From adb2d126d3f4b95e058583464662cd9bf2561307 Mon Sep 17 00:00:00 2001
From: Ben Sima <ben@bsima.me>
Date: Fri, 21 Nov 2025 00:27:13 -0500
Subject: feat: implement t-1neWyaO

---
 Biz/PodcastItLater/Web.py | 80 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 80 insertions(+)

(limited to 'Biz/PodcastItLater')

diff --git a/Biz/PodcastItLater/Web.py b/Biz/PodcastItLater/Web.py
index 7e8e969..91761a1 100644
--- a/Biz/PodcastItLater/Web.py
+++ b/Biz/PodcastItLater/Web.py
@@ -3164,6 +3164,85 @@ class TestUsageLimits(BaseWebTest):
         self.assertEqual(usage["articles"], 20)
 
 
+class TestAdminUsers(BaseWebTest):
+    """Test admin user management functionality."""
+
+    def setUp(self) -> None:
+        """Set up test client with logged-in admin user."""
+        super().setUp()
+
+        # Create and login admin user
+        self.user_id, _ = Core.Database.create_user(
+            "ben@bensima.com",
+        )
+        Core.Database.update_user_status(
+            self.user_id,
+            "active",
+        )
+        self.client.post("/login", data={"email": "ben@bensima.com"})
+
+        # Create another regular user
+        self.other_user_id, _ = Core.Database.create_user("user@example.com")
+        Core.Database.update_user_status(self.other_user_id, "active")
+
+    def test_admin_users_page_access(self) -> None:
+        """Admin can access users page."""
+        response = self.client.get("/admin/users")
+        self.assertEqual(response.status_code, 200)
+        self.assertIn("User Management", response.text)
+        self.assertIn("user@example.com", response.text)
+
+    def test_non_admin_users_page_access(self) -> None:
+        """Non-admin cannot access users page."""
+        # Login as regular user
+        self.client.get("/logout")
+        self.client.post("/login", data={"email": "user@example.com"})
+
+        response = self.client.get("/admin/users")
+        self.assertEqual(response.status_code, 302)
+        self.assertIn("error=forbidden", response.headers["Location"])
+
+    def test_admin_can_update_user_status(self) -> None:
+        """Admin can update user status."""
+        response = self.client.post(
+            f"/admin/users/{self.other_user_id}/status",
+            data={"status": "disabled"}
+        )
+        self.assertEqual(response.status_code, 200)
+        
+        user = Core.Database.get_user_by_id(self.other_user_id)
+        assert user is not None
+        self.assertEqual(user["status"], "disabled")
+
+    def test_non_admin_cannot_update_user_status(self) -> None:
+        """Non-admin cannot update user status."""
+        # Login as regular user
+        self.client.get("/logout")
+        self.client.post("/login", data={"email": "user@example.com"})
+
+        response = self.client.post(
+            f"/admin/users/{self.other_user_id}/status",
+            data={"status": "disabled"}
+        )
+        self.assertEqual(response.status_code, 403)
+        
+        user = Core.Database.get_user_by_id(self.other_user_id)
+        assert user is not None
+        self.assertEqual(user["status"], "active")
+        
+    def test_update_user_status_invalid_status(self) -> None:
+        """Invalid status validation."""
+        response = self.client.post(
+            f"/admin/users/{self.other_user_id}/status",
+            data={"status": "invalid_status"}
+        )
+        self.assertEqual(response.status_code, 400)
+        
+        user = Core.Database.get_user_by_id(self.other_user_id)
+        assert user is not None
+        self.assertEqual(user["status"], "active")
+
+
 def test() -> None:
     """Run all tests for the web module."""
     Test.run(
@@ -3180,6 +3259,7 @@ def test() -> None:
             TestEpisodeDeduplication,
             TestMetricsTracking,
             TestUsageLimits,
+            TestAdminUsers,
         ],
     )
 
-- 
cgit v1.2.3