/admin/scenarios_controller_test.rb
+++ b/test/controllers/admin/scenarios_controller_test.rb
@@ -34,6 +34,15 @@ class Admin::ScenariosControllerTest < ActionDispatch::IntegrationTest
assert_select "td", text: @admin.display_name
end
+ test "rows link to the scenario and break out of the table turbo frame" do
+ sign_in_as(@owner)
+ get admin_scenarios_path
+
+ # data-turbo-frame="_top" is required so the link navigates the whole page
+ # instead of trying (and failing) to render into the scenarios_table frame.
+ assert_select "a[href=?][data-turbo-frame=_top]", scenario_path(scenarios(:one_arlington))
+ end
+
test "does not show scenarios from another organization" do
sign_in_as(@owner)
get admin_scenarios_path
diff --git a/test/controllers/allocations_controller_test.rb b/test/controllers/allocations_controller_test.rb
index a037dad..754c8ff 100644
--- a/test/controllers/allocations_controller_test.rb
+++ b/test/controllers/allocations_controller_test.rb
@@ -103,4 +103,32 @@ class AllocationsControllerTest < ActionDispatch::IntegrationTest
end
assert_response :not_found
end
+
+ test "admin can add an allocation to another user's scenario in the same org" do
+ sign_in_as users(:admin)
+ assert_difference -> { @scenario.allocations.count }, 1 do
+ post scenario_allocations_url(@scenario), params: {
+ allocation: { type: "Allocation::Ongoing", option: "Population: Youth", percentage: 25 }
+ }
+ end
+ assert_redirected_to scenario_path(@scenario)
+ end
+
+ test "admin can destroy an allocation on another user's scenario in the same org" do
+ sign_in_as users(:admin)
+ assert_difference -> { @scenario.allocations.count }, -1 do
+ delete scenario_allocation_url(@scenario, allocations(:greatest_need))
+ end
+ assert_redirected_to scenario_path(@scenario)
+ end
+
+ test "plain member cannot add an allocation to another user's scenario in the same org" do
+ sign_in_as users(:passwordless)
+ assert_no_difference -> { Allocation.count } do
+ post scenario_allocations_url(@scenario), params: {
+ allocation: { type: "Allocation::Ongoing", option: "X", percentage: 10 }
+ }
+ end
+ assert_response :not_found
+ end
end
diff --git a/test/controllers/scenarios/names_controller_test.rb b/test/controllers/scenarios/names_controller_test.rb
index 937e24b..162fe53 100644
--- a/test/controllers/scenarios/names_controller_test.rb
+++ b/test/controllers/scenarios/names_controller_test.rb
@@ -35,4 +35,20 @@ class Scenarios::NamesControllerTest < ActionDispatch::IntegrationTest
get edit_scenario_name_url(scenarios(:two_boston))
assert_response :not_found
end
+
+ test "admin can edit another user's scenario name in the same org" do
+ sign_in_as users(:admin)
+ get edit_scenario_name_url(@scenario)
+ assert_response :success
+
+ patch scenario_name_url(@scenario), params: { scenario: { name: "Admin renamed" } }
+ assert_response :success
+ assert_equal "Admin renamed", @scenario.reload.name
+ end
+
+ test "plain member cannot edit another user's scenario name in the same org" do
+ sign_in_as users(:passwordless)
+ get edit_scenario_name_url(@scenario)
+ assert_response :not_found
+ end
end
diff --git a/test/controllers/scenarios/total_giving_amounts_controller_test.rb b/test/controllers/scenarios/total_giving_amounts_controller_test.rb
index c74978b..0281475 100644
--- a/test/controllers/scenarios/total_giving_amounts_controller_test.rb
+++ b/test/controllers/scenarios/total_giving_amounts_controller_test.rb
@@ -29,4 +29,20 @@ class Scenarios::TotalGivingAmountsControllerTest < ActionDispatch::IntegrationT
get edit_scenario_total_giving_amount_url(scenarios(:two_boston))
assert_response :not_found
end
+
+ test "admin can edit another user's scenario total in the same org" do
+ sign_in_as users(:admin)
+ get edit_scenario_total_giving_amount_url(@scenario)
+ assert_response :success
+
+ patch scenario_total_giving_amount_url(@scenario), params: { scenario: { total_giving_amount: 7500 } }
+ assert_response :success
+ assert_equal 7500, @scenario.reload.total_giving_amount
+ end
+
+ test "plain member cannot edit another user's scenario total in the same org" do
+ sign_in_as users(:passwordless)
+ get edit_scenario_total_giving_amount_url(@scenario)
+ assert_response :not_found
+ end
end
diff --git a/test/controllers/scenarios_controller_test.rb b/test/controllers/scenarios_controller_test.rb
index 33a63f0..8b2131b 100644
--- a/test/controllers/scenarios_controller_test.rb
+++ b/test/controllers/scenarios_controller_test.rb
@@ -63,4 +63,45 @@ class ScenariosControllerTest < ActionDispatch::IntegrationTest
get scenario_url(scenarios(:two_boston))
assert_response :not_found
end
+
+ test "admin can view another user's scenario in the same org" do
+ sign_in_as users(:admin)
+ get scenario_url(scenarios(:one_arlington))
+ assert_response :success
+ assert_select "a[href=?]", admin_scenarios_path
+ assert_match "as an admin", response.body
+ end
+
+ test "admin can update another user's scenario" do
+ sign_in_as users(:admin)
+ patch scenario_url(scenarios(:one_arlington)), params: { scenario: { total_giving_amount: 999 } }
+ assert_equal 999, scenarios(:one_arlington).reload.total_giving_amount
+ end
+
+ test "admin destroy of another user's scenario returns to the admin dashboard" do
+ sign_in_as users(:admin)
+ assert_difference -> { Scenario.count }, -1 do
+ delete scenario_url(scenarios(:one_arlington))
+ end
+ assert_redirected_to admin_scenarios_path
+ end
+
+ test "admin still cannot reach a scenario in another org" do
+ sign_in_as users(:admin)
+ get scenario_url(scenarios(:two_boston))
+ assert_response :not_found
+ end
+
+ test "plain member cannot reach another user's scenario in the same org" do
+ sign_in_as users(:passwordless)
+ get scenario_url(scenarios(:one_arlington))
+ assert_response :not_found
+ end
+
+ test "super admin cannot change another user's scenario" do
+ sign_in_as users(:super_admin)
+ patch scenario_url(scenarios(:one_arlington)), params: { scenario: { total_giving_amount: 1 } }
+ assert_response :not_found
+ assert_equal 10000, scenarios(:one_arlington).reload.total_giving_amount
+ end
end
diff --git a/test/models/organization_membership_test.rb b/test/models/organization_membership_test.rb
index 7d4b0eb..1f2843d 100644
--- a/test/models/organization_membership_test.rb
+++ b/test/models/organization_membership_test.rb
@@ -37,4 +37,24 @@ class OrganizationMembershipTest < ActiveSupport::TestCase
assert_not membership.valid?
assert_includes membership.errors[:role], "can't be blank"
end
+
+ test "owned_scenarios are the member's own scenarios in the organization" do
+ membership = organization_memberships(:one_arlington)
+ assert_includes membership.owned_scenarios, scenarios(:one_arlington)
+ assert_not_includes membership.owned_scenarios, scenarios(:admin_arlington)
+ end
+
+ test "admins and owners can access any scenario in the organization" do
+ %i[ admin_arlington one_arlington ].each do |fixture|
+ membership = organization_memberships(fixture)
+ assert_includes membership.accessible_scenarios, scenarios(:one_arlington)
+ assert_includes membership.accessible_scenarios, scenarios(:admin_arlington)
+ end
+ end
+
+ test "plain members can only access their own scenarios" do
+ membership = organization_memberships(:passwordless_arlington)
+ assert_equal membership.owned_scenarios.to_a, membership.accessible_scenarios.to_a
+ assert_not_includes membership.accessible_scenarios, scenarios(:one_arlington)
+ end
end