feat: allow bulk invite create via email (#8853)

* feat: add agent builder

* feat: use new agent builder

* refactor: validate limit

* test: agent limits

* feat: allow bulk create

* feat: allow bulk create

* refactor: rename current_user to inviter in AgentBuilder

* refactor: move limits tests to enterprise

* test: send correct params

* refactor: account builder returns both user and account_user

* chore: Revert "refactor: account builder returns both user and account_user"

This reverts commit 1419789871e8a3b8ff57af27fe53925b1486a839.

* feat: return user as is

* Update agent_builder.rb

- minor update

---------

Co-authored-by: Sojan Jose <sojan@pepalo.com>

spec/builders/agent_builder_spec.rb

@@ -0,0 +1,87 @@
+require 'rails_helper'
+
+RSpec.describe AgentBuilder, type: :model do
+  subject(:agent_builder) { described_class.new(params) }
+
+  let(:account) { create(:account) }
+  let!(:current_user) { create(:user, account: account) }
+  let(:email) { 'test@example.com' }
+  let(:name) { 'Test User' }
+  let(:role) { 'agent' }
+  let(:availability) { 'offline' }
+  let(:auto_offline) { false }
+  let(:params) do
+    {
+      email: email,
+      name: name,
+      inviter: current_user,
+      account: account,
+      role: role,
+      availability: availability,
+      auto_offline: auto_offline
+    }
+  end
+
+  describe '#perform' do
+    context 'when user does not exist' do
+      it 'creates a new user' do
+        expect { agent_builder.perform }.to change(User, :count).by(1)
+      end
+
+      it 'creates a new account user' do
+        expect { agent_builder.perform }.to change(AccountUser, :count).by(1)
+      end
+
+      it 'returns a user' do
+        expect(agent_builder.perform).to be_a(User)
+      end
+    end
+
+    context 'when user exists' do
+      before do
+        create(:user, email: email)
+      end
+
+      it 'does not create a new user' do
+        expect { agent_builder.perform }.not_to change(User, :count)
+      end
+
+      it 'creates a new account user' do
+        expect { agent_builder.perform }.to change(AccountUser, :count).by(1)
+      end
+    end
+
+    context 'when only email is provided' do
+      let(:params) { { email: email, inviter: current_user, account: account } }
+
+      it 'creates a user with default values' do
+        user = agent_builder.perform
+        expect(user.name).to eq('')
+        expect(AccountUser.find_by(user: user).role).to eq('agent')
+      end
+    end
+
+    context 'when a temporary password is generated' do
+      it 'sets a temporary password for the user' do
+        user = agent_builder.perform
+        expect(user.encrypted_password).not_to be_empty
+      end
+    end
+
+    context 'with confirmation required' do
+      let(:unconfirmed_user) { create(:user, email: email) }
+
+      before do
+        unconfirmed_user.confirmed_at = nil
+        unconfirmed_user.save(validate: false)
+        allow(unconfirmed_user).to receive(:confirmed?).and_return(false)
+      end
+
+      it 'sends confirmation instructions' do
+        user = agent_builder.perform
+        expect(user).to receive(:send_confirmation_instructions)
+        agent_builder.send(:send_confirmation_if_required)
+      end
+    end
+  end
+end

spec/controllers/api/v1/accounts/agents_controller_spec.rb

@@ -4,8 +4,8 @@ RSpec.describe 'Agents API', type: :request do
   include ActiveJob::TestHelper
 
   let(:account) { create(:account) }
-  let(:admin) { create(:user, custom_attributes: { test: 'test' }, account: account, role: :administrator) }
-  let(:agent) { create(:user, account: account, role: :agent) }
+  let!(:admin) { create(:user, custom_attributes: { test: 'test' }, account: account, role: :administrator) }
+  let!(:agent) { create(:user, account: account, role: :agent) }
 
   describe 'GET /api/v1/accounts/{account.id}/agents' do
     context 'when it is an unauthenticated user' do
@@ -63,6 +63,8 @@ RSpec.describe 'Agents API', type: :request do
       end
 
       it 'deletes the agent and user object if associated with only one account' do
+        expect(account.users).to include(other_agent)
+
         perform_enqueued_jobs(only: DeleteObjectJob) do
           delete "/api/v1/accounts/#{account.id}/agents/#{other_agent.id}",
                  headers: admin.create_new_auth_token,
@@ -70,8 +72,7 @@ RSpec.describe 'Agents API', type: :request do
         end
 
         expect(response).to have_http_status(:success)
-        expect(account.reload.users.size).to eq(1)
-        expect(User.count).to eq(account.reload.users.size)
+        expect(account.reload.users).not_to include(other_agent)
       end
 
       it 'deletes only the agent object when user is associated with multiple accounts' do
@@ -85,8 +86,8 @@ RSpec.describe 'Agents API', type: :request do
         end
 
         expect(response).to have_http_status(:success)
-        expect(account.users.size).to eq(1)
-        expect(User.count).to eq(account.reload.users.size + 1)
+        expect(account.reload.users).not_to include(other_agent)
+        expect(other_agent.account_users.count).to eq(1) # Should only be associated with other_account now
       end
     end
   end
@@ -174,4 +175,27 @@ RSpec.describe 'Agents API', type: :request do
       end
     end
   end
+
+  describe 'POST /api/v1/accounts/{account.id}/agents/bulk_create' do
+    let(:emails) { ['test1@example.com', 'test2@example.com', 'test3@example.com'] }
+    let(:bulk_create_params) { { emails: emails } }
+
+    context 'when it is an unauthenticated user' do
+      it 'returns unauthorized' do
+        post "/api/v1/accounts/#{account.id}/agents/bulk_create", params: bulk_create_params
+
+        expect(response).to have_http_status(:unauthorized)
+      end
+    end
+
+    context 'when authenticated as admin' do
+      it 'creates multiple agents successfully' do
+        expect do
+          post "/api/v1/accounts/#{account.id}/agents/bulk_create", params: bulk_create_params, headers: admin.create_new_auth_token
+        end.to change(User, :count).by(3)
+
+        expect(response).to have_http_status(:ok)
+      end
+    end
+  end
 end

spec/enterprise/controllers/api/v1/accounts/agents_controller_spec.rb

@@ -0,0 +1,45 @@
+require 'rails_helper'
+
+RSpec.describe 'Agents API', type: :request do
+  include ActiveJob::TestHelper
+
+  let(:account) { create(:account) }
+  let!(:admin) { create(:user, custom_attributes: { test: 'test' }, account: account, role: :administrator) }
+
+  describe 'POST /api/v1/accounts/{account.id}/agents' do
+    context 'when the account has reached its agent limit' do
+      params = { name: 'NewUser', email: Faker::Internet.email, role: :agent }
+
+      before do
+        account.update(limits: { agents: 4 })
+        create_list(:user, 4, account: account, role: :agent)
+      end
+
+      it 'prevents adding a new agent and returns a payment required status' do
+        post "/api/v1/accounts/#{account.id}/agents", params: params, headers: admin.create_new_auth_token, as: :json
+
+        expect(response).to have_http_status(:payment_required)
+        expect(response.body).to include('Account limit exceeded. Please purchase more licenses')
+      end
+    end
+  end
+
+  describe 'POST /api/v1/accounts/{account.id}/agents/bulk_create' do
+    let(:emails) { ['test1@example.com', 'test2@example.com', 'test3@example.com'] }
+    let(:bulk_create_params) { { emails: emails } }
+
+    context 'when exceeding agent limit' do
+      it 'prevents creating agents and returns a payment required status' do
+        # Set the limit to be less than the number of emails
+        account.update(limits: { agents: 2 })
+
+        expect do
+          post "/api/v1/accounts/#{account.id}/agents/bulk_create", params: bulk_create_params, headers: admin.create_new_auth_token
+        end.not_to change(User, :count)
+
+        expect(response).to have_http_status(:payment_required)
+        expect(response.body).to include('Account limit exceeded. Please purchase more licenses')
+      end
+    end
+  end
+end