6 files changed, 422 insertions, 0 deletions

diff --git a/test/models/concerns/rrule_humanizer_test.rb b/test/models/concerns/rrule_humanizer_test.rb
index 54c4c22..d747171 100644
--- a/test/models/concerns/rrule_humanizer_test.rb
+++ b/test/models/concerns/rrule_humanizer_test.rb
@@ -114,4 +114,11 @@ class RruleHumanizerTest < ActiveSupport::TestCase
   test "wday_abbr falls back to :de for an unrecognized locale" do
     assert_equal "Mo", RruleHumanizer.wday_abbr(Time.parse("2026-07-06"), :fr)
   end
+
+  test "monthly two selected weeks" do
+    assert_equal "Jeden ersten und dritten Dienstag im Monat",
+      humanize("FREQ=MONTHLY;BYDAY=1TU,3TU")
+    assert_equal "Every first and third Tuesday of the month",
+      humanize("FREQ=MONTHLY;BYDAY=1TU,3TU", :en)
+  end
 end
diff --git a/test/models/helpers/node_actions_helper_test.rb b/test/models/helpers/node_actions_helper_test.rb
index 5244c19..1b72ec9 100644
--- a/test/models/helpers/node_actions_helper_test.rb
+++ b/test/models/helpers/node_actions_helper_test.rb
@@ -10,6 +10,10 @@ class NodeActionsHelperTest < ActionView::TestCase
     { :locale => nil }
   end
 
+  def icon(_name, **)
+    '<svg class="stub-icon"></svg>'.html_safe
+  end
+
   def teardown
     I18n.locale = @original_locale
   end
@@ -104,4 +108,39 @@ class NodeActionsHelperTest < ActionView::TestCase
     assert_includes action_summary(e), "a/b"
     assert_not action_details?(e)
   end
+
+  test "trash, restore, and destroy render their paths" do
+    trash   = entry("trash",   { "path" => { "from" => "club/old", "to" => "trash/old" } })
+    restore = entry("restore_from_trash", { "path" => { "from" => "trash/old", "to" => "club/new" } })
+    doomed  = entry("destroy", { "path" => "trash/old" })
+
+    assert_includes action_summary(trash),   "club/old"
+    assert_includes action_summary(restore), "club/new"
+    assert_includes action_summary(doomed),  "trash/old"
+  end
+
+  test "revision lifecycle badges cover create, publish, rollback, and inference" do
+    created   = entry("create",  { "title" => "x", "path" => "a/b" })
+    published = entry("publish", { "via" => "draft",    "title" => { "from" => nil, "to" => "x" } })
+    restored  = entry("publish", { "via" => "revision", "title" => { "from" => "y", "to" => "x" } })
+    restored.update!(:inferred_from => "from_page_revision")
+
+    out = revision_lifecycle_badges([created, published, restored])
+
+    assert_includes out, "created"
+    assert_includes out, "published"
+    assert_includes out, "restored"
+    assert_includes out, "quentin"
+    assert_includes out, "node_action_inferred"
+    assert_includes out, "<span"
+    assert_not_includes out, "&lt;span"
+
+    assert_equal "", revision_lifecycle_badges(nil)
+  end
+
+  test "verb icons map known verbs, distinguish rollbacks, and fall back" do
+    assert_includes verb_icon(entry("trash", { "path" => { "from" => "a", "to" => "t/a" } })), "node_action_icon--trash"
+    assert_includes verb_icon(entry("publish", { "via" => "revision" })), "node_action_icon--history"
+    assert_includes verb_icon(entry("frobnicate")), "node_action_icon--circle-dashed"
+  end
 end
diff --git a/test/models/node_test.rb b/test/models/node_test.rb
index c8e49e5..ab66f81 100644
--- a/test/models/node_test.rb
+++ b/test/models/node_test.rb
@@ -761,4 +761,105 @@ class NodeTest < ActiveSupport::TestCase
     assert_equal "Second",    action.metadata.dig("title", "from")
     assert_equal "First",     action.metadata.dig("title", "to")
   end
+
+  test "default_template_name rejects values not present in the template directory" do
+    node = Node.root.children.build(:slug => "template_guard_test",
+                                     :default_template_name => "../../layouts/admin")
+    assert_not node.valid?
+
+    node.default_template_name = "standard_template"
+    assert node.valid?
+  end
+
+  test "destroying a node with children is refused" do
+    parent = Node.root.children.create!(:slug => "destroy_guard_parent")
+    parent.children.create!(:slug => "destroy_guard_child")
+
+    assert_no_difference "Node.count" do
+      assert_not parent.destroy
+    end
+    assert parent.errors[:base].any?
+  end
+
+  test "destroying a childless node leaves no orphaned pages or asset links" do
+    node = create_node_with_published_page
+    page_ids = node.pages.pluck(:id)
+    asset = Asset.create!(:name => "destroy cascade probe",
+                          :upload_file_name    => "test_image.png",
+                          :upload_content_type => "image/png",
+                          :upload_file_size    => 49854,
+                          :upload_updated_at   => Time.current)
+    node.head.related_assets.create!(:asset_id => asset.id, :position => 1)
+
+    node.destroy
+
+    assert_equal 0, Page.where(:id => page_ids).count
+    assert_equal 0, RelatedAsset.where(:page_id => page_ids).count
+  end
+
+  test "destroying a node also removes its autosave page" do
+    node = create_node_with_published_page
+    node.lock_for_editing!(@user1)
+    node.autosave!({:title => "in flight"}, @user1)
+    autosave_id = node.autosave_id
+
+    node.destroy
+
+    assert_equal 0, Page.where(:id => autosave_id).count
+  end
+
+  test "Node.trash lazily creates the container exactly once" do
+    assert_difference "Node.count", 1 do
+      Node.trash
+    end
+    assert_no_difference "Node.count" do
+      assert_equal Node.trash, Node.trash
+    end
+    assert Node.trash.trash_node?
+    assert_not Node.trash.in_trash?
+    assert_equal "Trash", Globalize.with_locale(I18n.default_locale) { Node.trash.draft.title }
+  end
+
+  test "in_trash? walks the whole parent chain" do
+    child = Node.trash.children.create!(:slug => "trashed_thing")
+    grandchild = child.children.create!(:slug => "trashed_deeper")
+
+    assert child.in_trash?
+    assert grandchild.in_trash?
+    assert_not Node.root.children.create!(:slug => "living_thing").in_trash?
+  end
+
+  test "the reserved slug is refused for other root children, live and staged" do
+    Node.trash
+
+    assert_not Node.root.children.build(:slug => CccConventions::TRASH_SLUG).valid?
+    assert_not Node.root.children.build(:slug => "fine", :staged_slug => CccConventions::TRASH_SLUG).valid?
+    assert Node.trash.children.create!(:slug => "sub").children.build(:slug => CccConventions::TRASH_SLUG).valid?
+  end
+
+  test "the Trash node refuses rename, move, and destroy" do
+    trash = Node.trash
+    other = Node.root.children.create!(:slug => "not_the_trash")
+
+    trash.slug = "recycling"
+    assert_not trash.valid?
+
+    trash.reload.parent_id = other.id
+    assert_not trash.valid?
+
+    assert_no_difference "Node.count" do
+      assert_not trash.reload.destroy
+    end
+  end
+
+  test "a head cannot exist inside the Trash, and publishing there is refused" do
+    node = Node.trash.children.create!(:slug => "no_publish_here")
+    page = node.pages.create!
+
+    node.head = page
+    assert_not node.valid?
+
+    node.reload
+    assert_raises(ActiveRecord::RecordInvalid) { node.publish_draft! }
+  end
 end
diff --git a/test/models/node_trash_test.rb b/test/models/node_trash_test.rb
new file mode 100644
index 0000000..52069d7
--- /dev/null
+++ b/test/models/node_trash_test.rb
@@ -0,0 +1,168 @@
+require "test_helper"
+
+class NodeTrashTest < ActiveSupport::TestCase
+
+  def setup
+    @user1 = User.create!(:login => "trasher", :email => "t@example.com",
+                           :password => "foobar", :password_confirmation => "foobar")
+  end
+
+  test "trash! demotes the head into the draft slot when no draft exists" do
+    node = create_node_with_published_page
+    former_head = node.head
+
+    node.trash!(@user1)
+    node.reload
+
+    assert_nil node.head_id
+    assert_equal former_head, node.draft
+    assert node.in_trash?
+  end
+
+  test "trash! keeps an existing draft; the former head stays a plain revision" do
+    node = create_node_with_published_page
+    draft = find_or_create_draft(node, @user1)
+    former_head = node.head
+
+    node.trash!(@user1)
+    node.reload
+
+    assert_nil node.head_id
+    assert_equal draft, node.draft
+    assert_includes node.pages, former_head
+  end
+
+  test "trash! demotes descendant heads and counts them in the log entry" do
+    parent = create_node_with_published_page
+    child  = parent.children.create!(:slug => "trashed_child")
+    child.draft.update!(:title => "Child")
+    child.publish_draft!(@user1)
+
+    parent.trash!(@user1)
+
+    action = NodeAction.where(:action => "trash").last
+    assert_equal parent, action.node
+    assert_equal 2, action.metadata["demoted_heads"]
+    assert action.metadata["was_published"]
+    assert_nil child.reload.head_id
+    assert child.in_trash?
+  end
+
+  test "trash! logs one entry with the path pair and updates unique names" do
+    node = create_node_with_published_page
+    path_before = node.unique_name
+
+    assert_difference "NodeAction.count", 1 do
+      node.trash!(@user1)
+    end
+
+    action = NodeAction.last
+    assert_equal path_before, action.metadata.dig("path", "from")
+    assert_equal node.reload.unique_name, action.metadata.dig("path", "to")
+    assert action.metadata.dig("path", "to").start_with?(CccConventions::TRASH_SLUG)
+  end
+
+  test "trash! on an already trashed node is a logged-nothing no-op" do
+    node = create_node_with_published_page
+    node.trash!(@user1)
+
+    assert_no_difference "NodeAction.count" do
+      assert_nil node.reload.trash!(@user1)
+    end
+  end
+
+  test "restore_from_trash! reparents as drafts without republishing" do
+    node = create_node_with_published_page
+    node.trash!(@user1)
+    target = Node.root.children.create!(:slug => "restore_target")
+
+    node.reload.restore_from_trash!(target, @user1)
+    node.reload
+
+    assert_equal target, node.parent
+    assert_not node.in_trash?
+    assert_nil node.head_id
+    assert_not_nil node.draft_id
+    assert_equal "restore_from_trash", NodeAction.last.action
+  end
+
+  test "restore_from_trash! refuses targets inside the Trash and the Trash itself" do
+    node = create_node_with_published_page
+    node.trash!(@user1)
+    other_trashed = Node.trash.children.create!(:slug => "also_trashed")
+
+    assert_raises(ActiveRecord::RecordInvalid) { node.reload.restore_from_trash!(Node.trash, @user1) }
+    assert_raises(ActiveRecord::RecordInvalid) { node.reload.restore_from_trash!(other_trashed, @user1) }
+  end
+
+  test "destroy_from_trash! refuses nodes outside the Trash" do
+    node = create_node_with_published_page
+
+    assert_raises(ActiveRecord::RecordInvalid) { node.destroy_from_trash!(@user1) }
+    assert Node.exists?(node.id)
+  end
+
+  test "destroy_from_trash! removes the whole subtree bottom-up with one entry" do
+    parent = create_node_with_published_page
+    child = parent.children.create!(:slug => "doomed_child")
+    grandchild = child.children.create!(:slug => "doomed_grandchild")
+    page_ids = [parent, child, grandchild].flat_map { |n| n.pages.pluck(:id) }
+    parent.trash!(@user1)
+
+    assert_difference "NodeAction.count", 1 do
+      parent.reload.destroy_from_trash!(@user1)
+    end
+
+    assert_not Node.exists?(parent.id)
+    assert_not Node.exists?(child.id)
+    assert_not Node.exists?(grandchild.id)
+    assert_equal 0, Page.where(:id => page_ids).count
+
+    action = NodeAction.where(:action => "destroy").last
+    assert_equal 2, action.metadata["destroyed_descendants"]
+    assert_nil action.node_id
+  end
+
+  test "destroy_from_trash! logs an entry that survives the node" do
+    node = create_node_with_published_page
+    Globalize.with_locale(I18n.default_locale) { node.head.update!(:title => "Doomed") }
+    node.trash!(@user1)
+    final_path = node.reload.unique_name
+
+    node.destroy_from_trash!(@user1)
+
+    action = NodeAction.where(:action => "destroy").last
+    assert_nil action.node_id
+    assert_equal final_path, action.metadata["path"]
+    assert_equal "Doomed", action.subject_name
+    assert_equal @user1, action.user
+  end
+
+  test "suggested_restore_parent finds the old parent while it lives" do
+    parent = Node.root.children.create!(:slug => "old_home")
+    node = parent.children.create!(:slug => "comes_back")
+    node.trash!(@user1)
+
+    assert_equal parent, node.reload.suggested_restore_parent
+
+    parent.trash!(@user1)
+    assert_nil node.reload.suggested_restore_parent
+  end
+
+  test "suggested_restore_parent is root for trashed top-level nodes" do
+    node = Node.root.children.create!(:slug => "was_top_level")
+    node.trash!(@user1)
+
+    assert_equal Node.root, node.reload.suggested_restore_parent
+  end
+
+  test "trashed nodes and the Trash itself stay out of the drafts surfaces" do
+    Node.trash
+    node = create_node_with_published_page
+    node.trash!(@user1)
+
+    ids = Node.drafts_and_autosaves.pluck(:id)
+    assert_not_includes ids, Node.trash.id
+    assert_not_includes ids, node.id
+  end
+end
diff --git a/test/models/page_test.rb b/test/models/page_test.rb
index edb7c37..1f924f9 100644
--- a/test/models/page_test.rb
+++ b/test/models/page_test.rb
@@ -370,4 +370,39 @@ class PageTest < ActiveSupport::TestCase
     assert en_entry[:changed]
     refute en_entry[:exists_there]
   end
+
+  test "aggregate ignores order_by values outside the allowlist" do
+    sql = Page.aggregate(:order_by => "pages.id; DROP TABLE pages--").to_sql
+
+    assert_not_includes sql, "DROP"
+    assert_includes sql, "pages.id ASC"
+  end
+
+  test "aggregate accepts allowlisted order columns, bare or prefixed" do
+    assert_includes Page.aggregate(:order_by => "published_at").to_sql,
+                    "pages.published_at ASC"
+    assert_includes Page.aggregate(:order_by => "pages.published_at").to_sql,
+                    "pages.published_at ASC"
+  end
+
+  test "template_name rejects values not present in the template directory" do
+    page = Page.create!(:title => "Template guard")
+
+    page.template_name = "../../partials/_article"
+    assert_not page.valid?
+
+    page.template_name = "standard_template"
+    assert page.valid?
+
+    page.template_name = ""
+    assert page.valid?
+  end
+
+  test "a stale legacy template_name does not block unrelated saves" do
+    page = Page.create!(:title => "Stale template")
+    page.update_column(:template_name, "long_deleted_template")
+
+    page.reload
+    assert page.update(:abstract => "still saveable")
+  end
 end
diff --git a/test/models/user_test.rb b/test/models/user_test.rb
index 6e4d2d7..feccce2 100644
--- a/test/models/user_test.rb
+++ b/test/models/user_test.rb
@@ -54,6 +54,78 @@ class UserTest < ActiveSupport::TestCase
   def test_should_authenticate_user
     assert_equal users(:quentin), User.authenticate('quentin', 'monkey')
   end
+
+  def test_should_not_authenticate_wrong_password
+    assert_nil User.authenticate("quentin", "wrong password")
+  end
+
+  def test_should_not_authenticate_unknown_user
+    assert_nil User.authenticate("nosuchuser", "monkey")
+  end
+
+  def test_user_with_crypted_password_is_migrated_on_login
+    user = users(:quentin)
+
+    assert_nil user.password_digest
+
+    assert User.authenticate("quentin", "monkey")
+
+    user.reload
+
+    assert_not_nil user.password_digest
+    assert_nil user.crypted_password
+    assert_nil user.salt
+  end
+
+  def test_new_user_uses_password_digest
+    user = create_user
+
+    assert_not_nil user.password_digest
+    assert_nil user.crypted_password
+    assert_nil user.salt
+
+    assert_equal user, User.authenticate("quire", "quire69")
+  end
+
+  def test_legacy_user_is_migrated_on_login
+    user = users(:quentin)
+
+    assert_nil user.password_digest
+    assert_not_nil user.crypted_password
+    assert_not_nil user.salt
+
+    assert_equal user, User.authenticate("quentin", "monkey")
+
+    user.reload
+
+    assert_not_nil user.password_digest
+    assert_nil user.crypted_password
+    assert_nil user.salt
+  end
+
+  def test_migrated_user_authenticates_using_password_digest
+    user = users(:quentin)
+
+    # Trigger automatic migration.
+    assert_equal user, User.authenticate("quentin", "monkey")
+
+    user.reload
+
+    assert_not_nil user.password_digest
+    assert_nil user.crypted_password
+    assert_nil user.salt
+
+    # Second login should now use password_digest.
+    assert_equal user, User.authenticate("quentin", "monkey")
+  end
+
+  def test_migrated_user_can_be_updated_without_password
+    user = users(:quentin)
+    assert_equal user, User.authenticate("quentin", "monkey")
+    user.reload
+
+    assert user.update(:email => "quentin@example.org")
+  end
   
 protected
   def create_user(options = {})