From 62dabf75aedd2784e527a2a38bec3c0fbcdf7db9 Mon Sep 17 00:00:00 2001
From: FloWalchs <florian.walchshofer@icloud.com>
Date: Mon, 9 Mar 2026 19:29:02 +0000
Subject: [PATCH] group-controller-remove_users

---
 app/controllers/context_menus_controller.rb | 23 ++++++++++++
 app/controllers/groups_controller.rb        | 19 ++++++----
 app/views/context_menus/users.html.erb      | 39 +++++++++++++++++++--
 app/views/groups/remove_user.js.erb         |  1 -
 app/views/groups/remove_users.js.erb        |  1 +
 config/routes.rb                            |  3 +-
 6 files changed, 75 insertions(+), 11 deletions(-)
 create mode 100644 app/views/groups/remove_users.js.erb

diff --git a/app/controllers/context_menus_controller.rb b/app/controllers/context_menus_controller.rb
index 11d4b37c0..a982af0eb 100644
--- a/app/controllers/context_menus_controller.rb
+++ b/app/controllers/context_menus_controller.rb
@@ -134,6 +134,29 @@ class ContextMenusController < ApplicationController
     if @users.size == 1
       @user = @users.first
     end
+    @user_ids = @users.map(&:id)
+
+    @groups_for_remove = Group.givable
+      .joins(:groups_users)
+      .where(groups_users: { user_id: @user_ids })
+      .distinct
+      .order(:name)
+
+    @groups_for_add = Group.givable
+          .joins(<<-SQL.squish)
+          LEFT JOIN groups_users gu
+                 ON gu.group_id = #{Group.table_name}.id
+                AND gu.user_id IN (#{@user_ids.map { |i| ActiveRecord::Base.connection.quote(i) }.join(',')})
+          SQL
+          .group("#{Group.table_name}.id")
+          .having('COUNT(DISTINCT gu.user_id) < ?', @user_ids.size)
+          .order(:name)
+
+    if @users.size <= 10
+      names = @users.map { |u| "#{u.firstname} #{u.lastname}".strip }
+      @user_names = names.join("\n")
+    end
+
     render layout: false
   end
 end
diff --git a/app/controllers/groups_controller.rb b/app/controllers/groups_controller.rb
index 45631939f..1b5c0ab56 100644
--- a/app/controllers/groups_controller.rb
+++ b/app/controllers/groups_controller.rb
@@ -23,9 +23,9 @@ class GroupsController < ApplicationController
 
   before_action :require_admin, :except => [:show]
   before_action :find_group, :except => [:index, :new, :create]
-  accept_api_auth :index, :show, :create, :update, :destroy, :add_users, :remove_user
+  accept_api_auth :index, :show, :create, :update, :destroy, :add_users, :remove_users
 
-  require_sudo_mode :add_users, :remove_user, :create, :update, :destroy, :edit_membership, :destroy_membership
+  require_sudo_mode :add_users, :remove_users, :create, :update, :destroy, :edit_membership, :destroy_membership
 
   helper :custom_fields
   helper :principal_memberships
@@ -117,7 +117,10 @@ class GroupsController < ApplicationController
     @users = User.not_in_group(@group).where(:id => (params[:user_id] || params[:user_ids])).to_a
     @group.users << @users
     respond_to do |format|
-      format.html {redirect_to edit_group_path(@group, :tab => 'users')}
+      format.html do
+        flash[:notice] = l(:notice_successful_update) unless request.referer.presence == edit_group_path(@group, :tab => 'users')
+        redirect_back_or_default edit_group_path(@group, tab: 'users'), referer: true
+      end
       format.js
       format.api do
         if @users.any?
@@ -129,10 +132,14 @@ class GroupsController < ApplicationController
     end
   end
 
-  def remove_user
-    @group.users.delete(User.find(params[:user_id])) if request.delete?
+  def remove_users
+    @users = User.in_group(@group).where(:id => (params[:user_id] || params[:user_ids])).to_a
+    @group.users.delete(@users)
     respond_to do |format|
-      format.html {redirect_to edit_group_path(@group, :tab => 'users')}
+      format.html do
+        flash[:notice] = l(:notice_successful_delete) unless request.referer.presence == edit_group_path(@group, :tab => 'users')
+        redirect_back_or_default edit_group_path(@group, tab: 'users'), referer: true
+      end
       format.js
       format.api {render_api_ok}
     end
diff --git a/app/views/context_menus/users.html.erb b/app/views/context_menus/users.html.erb
index 5b6c783b7..35d26687f 100644
--- a/app/views/context_menus/users.html.erb
+++ b/app/views/context_menus/users.html.erb
@@ -23,17 +23,50 @@
   <% else %>
     <% unless @users.all?(&:locked?) %>
       <li>
-        <%= context_menu_link sprite_icon('lock', l(:button_lock)), bulk_lock_users_path(ids: @users.map(&:id)), method: :post, class: 'icon icon-lock' %>
+        <%= context_menu_link sprite_icon('lock', l(:button_lock)), bulk_lock_users_path(ids: @user_ids), method: :post, class: 'icon icon-lock' %>
       </li>
     <% else %>
       <li>
-        <%= context_menu_link sprite_icon('unlock', l(:button_unlock)), bulk_unlock_users_path(ids: @users.map(&:id)), method: :post, class: 'icon icon-unlock' %>
+        <%= context_menu_link sprite_icon('unlock', l(:button_unlock)), bulk_unlock_users_path(ids: @user_ids), method: :post, class: 'icon icon-unlock' %>
       </li>
     <% end %>
     <li>
       <%= context_menu_link sprite_icon('del', l(:button_delete)),
-                            {controller: 'users', action: 'bulk_destroy', ids: @users.map(&:id)},
+                            {controller: 'users', action: 'bulk_destroy', ids: @user_ids},
                             method: :delete, class: 'icon icon-del' %>
     </li>
   <% end %>
+  <% if @groups_for_add.any? %>
+    <li class="folder">
+      <a href="#" class="submenu"><%= l(:label_add_user_to_group) %></a>
+      <span class="icon-only"><%= sprite_icon('angle-right', rtl: true) %></span>
+      <ul>
+        <% @groups_for_add.each do |group| %>
+          <li>
+            <%= context_menu_link group.name,
+                group_users_path(user_ids: @user_ids, id: group.id),
+                :method => :post,
+                :disabled => false %>
+          </li>
+        <% end %>
+      </ul>
+    </li>
+  <% end %>
+  <% if @groups_for_remove.any? %>
+    <li class="folder">
+      <a href="#" class="submenu"><%= l(:label_remove_user_from_group) %></a>
+      <span class="icon-only"><%= sprite_icon('angle-right', rtl: true) %></span>
+      <ul>
+        <% @groups_for_remove.each do |group| %>
+          <li>
+            <%= context_menu_link group.name,
+                group_remove_users_path(user_ids: @user_ids, id: group.id),
+                method: :delete,
+                data: { confirm: l(:text_remove_user_from_group_confirmation, count: @user_ids.size, groupname: group.name, users: @user_names) } %>
+          </li>
+        <% end %>
+      </ul>
+    </li>
+  <% end %>
+
 </ul>
diff --git a/app/views/groups/remove_user.js.erb b/app/views/groups/remove_user.js.erb
index 88daa8f58..e69de29bb 100644
--- a/app/views/groups/remove_user.js.erb
+++ b/app/views/groups/remove_user.js.erb
@@ -1 +0,0 @@
-$('#tab-content-users').html('<%= escape_javascript(render :partial => 'groups/users') %>');
diff --git a/app/views/groups/remove_users.js.erb b/app/views/groups/remove_users.js.erb
new file mode 100644
index 000000000..88daa8f58
--- /dev/null
+++ b/app/views/groups/remove_users.js.erb
@@ -0,0 +1 @@
+$('#tab-content-users').html('<%= escape_javascript(render :partial => 'groups/users') %>');
diff --git a/config/routes.rb b/config/routes.rb
index 3d039aaaf..33affde71 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -346,7 +346,8 @@ Rails.application.routes.draw do
 
   get 'groups/:id/users/new', :to => 'groups#new_users', :id => /\d+/, :as => 'new_group_users'
   post 'groups/:id/users', :to => 'groups#add_users', :id => /\d+/, :as => 'group_users'
-  delete 'groups/:id/users/:user_id', :to => 'groups#remove_user', :id => /\d+/, :as => 'group_user'
+  delete 'groups/:id/users/:user_id', :to => 'groups#remove_users', :id => /\d+/, :as => 'group_user'
+  delete 'groups/:id/users', :to => 'groups#remove_users', :id => /\d+/, :as => 'group_remove_users'
 
   resources :trackers, :except => :show do
     collection do
-- 
2.43.0