chore: Update method for team members (#1734)

Co-authored-by: Sojan Jose <sojan@pepalo.com>

app/controllers/api/v1/accounts/inbox_members_controller.rb

@@ -22,9 +22,10 @@ class Api::V1::Accounts::InboxMembersController < Api::V1::Accounts::BaseControl
     # get the list of  user_ids from params
     # the missing ones are the agents which are to be deleted from the inbox
     # the new ones are the agents which are to be added to the inbox
-
-    agents_to_be_added_ids.each { |user_id| @inbox.add_member(user_id) }
-    agents_to_be_removed_ids.each { |user_id| @inbox.remove_member(user_id) }
+    ActiveRecord::Base.transaction do
+      agents_to_be_added_ids.each { |user_id| @inbox.add_member(user_id) }
+      agents_to_be_removed_ids.each { |user_id| @inbox.remove_member(user_id) }
+    end
   end
 
   def agents_to_be_added_ids

app/controllers/api/v1/accounts/team_members_controller.rb

@@ -8,25 +8,38 @@ class Api::V1::Accounts::TeamMembersController < Api::V1::Accounts::BaseControll
 
   def create
     ActiveRecord::Base.transaction do
-      @team_members = params[:user_ids].map { |user_id| create_team_member(user_id) }
+      @team_members = params[:user_ids].map { |user_id| @team.add_member(user_id) }
     end
   end
 
+  def update
+    ActiveRecord::Base.transaction do
+      members_to_be_added_ids.each { |user_id| @team.add_member(user_id) }
+      members_to_be_removed_ids.each { |user_id| @team.remove_member(user_id) }
+    end
+    @team_members = @team.members
+    render action: 'create'
+  end
+
   def destroy
     ActiveRecord::Base.transaction do
-      params[:user_ids].map { |user_id| remove_team_member(user_id) }
+      params[:user_ids].map { |user_id| @team.remove_member(user_id) }
     end
     head :ok
   end
 
   private
 
-  def create_team_member(user_id)
-    @team.team_members.find_or_create_by(user_id: user_id)&.user
+  def members_to_be_added_ids
+    params[:user_ids] - current_members_ids
   end
 
-  def remove_team_member(user_id)
-    @team.team_members.find_by(user_id: user_id)&.destroy
+  def members_to_be_removed_ids
+    current_members_ids - params[:user_ids]
+  end
+
+  def current_members_ids
+    @current_members_ids ||= @team.members.pluck(:id)
   end
 
   def fetch_team

app/models/team.rb

@@ -24,6 +24,7 @@ class Team < ApplicationRecord
 
   belongs_to :account
   has_many :team_members, dependent: :destroy
+  has_many :members, through: :team_members, source: :user
   has_many :conversations, dependent: :nullify
 
   validates :name,
@@ -34,4 +35,12 @@ class Team < ApplicationRecord
   before_validation do
     self.name = name.downcase if attribute_present?('name')
   end
+
+  def add_member(user_id)
+    team_members.find_or_create_by(user_id: user_id)&.user
+  end
+
+  def remove_member(user_id)
+    team_members.find_by(user_id: user_id)&.destroy
+  end
 end

app/policies/team_member_policy.rb

@@ -10,4 +10,8 @@ class TeamMemberPolicy < ApplicationPolicy
   def destroy?
     @account_user.administrator?
   end
+
+  def update?
+    @account_user.administrator?
+  end
 end

config/routes.rb

@@ -102,6 +102,7 @@ Rails.application.routes.draw do
             resources :team_members, only: [:index, :create] do
               collection do
                 delete :destroy
+                patch :update
               end
             end
           end

spec/controllers/api/v1/accounts/team_members_controller_spec.rb

@@ -105,4 +105,43 @@ RSpec.describe 'Team Members API', type: :request do
       end
     end
   end
+
+  describe 'PATCH /api/v1/accounts/{account.id}/teams/{team_id}/team_members' do
+    context 'when it is an unauthenticated user' do
+      it 'returns unauthorized' do
+        patch "/api/v1/accounts/#{account.id}/teams/#{team.id}/team_members"
+
+        expect(response).to have_http_status(:unauthorized)
+      end
+    end
+
+    context 'when it is an authenticated user' do
+      let(:agent) { create(:user, account: account, role: :agent) }
+      let(:administrator) { create(:user, account: account, role: :administrator) }
+
+      it 'return unauthorized for agent' do
+        params = { user_id: agent.id }
+        patch "/api/v1/accounts/#{account.id}/teams/#{team.id}/team_members",
+              params: params,
+              headers: agent.create_new_auth_token,
+              as: :json
+
+        expect(response).to have_http_status(:unauthorized)
+      end
+
+      it 'updates the team members when its administrator' do
+        user_ids = (1..5).map { create(:user, account: account, role: :agent).id }
+        params = { user_ids: user_ids }
+
+        patch "/api/v1/accounts/#{account.id}/teams/#{team.id}/team_members",
+              params: params,
+              headers: administrator.create_new_auth_token,
+              as: :json
+
+        expect(response).to have_http_status(:success)
+        json_response = JSON.parse(response.body)
+        expect(json_response.count).to eq(user_ids.count)
+      end
+    end
+  end
 end