Refactor user management and enhance email confirmation process

- Added `users` to the list of accessible resources in the `ApplicationController`.
- Removed super admin assignment logic from the `UsersController` to streamline user updates.
- Updated email confirmation link generation in the confirmation instructions template for better URL handling.
- Adjusted test cases to reflect changes in email confirmation paths and improved request specs for user actions.
- Enhanced test setup to ensure proper routing and CSRF protection handling in request specs.

Author: Zoncovsky

app/controllers/application_controller.rb

@@ -12,6 +12,7 @@ class ApplicationController < ActionController::Base
     subscriptions
     account_settings
     settings
+    users
   ].freeze
 
   # Include Pagy backend for pagination

app/controllers/users_controller.rb

@@ -61,11 +61,6 @@ def update
 
     update_params = permitted_attributes(@user)
 
-    # Only allow super_admin assignment if current user is super_admin and not editing themselves
-    if current_user.super_admin? && @user != current_user && params.dig(:user, :super_admin).present?
-      @user.super_admin = params.dig(:user, :super_admin) == "1"
-    end
-
     if @user == current_user
       if update_params[:password].present?
         if update_params[:current_password].blank?

app/views/devise/mailer/confirmation_instructions.html.erb

@@ -127,7 +127,17 @@
     <p>Please confirm your email address (<strong><%= @email %></strong>) to get started with error monitoring.</p>
 
     <div class="button-wrapper">
-      <a href="<%= confirmation_url(@resource, confirmation_token: @token) %>" class="button">Confirm Email Address</a>
+      <%
+        app_host = ENV.fetch('APP_HOST') { Rails.env.production? ? 'https://activerabbit.ai' : 'http://localhost:3000' }
+        # Strip trailing slash and ensure we have a proper base URL
+        base_url = app_host.sub(/\/+$/, '')
+        # Add protocol if missing
+        unless base_url.start_with?('http://', 'https://')
+          base_url = (Rails.env.production? ? 'https://' : 'http://') + base_url
+        end
+        confirmation_link = "#{base_url}/confirmation?confirmation_token=#{@token}"
+      %>
+      <a href="<%= confirmation_link %>" class="button">Confirm Email Address</a>
     </div>
 
     <div class="note">

config/environments/development.rb

@@ -100,5 +100,4 @@
   config.hosts << "127.0.0.1"
   config.hosts << "host.docker.internal"
   config.hosts << "host.docker.internal:3000"
-  config.hosts << "160ec4227c78.ngrok-free.app"
 end

config/environments/test.rb

@@ -53,4 +53,7 @@
 
   # Ensure Rack::Attack is disabled in test environment
   config.middleware.delete Rack::Attack
+
+  # Disable host authorization in test environment
+  config.host_authorization = { exclude: ->(request) { true } }
 end

spec/features/email_confirmation_spec.rb

@@ -29,14 +29,14 @@
       expect(user.confirmed?).to be false
 
       # Confirm using raw token
-      get user_confirmation_path(confirmation_token: raw_token)
+      get "/confirmation?confirmation_token=#{raw_token}"
 
       user.reload
       expect(user.confirmed?).to be true
     end
   end
 
-  describe "GET /users/confirmation" do
+  describe "GET /confirmation" do
     let(:account) { create(:account) }
 
     context "with valid token" do
@@ -51,27 +51,27 @@
       it "confirms the user" do
         expect(user.confirmed?).to be false
 
-        get user_confirmation_path(confirmation_token: @raw_token)
+        get "/confirmation?confirmation_token=#{@raw_token}"
 
         user.reload
         expect(user.confirmed?).to be true
       end
 
       it "redirects to sign in" do
-        get user_confirmation_path(confirmation_token: @raw_token)
+        get "/confirmation?confirmation_token=#{@raw_token}"
 
-        expect(response).to redirect_to(new_user_session_path)
+        expect(response).to redirect_to("/signin")
       end
     end
 
     context "with invalid token" do
       it "does not confirm and shows error or redirects" do
-        get user_confirmation_path(confirmation_token: "invalid_token")
+        get "/confirmation?confirmation_token=invalid_token"
 
         # Devise either renders a page with errors or redirects
         # Check that it either has error content or redirects
         if response.redirect?
-          expect(response).to redirect_to(new_user_confirmation_path).or redirect_to(new_user_session_path)
+          expect(response).to redirect_to("/confirmation/new").or redirect_to("/signin")
         else
           expect(response.body.downcase).to include("invalid").or include("token")
         end
@@ -89,7 +89,7 @@
       end
 
       it "does not confirm user if token expired" do
-        get user_confirmation_path(confirmation_token: @raw_token)
+        get "/confirmation?confirmation_token=#{@raw_token}"
 
         user.reload
         # User should not be confirmed with expired token (unless confirm_within is not set)
@@ -108,7 +108,7 @@
       end
 
       it "handles already confirmed user" do
-        get user_confirmation_path(confirmation_token: @raw_token)
+        get "/confirmation?confirmation_token=#{@raw_token}"
 
         # User should remain confirmed
         user.reload

spec/jobs/weekly_report_job_spec.rb

@@ -13,8 +13,8 @@
   end
 
   before do
+    # Update account stats without changing name (to avoid uniqueness conflicts)
     account.update!(
-      name: "Test Account",
       cached_events_used: 100,
       usage_cached_at: Time.current
     )

spec/mailers/devise_mailer_spec.rb

@@ -5,13 +5,19 @@
 RSpec.describe Devise::Mailer, type: :mailer do
   describe "#confirmation_instructions" do
     let(:account) { create(:account) }
-    let(:user) { create(:user, :unconfirmed, account: account, email: "test@example.com") }
+    let(:user) { create(:user, :unconfirmed, account: account) }
     let(:token) { "test_confirmation_token_123" }
 
+    before do
+      # Ensure routes and Devise mappings are properly loaded
+      Rails.application.reload_routes!
+      Rails.application.routes.default_url_options[:host] = 'localhost'
+    end
+
     subject(:mail) { described_class.confirmation_instructions(user, token) }
 
     it "renders the headers" do
-      expect(mail.to).to eq(["test@example.com"])
+      expect(mail.to).to eq([user.email])
       expect(mail.from.first).to include("activerabbit")
     end
 
@@ -28,7 +34,7 @@
     end
 
     it "includes user email" do
-      expect(mail.body.encoded).to include("test@example.com")
+      expect(mail.body.encoded).to include(user.email)
     end
 
     it "includes confirm button" do

spec/rails_helper.rb

@@ -81,4 +81,9 @@
   config.before(:each) do
     WebMock.disable_net_connect!(allow_localhost: true)
   end
+
+  # Use localhost as default host for request specs to avoid host authorization issues
+  config.before(:each, type: :request) do
+    host! 'localhost'
+  end
 end

spec/requests/api_deploys_spec.rb

@@ -3,13 +3,17 @@
 RSpec.describe 'API::V1::Deploys', type: :request, api: true do
   let(:account) { create(:account) }
   let(:user) { create(:user, account: account) }
-  let(:project) { create(:project, user: user, account: account) }
-  let(:token)   { create(:api_token, project: project, account: account) }
-  let(:headers) { { 'CONTENT_TYPE' => 'application/json', 'X-Project-Token' => token.token } }
-
-  before do
-    ActsAsTenant.current_tenant = account
+  let(:project) do
+    ActsAsTenant.with_tenant(account) do
+      create(:project, user: user, account: account)
+    end
   end
+  let(:token) do
+    ActsAsTenant.with_tenant(account) do
+      create(:api_token, project: project, account: account)
+    end
+  end
+  let(:headers) { { 'CONTENT_TYPE' => 'application/json', 'X-Project-Token' => token.token } }
 
   describe 'POST /api/v1/deploys' do
     it 'creates a deploy and associated release' do
@@ -25,8 +29,8 @@
 
       expect {
         post '/api/v1/deploys', params: body, headers: headers
-      }.to change { Deploy.count }.by(1)
-        .and change { Release.count }.by(1)
+      }.to change { ActsAsTenant.with_tenant(account) { Deploy.count } }.by(1)
+        .and change { ActsAsTenant.with_tenant(account) { Release.count } }.by(1)
 
       expect(response).to have_http_status(:ok)
       json = JSON.parse(response.body)
@@ -36,13 +40,15 @@
 
     it 'reuses existing release for same version/environment' do
       # Pre-create a release for this project/version/environment
-      existing_release = create(
-        :release,
-        project: project,
-        account: account,
-        version: 'v1.0.1',
-        environment: 'staging'
-      )
+      existing_release = ActsAsTenant.with_tenant(account) do
+        create(
+          :release,
+          project: project,
+          account: account,
+          version: 'v1.0.1',
+          environment: 'staging'
+        )
+      end
 
       body = {
         project_slug: project.slug,
@@ -54,17 +60,17 @@
         finished_at: Time.current.iso8601
       }.to_json
 
-      deploy_count_before  = Deploy.count
-      release_count_before = Release.count
+      deploy_count_before  = ActsAsTenant.with_tenant(account) { Deploy.count }
+      release_count_before = ActsAsTenant.with_tenant(account) { Release.count }
 
       post '/api/v1/deploys', params: body, headers: headers
 
       expect(response).to have_http_status(:ok)
       json = JSON.parse(response.body)
       expect(json['ok']).to eq(true)
 
-      expect(Deploy.count).to eq(deploy_count_before + 1)
-      expect(Release.count).to eq(release_count_before)
+      expect(ActsAsTenant.with_tenant(account) { Deploy.count }).to eq(deploy_count_before + 1)
+      expect(ActsAsTenant.with_tenant(account) { Release.count }).to eq(release_count_before)
     end
 
     it 'returns not_found for unknown project slug' do