Add admin user edit flow

tests/Feature/Admin/UserManagementControllerTest.php

@@ -4,6 +4,7 @@ namespace Tests\Feature\Admin;
 
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Hash;
 use Inertia\Testing\AssertableInertia as Assert;
 use Tests\TestCase;
 
@@ -61,6 +62,24 @@ class UserManagementControllerTest extends TestCase
             );
     }
 
+    /**
+     * Ensure admins can view the edit user page.
+     */
+    public function test_admin_can_view_the_edit_user_page(): void
+    {
+        $admin = User::factory()->admin()->create();
+        $member = User::factory()->create();
+
+        $this->actingAs($admin)
+            ->get(route('admin.users.edit', $member))
+            ->assertOk()
+            ->assertInertia(fn (Assert $page) => $page
+                ->component('admin/users/Edit')
+                ->where('user.id', $member->id)
+                ->where('user.email', $member->email),
+            );
+    }
+
     /**
      * Ensure admins can create managed users.
      */
@@ -120,6 +139,37 @@ class UserManagementControllerTest extends TestCase
         ]);
     }
 
+    /**
+     * Ensure admins can update managed users, including password and forced password changes.
+     */
+    public function test_admin_can_update_a_managed_user(): void
+    {
+        $admin = User::factory()->admin()->create();
+        $member = User::factory()->create([
+            'name' => 'Regular User',
+            'email' => 'member@example.com',
+            'must_change_password_on_next_login' => false,
+        ]);
+
+        $this->actingAs($admin)
+            ->patch(route('admin.users.save', $member), [
+                'name' => 'Updated User',
+                'email' => 'updated-user@example.com',
+                'password' => 'fresh-password',
+                'password_confirmation' => 'fresh-password',
+                'must_change_password_on_next_login' => true,
+            ])
+            ->assertRedirect(route('admin.users.index'))
+            ->assertSessionHas('status', 'Updated User was updated.');
+
+        $member->refresh();
+
+        $this->assertSame('Updated User', $member->name);
+        $this->assertSame('updated-user@example.com', $member->email);
+        $this->assertTrue($member->must_change_password_on_next_login);
+        $this->assertTrue(Hash::check('fresh-password', $member->password));
+    }
+
     /**
      * Ensure admins can also clear a user's global permissions.
      */
@@ -188,4 +238,27 @@ class UserManagementControllerTest extends TestCase
             'email' => 'blocked-user@example.com',
         ]);
     }
+
+    /**
+     * Ensure non-admin users cannot edit managed users.
+     */
+    public function test_non_admin_cannot_edit_a_user(): void
+    {
+        $member = User::factory()->create();
+        $otherUser = User::factory()->create();
+
+        $this->actingAs($member)
+            ->patch(route('admin.users.save', $otherUser), [
+                'name' => 'Blocked User',
+                'email' => 'blocked-user@example.com',
+                'password' => 'fresh-password',
+                'password_confirmation' => 'fresh-password',
+                'must_change_password_on_next_login' => true,
+            ])
+            ->assertForbidden();
+
+        $this->assertDatabaseMissing('users', [
+            'email' => 'blocked-user@example.com',
+        ]);
+    }
 }