From 403eb36903f510af7c992296ee126b73bb3df54b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Beno=C3=AEt=20Burnichon?= <bburnichon@alchemy.fr>
Date: Tue, 9 Feb 2016 11:17:25 +0100
Subject: [PATCH] Demote Admin users on request

---
 .../Controller/Admin/DashboardController.php     | 16 ++++++++++++++++
 .../Model/Manipulator/UserManipulator.php        |  4 ++--
 .../Model/Repositories/UserRepository.php        |  2 +-
 templates/web/admin/dashboard.html.twig          |  6 ++----
 4 files changed, 21 insertions(+), 7 deletions(-)

diff --git a/lib/Alchemy/Phrasea/Controller/Admin/DashboardController.php b/lib/Alchemy/Phrasea/Controller/Admin/DashboardController.php
index 82abeb8543..86dfb14d98 100644
--- a/lib/Alchemy/Phrasea/Controller/Admin/DashboardController.php
+++ b/lib/Alchemy/Phrasea/Controller/Admin/DashboardController.php
@@ -124,6 +124,10 @@ class DashboardController extends Controller
     public function addAdmins(Request $request)
     {
         $admins = $request->request->get('admins', []);
+
+        // Remove empty values
+        $admins = array_filter($admins);
+
         if (!is_array($admins) || count($admins) === 0) {
             $this->app->abort(400, '"admins" parameter must contains at least one value.');
         }
@@ -134,6 +138,15 @@ class DashboardController extends Controller
         }
 
         $userRepository = $this->getUserRepository();
+
+        $demotedAdmins = [];
+
+        foreach ($userRepository->findAdmins() as $admin) {
+            if (!in_array($admin->getId(), $admins)) {
+                $demotedAdmins[$admin->getId()] = $admin;
+            }
+        }
+
         $userRepository->findBy(['id' => $admins]);
         $admins = array_map(function ($usrId) use ($userRepository) {
             if (null === $user = $userRepository->find($usrId)) {
@@ -145,7 +158,10 @@ class DashboardController extends Controller
 
         /** @var UserManipulator $userManipulator */
         $userManipulator = $this->app['manipulator.user'];
+
+        $userManipulator->demote($demotedAdmins);
         $userManipulator->promote($admins);
+
         /** @var ACLManipulator $aclManipulator */
         $aclManipulator = $this->app['manipulator.acl'];
         $aclManipulator->resetAdminRights($admins);
diff --git a/lib/Alchemy/Phrasea/Model/Manipulator/UserManipulator.php b/lib/Alchemy/Phrasea/Model/Manipulator/UserManipulator.php
index e8a5fc8128..adfebb6f4f 100644
--- a/lib/Alchemy/Phrasea/Model/Manipulator/UserManipulator.php
+++ b/lib/Alchemy/Phrasea/Model/Manipulator/UserManipulator.php
@@ -347,9 +347,9 @@ class UserManipulator implements ManipulatorInterface
     /**
      * Makes given variable traversable.
      *
-     * @param mixed $var
+     * @param User|User[] $var
      *
-     * @return array
+     * @return array|\Traversable|User[]
      */
     private function makeTraversable($var)
     {
diff --git a/lib/Alchemy/Phrasea/Model/Repositories/UserRepository.php b/lib/Alchemy/Phrasea/Model/Repositories/UserRepository.php
index 7e14289f03..9d66c73285 100644
--- a/lib/Alchemy/Phrasea/Model/Repositories/UserRepository.php
+++ b/lib/Alchemy/Phrasea/Model/Repositories/UserRepository.php
@@ -25,7 +25,7 @@ class UserRepository extends EntityRepository
     /**
      * Finds admins.
      *
-     * @return array
+     * @return User[]
      */
     public function findAdmins()
     {
diff --git a/templates/web/admin/dashboard.html.twig b/templates/web/admin/dashboard.html.twig
index b6c67d3318..2242d18c17 100644
--- a/templates/web/admin/dashboard.html.twig
+++ b/templates/web/admin/dashboard.html.twig
@@ -106,11 +106,9 @@
                         </label>
                     </li>
                 {% endfor %}
-            </ul>
-            <div class="input-append" style="margin-left:20px">
                 <input class="admin_adder input-large" placeholder="{{ 'Add an admin' | trans }}"/>
-                <input type="submit" class="btn btn-warning" value="{{ 'boutton::valider' | trans }}" />
-            </div>
+            </ul>
+            <input type="submit" class="btn btn-warning" value="{{ 'boutton::valider' | trans }}" />
             <input type="hidden" class="new" name="admins[]" />
         </fieldset>
     </form>