add base feature specs

app/models/encrypted_config.rb

@@ -21,14 +21,18 @@
 #  fk_rails_...  (account_id => accounts.id)
 #
 class EncryptedConfig < ApplicationRecord
-  FILES_STORAGE_KEY = 'active_storage'
-  EMAIL_SMTP_KEY = 'action_mailer_smtp'
-  ESIGN_CERTS_KEY = 'esign_certs'
-  APP_URL_KEY = 'app_url'
-  WEBHOOK_URL_KEY = 'webhook_url'
+  CONFIG_KEYS = [
+    FILES_STORAGE_KEY = 'active_storage',
+    EMAIL_SMTP_KEY = 'action_mailer_smtp',
+    ESIGN_CERTS_KEY = 'esign_certs',
+    APP_URL_KEY = 'app_url',
+    WEBHOOK_URL_KEY = 'webhook_url'
+  ].freeze
 
   belongs_to :account
 
+  validates :key, inclusion: { in: CONFIG_KEYS }
+
   encrypts :value
 
   serialize :value, JSON

app/models/user.rb

@@ -40,7 +40,9 @@
 #  fk_rails_...  (account_id => accounts.id)
 #
 class User < ApplicationRecord
-  ROLES = %w[admin].freeze
+  ROLES = [
+    ADMIN_ROLE = 'admin'
+  ].freeze
 
   EMAIL_REGEXP = /[^@,\s]+@[^@,\s]+/
 
@@ -51,10 +53,11 @@ class User < ApplicationRecord
   devise :database_authenticatable, :recoverable, :rememberable, :validatable, :trackable
   devise :registerable, :omniauthable, omniauth_providers: [:google_oauth2] if Docuseal.multitenant?
 
-  attribute :role, :string, default: 'admin'
+  attribute :role, :string, default: ADMIN_ROLE
   attribute :uuid, :string, default: -> { SecureRandom.uuid }
 
   scope :active, -> { where(deleted_at: nil) }
+  scope :admins, -> { where(role: ADMIN_ROLE) }
 
   def access_token
     super || build_access_token.tap(&:save!)