move revision history of users to be accessed only by site admins

app/models/admin_ability.rb

@@ -167,7 +167,6 @@ class AdminAbility
         role.resource_type == 'Track' && (track_ids.include? role.resource_id)
     end
 
-    can [:index, :revert_object, :revert_attribute], PaperTrail::Version, item_type: 'User'
     can [:index, :revert_object, :revert_attribute], PaperTrail::Version, conference_id: conf_ids
   end
 

spec/features/versions_spec.rb

@@ -1,12 +1,14 @@
 require 'spec_helper'
 
 feature 'Version' do
+  let(:admin) { create(:admin) }
   let!(:conference) { create(:conference) }
   let!(:organizer_role) { Role.find_by(name: 'organizer', resource: conference) }
   let!(:organizer) { create(:user, role_ids: [organizer_role.id]) }
   let(:event_with_commercial) { create(:event, program: conference.program) }
   let(:event_commercial) { create(:event_commercial, commercialable: event_with_commercial, url: 'https://www.youtube.com/watch?v=M9bq_alk-sw') }
 
+  context 'signed in as organizer' do
     before(:each) do
       sign_in organizer
     end
@@ -301,18 +303,6 @@ feature 'Version' do
       expect(page).to have_no_text('Someone (probably via the console) created new commercial')
     end
 
-  scenario 'display changes in organization', feature: true, versioning: true, js: true do
-    admin = create(:admin)
-    sign_in admin
-
-    visit new_admin_organization_path
-    fill_in 'organization_name', with: 'New org'
-    click_button 'Create Organization'
-
-    visit admin_revision_history_path
-    expect(page).to have_text('created new organization New org')
-  end
-
     scenario 'display changes in users_role for organization role', feature: true, versioning: true, js: true do
       user = create(:user)
       role = Role.find_by(resource_id: conference.organization.id, resource_type: 'Organization')
@@ -424,6 +414,44 @@ feature 'Version' do
       expect(page).to have_text("Someone (probably via the console) deleted campaign Test Campaign with ID #{campaign_id} in conference #{conference.short_title}")
     end
 
+    scenario 'does not display password reset requests', feature: true, versioning: true, js: true do
+      user = create(:user)
+      user.send_reset_password_instructions
+
+      visit admin_revision_history_path
+      expect(page).to_not have_text("Someone requested password reset of user #{user.name}")
+    end
+
+    scenario 'does not display user signups', feature: true, versioning: true, js: true do
+      create(:user, name: 'testname')
+
+      visit admin_revision_history_path
+      expect(page).to_not have_text('testname signed up')
+    end
+
+    scenario 'does not display updates to user', feature: true, versioning: true, js: true do
+      user = create(:user)
+      user.update_attributes(nickname: 'testnick', affiliation: 'openSUSE')
+
+      visit admin_revision_history_path
+      expect(page).to_not have_text("Someone (probably via the console) updated  nickname and affiliation of user #{user.name}")
+    end
+  end
+
+  context 'signed in as admin' do
+    before do
+      sign_in admin
+    end
+
+    scenario 'display changes in organization', feature: true, versioning: true, js: true do
+      visit new_admin_organization_path
+      fill_in 'organization_name', with: 'New org'
+      click_button 'Create Organization'
+
+      visit admin_revision_history_path
+      expect(page).to have_text('created new organization New org')
+    end
+
     scenario 'display password reset requests', feature: true, versioning: true, js: true do
       user = create(:user)
       user.send_reset_password_instructions
@@ -447,3 +475,4 @@ feature 'Version' do
       expect(page).to have_text("Someone (probably via the console) updated  nickname and affiliation of user #{user.name}")
     end
   end
+end