DEV: Make groups/new extensible by plugins (#7642)

* Expose a new plugin outlet. Pass group model to the group-member-dropdown so it can be accessed by plugins

* Added controller tests for group custom fields. update custom fields when updating a group

spec/requests/admin/groups_controller_spec.rb

@@ -12,8 +12,8 @@ RSpec.describe Admin::GroupsController do
   end
 
   describe '#create' do
-    it 'should work' do
-      post "/admin/groups.json", params: {
+    let(:group_params) do
+      {
         group: {
           name: 'testing',
           usernames: [admin.username, user.username].join(","),
@@ -22,6 +22,10 @@ RSpec.describe Admin::GroupsController do
           membership_request_template: 'Testing',
         }
       }
+    end
+
+    it 'should work' do
+      post "/admin/groups.json", params: group_params
 
       expect(response.status).to eq(200)
 
@@ -32,6 +36,44 @@ RSpec.describe Admin::GroupsController do
       expect(group.allow_membership_requests).to eq(true)
       expect(group.membership_request_template).to eq('Testing')
     end
+
+    context "custom_fields" do
+      before do
+        plugin = Plugin::Instance.new
+        plugin.register_editable_group_custom_field :test
+      end
+
+      after do
+        Group.plugin_editable_group_custom_fields.clear
+      end
+
+      it "only updates allowed user fields" do
+        params = group_params
+        params[:group].merge!(custom_fields: { test: :hello1, test2: :hello2 })
+
+        post "/admin/groups.json", params: params
+
+        group = Group.last
+
+        expect(response.status).to eq(200)
+        expect(group.custom_fields['test']).to eq('hello1')
+        expect(group.custom_fields['test2']).to be_blank
+      end
+
+      it "is secure when there are no registered editable fields" do
+        Group.plugin_editable_group_custom_fields.clear
+        params = group_params
+        params[:group].merge!(custom_fields: { test: :hello1, test2: :hello2 })
+
+        post "/admin/groups.json", params: params
+
+        group = Group.last
+
+        expect(response.status).to eq(200)
+        expect(group.custom_fields['test']).to be_blank
+        expect(group.custom_fields['test2']).to be_blank
+      end
+    end
   end
 
   describe '#add_owners' do