Primerize the administration user form. wp/72005

app/components/users/form_component.html.erb

@@ -0,0 +1,15 @@
+<%= render(form_list) %>
+
+<%= helpers.render_user_form_hooks(user: @user, form: @builder) %>
+
+<% if show_consent? %>
+  <%= render("users/consent", user: @user) %>
+<% end %>
+
+<% if show_preferences? %>
+  <%= fields_for(:pref, @user.pref, builder: @builder.class) do |pref_f| %>
+    <%= render(Users::Form::PreferencesForm.new(pref_f)) %>
+  <% end %>
+<% end %>
+
+<%= render(Primer::Beta::Button.new(type: :submit, scheme: :primary, name: "submit")) { creating? ? I18n.t(:button_create) : I18n.t(:button_save) } %>

app/components/users/form_component.rb

@@ -0,0 +1,103 @@
+# frozen_string_literal: true
+
+#-- copyright
+# OpenProject is an open source project management software.
+# Copyright (C) the OpenProject GmbH
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License version 3.
+#
+# OpenProject is a fork of ChiliProject, which is a fork of Redmine. The copyright follows:
+# Copyright (C) 2006-2013 Jean-Philippe Lang
+# Copyright (C) 2010-2013 the ChiliProject Team
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+#
+# See COPYRIGHT and LICENSE files for more details.
+#++
+
+module Users
+  # Coordinates the administration user form: receives the surrounding
+  # `settings_primer_form_with` builder, composes the inner forms into a
+  # Primer::Forms::FormList and renders the read-only / plain bits (status,
+  # consent, external auth, hooks, submit) and the pref-scoped preferences form
+  # around it. Create vs edit is derived from `user.new_record?`.
+  class FormComponent < ApplicationComponent
+    def initialize(builder:, user:, contract:)
+      super()
+      @builder = builder
+      @user = user
+      @contract = contract
+    end
+
+    private
+
+    def creating? = @user.new_record?
+    def editing? = !creating?
+
+    def form_list
+      Primer::Forms::FormList.new(*input_forms)
+    end
+
+    def input_forms
+      forms = [Users::Form::AttributesForm.new(@builder, user: @user, contract: @contract)]
+      if show_authentication?
+        forms << Users::Form::AuthenticationForm.new(@builder,
+                                                     user: @user,
+                                                     render_auth_source: show_auth_source?,
+                                                     render_password: show_password?,
+                                                     render_no_login_message: show_no_login_message?,
+                                                     render_external_auth: show_external_auth?,
+                                                     assign_random_password_checked: assign_random_password_checked?)
+      end
+      forms
+    end
+
+    def show_authentication?
+      show_auth_source? || show_password? || show_no_login_message? || show_external_auth?
+    end
+
+    def show_auth_source?
+      return false if editing? && @user.uses_external_authentication?
+
+      creating? ? can_users_have_auth_source? : (User.current.admin? || can_users_have_auth_source?)
+    end
+
+    def show_password?
+      editing? && User.current.admin? && !@user.uses_external_authentication? && !disable_password_login?
+    end
+
+    def show_preferences? = editing? && User.current.admin?
+    def show_external_auth? = editing? && @user.uses_external_authentication?
+
+    def show_no_login_message?
+      editing? && User.current.admin? && !@user.uses_external_authentication? && disable_password_login?
+    end
+
+    def show_consent? = editing? && Setting.consent_required?
+
+    def can_users_have_auth_source?
+      LdapAuthSource.any? && !disable_password_login?
+    end
+
+    def disable_password_login?
+      OpenProject::Configuration.disable_password_login?
+    end
+
+    def assign_random_password_checked?
+      helpers.params.dig(:user, :assign_random_password).present?
+    end
+  end
+end

app/controllers/my_controller.rb

@@ -185,7 +185,20 @@ def user_params
     # The Users::UpdateService updates the user's pref using the UserPreferences::UpdateService
     # which has a contract/schema applied to the values which is why it is ok
     # to blindly allow all scalar values in pref.
-    permitted_params.user.to_h.merge(params.permit(pref: {}))
+    attributes = permitted_params.user.to_h.merge(params.permit(pref: {}))
+    drop_non_editable_custom_field_values(attributes)
+  end
+
+  # On the self-service account page only custom fields the user is allowed to
+  # edit themselves (editable: true) may be changed. Drop the rest so a crafted
+  # request cannot persist values the UI renders read-only.
+  def drop_non_editable_custom_field_values(attributes)
+    values = attributes["custom_field_values"]
+    return attributes if values.blank?
+
+    editable_ids = current_user.available_custom_fields.select(&:editable?).map { |cf| cf.id.to_s }
+    attributes["custom_field_values"] = values.slice(*editable_ids)
+    attributes
   end
 
   def update_global_notification_setting(update_params)

app/controllers/users_controller.rb

@@ -115,7 +115,7 @@ def edit
     prepare_views_for_tab
   end
 
-  def create # rubocop:disable Metrics/AbcSize
+  def create
     call = Users::CreateService
            .new(user: current_user)
            .call(create_params)
@@ -124,7 +124,7 @@ def create # rubocop:disable Metrics/AbcSize
 
     if call.success?
       flash[:notice] = I18n.t(:notice_successful_create)
-      redirect_to(params[:continue] ? new_user_path : helpers.allowed_management_user_profile_path(@user))
+      redirect_to helpers.allowed_management_user_profile_path(@user)
     else
       @contract = Users::CreateContract.new(@user, current_user)
       render action: :new, status: :unprocessable_entity

app/forms/custom_fields/custom_field_rendering.rb

@@ -52,13 +52,17 @@ module CustomFields::CustomFieldRendering
 
   def render_custom_fields(form:)
     custom_fields.each do |custom_field|
-      form.fields_for(:custom_field_values) do |builder|
-        custom_field_input(builder, custom_field)
-      end
-      if custom_field.has_comment?
-        form.fields_for(:custom_comments) do |builder|
-          custom_comment_input(builder, custom_field)
-        end
+      render_custom_field(form:, custom_field:)
+    end
+  end
+
+  def render_custom_field(form:, custom_field:)
+    form.fields_for(:custom_field_values) do |builder|
+      custom_field_input(builder, custom_field)
+    end
+    if custom_field.has_comment?
+      form.fields_for(:custom_comments) do |builder|
+        custom_comment_input(builder, custom_field)
       end
     end
   end

app/forms/custom_fields/inputs/base/autocomplete/multi_value_input.rb

@@ -40,12 +40,14 @@ def input_attributes
   end
 
   def autocomplete_options
-    {
+    opts = {
       multiple: true,
       decorated: decorated?,
       focusDirectly: false,
       append_to:
     }
+    opts[:disabled] = true if options[:disabled]
+    opts
   end
 
   def decorated?

app/forms/custom_fields/inputs/base/autocomplete/single_value_input.rb

@@ -40,12 +40,14 @@ def input_attributes
   end
 
   def autocomplete_options
-    {
+    opts = {
       multiple: false,
       decorated: decorated?,
       focusDirectly: false,
       append_to:
     }
+    opts[:disabled] = true if options[:disabled]
+    opts
   end
 
   def decorated?

app/forms/custom_fields/inputs/base/utils.rb

@@ -32,7 +32,7 @@ module CustomFields::Inputs::Base::Utils
   delegate :attribute_name, to: :@custom_field
 
   def base_input_attributes
-    {
+    attributes = {
       name:,
       label:,
       value:,
@@ -41,6 +41,8 @@ def base_input_attributes
       validation_message:,
       help_text_options: { attribute_name: }
     }
+    attributes[:disabled] = true if options[:disabled]
+    attributes
   end
 
   def name