Bullet and access policy fix for HtmlVariant admin page (#19391)

* revert html variants admin page queries

* update specs to test which variants are returned

app/controllers/admin/html_variants_controller.rb

@@ -4,14 +4,17 @@ module Admin
 
     def index
       relation = if params[:state] == "mine"
-                   current_user.html_variants.order(created_at: :desc)
-                 elsif params[:state].present? && params[:state] != "admin"
-                   HtmlVariant.where(published: true, approved: true, group: params[:state]).order(created_at: :desc)
+                   current_user.html_variants
+                 elsif params[:state] == "admin"
+                   HtmlVariant.where(published: true, approved: false)
+                 elsif params[:state].present?
+                   HtmlVariant.where(published: true, approved: true, group: params[:state])
                  else
-                   HtmlVariant.where(published: true, approved: true).order(created_at: :desc)
+                   HtmlVariant.where(published: true, approved: true)
                  end
 
-      @html_variants = relation.includes(:user).page(params[:page]).per(30)
+      relation = relation.includes(:user) unless params[:state] == "mine"
+      @html_variants = relation.order(created_at: :desc).page(params[:page]).per(30)
     end
 
     def show

spec/requests/admin/html_variants_spec.rb

@@ -136,4 +136,76 @@ RSpec.describe "/admin/customization/html_variants" do
       end
     end
   end
+
+  context "with filters" do
+    let(:admin) { create(:user, :super_admin) }
+    let(:other_admin) { create(:user, :admin) }
+
+    before do
+      create(:html_variant, user: admin, name: "Ruby Variant", group: "article_show_below_article_cta",
+                            published: true, approved: true)
+      create(:html_variant, user: other_admin, name: "Python Variant", group: "badge_landing_page", published: true)
+      create(:html_variant, user: admin, name: "Java Variant", group: "campaign")
+      create(:html_variant, user: admin, name: "Linux Variant", group: "campaign", published: true)
+      create(:html_variant, user: other_admin, name: "Go Variant", group: "campaign", published: true, approved: true)
+
+      sign_in admin
+    end
+
+    describe "GET /admin/customization/html_variants" do
+      it "returns only published and approved variants" do
+        get_resource
+        expect(response).to have_http_status(:ok)
+
+        expect(response.body).to include("Ruby Variant")
+        expect(response.body).to include("Go Variant")
+
+        expect(response.body).not_to include("Linux Variant")
+        expect(response.body).not_to include("Python Variant")
+        expect(response.body).not_to include("Java Variant")
+      end
+    end
+
+    describe "GET /admin/customization/html_variants?state=mine" do
+      it "returns all of a user's variants whether published, approved or not" do
+        get admin_html_variants_path, params: { state: "mine" }
+        expect(response).to have_http_status(:ok)
+
+        expect(response.body).to include("Ruby Variant")
+        expect(response.body).to include("Java Variant")
+        expect(response.body).to include("Linux Variant")
+
+        expect(response.body).not_to include("Python Variant")
+        expect(response.body).not_to include("Go Variant")
+      end
+    end
+
+    describe "GET /admin/customization/html_variants?state=admin" do
+      it "returns only published but not approved variants" do
+        get admin_html_variants_path, params: { state: "admin" }
+        expect(response).to have_http_status(:ok)
+
+        expect(response.body).to include("Python Variant")
+        expect(response.body).to include("Linux Variant")
+
+        expect(response.body).not_to include("Ruby Variant")
+        expect(response.body).not_to include("Java Variant")
+        expect(response.body).not_to include("Go Variant")
+      end
+    end
+
+    describe "GET /admin/customization/html_variants?state=[:group]" do
+      it "returns only published and approved variants in the group" do
+        get admin_html_variants_path, params: { state: "campaign" }
+        expect(response).to have_http_status(:ok)
+
+        expect(response.body).to include("Go Variant")
+
+        expect(response.body).not_to include("Ruby Variant")
+        expect(response.body).not_to include("Python Variant")
+        expect(response.body).not_to include("Java Variant")
+        expect(response.body).not_to include("Linux Variant")
+      end
+    end
+  end
 end