Fix more tests and refactor invitation signup flow

Author: mayorova

app/controllers/provider/invitee_signups_controller.rb

@@ -53,9 +53,10 @@ def can_create?
   end
 
   def build_user
-    allowed_attrs = @invitation.account.users.new.defined_fields_names | %i(password password_confirmation)
+    @user = @invitation.make_user
+    allowed_attrs = @user.defined_fields_names | %i(password password_confirmation)
     user_params = params.fetch(:user, ActionController::Parameters.new).permit(*allowed_attrs)
-    @user = @invitation.make_user(user_params)
+    @user.assign_attributes(user_params)
 
     # This is just a sanity guard added when splitting invitation
     # controllers. Remove when SURE.

app/models/invitation.rb

@@ -26,7 +26,7 @@ class Invitation < ApplicationRecord
 
   # Build new user on information in this invitation.
   def make_user(params = {})
-    self.user= account.users.build_with_fields params.reverse_merge(:email => email, :invitation => self)
+    self.user = account.users.build_with_fields params.reverse_merge(:email => email, :invitation => self)
   end
 
   def accepted?

lib/developer_portal/app/controllers/developer_portal/accounts/invitee_signups_controller.rb

@@ -121,8 +121,10 @@ def check_invitation!
   end
 
   def build_user
-    allowed_attrs = @invitation.account.users.new.defined_fields_names | %i(password password_confirmation)
-    @user = @invitation.make_user(filter_readonly_params(params[:user], User).permit(*allowed_attrs))
+    @user = @invitation.make_user
+    allowed_attrs = @user.defined_fields_names | %i(password password_confirmation)
+    user_params = filter_readonly_params(params[:user], User).permit(*allowed_attrs)
+    @user.assign_attributes(user_params)
   end
 
   def invitation_token

test/integration/developer_portal/accounts/invitee_signups_controller_test.rb

@@ -87,6 +87,23 @@ def setup
     assert_nil created_user.extra_fields['employee_id']
   end
 
+  test 'do not set unpermitted attributes' do
+    invitation = FactoryBot.create(:invitation, account: buyer)
+
+    assert_difference(buyer.users.method(:count), +1) do
+      post invitee_signup_path(invitation_token: invitation.token, user: user_params.merge(
+        role: 'superadmin'
+      ))
+    end
+
+    assert_equal I18n.t('developer_portal.accounts.invitee_signups.create.success'), flash[:notice]
+    assert_redirected_to login_path
+
+    created_user = invitation.reload.user
+    assert_equal :member, created_user.role
+    assert_equal 'admin', created_user.username
+  end
+
   private
 
   def user_params

test/integration/provider/invitee_signups_controller_integration_test.rb

@@ -28,6 +28,25 @@ def setup
     assert_redirected_to provider_login_path
   end
 
+  test 'do not set unpermitted attributes' do
+    FieldsDefinition.create_defaults!(provider.provider_account)
+    invitation = FactoryBot.create(:invitation, account: provider)
+
+    assert_difference(provider.users.method(:count), +1) do
+      post provider_invitee_signup_path(invitation_token: invitation.token, user: user_params.merge(
+        role: 'superadmin'
+      ))
+    end
+
+    assert_equal I18n.t('provider.invitee_signups.create.success'), flash[:success]
+    assert_redirected_to provider_login_path
+
+    created_user = invitation.reload.user
+    assert_equal :member, created_user.role
+    assert_equal 'admin', created_user.username
+  end
+
+
   test 'get asks for upgrade' do
     provider.create_provider_constraints!(max_users: 0)