conditionally render create post button for admins #16490 (#16606)

* Trigger Build

* WIP - use turbo to render html for create post button

todos and discussion topics
[] add tests (probably gonna be a lot of cypress 😅😭)
[] nominclature & file structure for authorization controller/routes
[] is this "authorizations" namespace approach the best?
[] authorization strategy relies on current user and caching doesn't
like `current_user`

* Use URL helper and not change the policy just yet

* put the turbo frame behind a feature flag

* Trigger Build

* Use URL helper and not change the policy just yet

* :)

* Add some test coverage and use same feature flag for consistency

* rubocop

* more rubocop

* trigger build

* adding a small sleep to see if specs pass 😩

* remove sleep

* disable Turbo session drive

* WIP

* Revert "WIP"

This reverts commit ce838672069fd703122156a0d82e5e6ad5398e0a.

* Moving spec from dashboard to root

With forem/forem#16913 the underlying test broke because we were
redirecting on the dashboard.

Co-authored-by: Jeremy Friesen <jeremy.n.friesen@gmail.com>

app/assets/javascripts/base.js.erb

@@ -4,9 +4,11 @@
 //= require initializePage
 //= require utilities/getImageForLink
 //= require @honeybadger-io/js/dist/browser/honeybadger.js
+//= require @hotwired/turbo
 //= require i18n
 //= require ahoy.js/dist/ahoy.js
 
+Turbo.session.drive = false
 I18n.defaultLocale = 'en';
 I18n.locale = document.body.dataset.locale;
 I18n.translations = JSON.parse(document.getElementById('i18n-translations').dataset.translations);

app/controllers/authorization/articles_controller.rb

@@ -0,0 +1,16 @@
+module Authorization
+  class ArticlesController < ApplicationController
+    include ApplicationHelper
+    layout false
+
+    before_action :authenticate_user!
+    after_action :verify_authorized
+
+    def create_post_button
+      authorize Article, :create?
+      unless FeatureFlag.enabled?(:limit_post_creation_to_admins)
+        render file: "public/404.html", status: :not_found
+      end
+    end
+  end
+end

app/views/authorization/articles/create_post_button.html.erb

@@ -0,0 +1,3 @@
+<turbo-frame id="authorization-articles-create-post-button">
+  <a href="<%= new_path %>" class="c-cta c-cta--branded mr-2 whitespace-nowrap"><%= t("views.main.create_post") %></a>
+</turbo-frame>

app/views/layouts/_top_bar.html.erb

@@ -29,7 +29,12 @@
       </a>
       <% if user_signed_in? %>
         <span class="hidden m:flex ml-auto">
-          <a href="<%= new_path %>" class="c-cta c-cta--branded mr-2 whitespace-nowrap"><%= t("views.main.create_post") %></a>
+          <% if FeatureFlag.enabled?(:limit_post_creation_to_admins) %>
+            <turbo-frame id="authorization-articles-create-post-button" src="<%= authorization_create_post_button_path %>">
+            </turbo-frame>
+          <% else %>
+            <a href="<%= new_path %>" class="c-cta c-cta--branded mr-2 whitespace-nowrap"><%= t("views.main.create_post") %></a>
+          <% end %>
 
           <span class="trusted-visible-block">
             <a id="moderation-link" class="c-link c-link--icon-alone c-link--block mx-1" aria-label="<%= t("views.main.header.moderation.aria_label") %>" href="<%= mod_path %>">

config/routes.rb

@@ -33,6 +33,12 @@ Rails.application.routes.draw do
       draw :listing
     end
 
+    namespace :authorization do
+      scope :articles do
+        get "create_post_button", controller: "articles"
+      end
+    end
+
     namespace :stories, defaults: { format: "json" } do
       resource :feed, only: [:show] do
         resource :pinned_article, only: %w[show update destroy]

package.json

@@ -109,6 +109,7 @@
     "@honeybadger-io/webpack": "^1.5.1",
     "@hotwired/stimulus": "3.0.1",
     "@hotwired/stimulus-webpack-helpers": "1.0.1",
+    "@hotwired/turbo": "^7.1.0",
     "@rails/ujs": "7.0.2",
     "@rails/webpacker": "5.4.3",
     "@reach/combobox": "^0.16.5",

spec/requests/authorization/articles_spec.rb

@@ -0,0 +1,47 @@
+require "rails_helper"
+
+RSpec.describe "Articles", type: :request do
+  let(:user)          { create(:user) }
+  let(:super_admin)   { create(:user, :super_admin) }
+
+  describe "GET /create_post_button" do
+    context "when limit post creation to admins is enabled" do
+      before do
+        FeatureFlag.add("limit_post_creation_to_admins")
+        FeatureFlag.enable("limit_post_creation_to_admins")
+      end
+
+      after { FeatureFlag.remove("limit_post_creation_to_admins") }
+
+      it "returns the Create Post anchor tag for admins" do
+        sign_in super_admin
+        get authorization_create_post_button_path
+        expect(response.body).to include("Create Post")
+      end
+
+      it "raises Pundit::NotAuthorizedError for non admins" do
+        sign_in user
+        expect { get authorization_create_post_button_path }.to raise_error(Pundit::NotAuthorizedError)
+      end
+    end
+
+    context "when limit post creation to admins is disabled" do
+      before do
+        FeatureFlag.add("limit_post_creation_to_admins")
+        FeatureFlag.disable("limit_post_creation_to_admins")
+      end
+
+      after { FeatureFlag.remove("limit_post_creation_to_admins") }
+
+      it "returns a 404", :aggregate_failures do
+        sign_in user
+        get authorization_create_post_button_path
+        expect(response).to have_http_status(:not_found)
+
+        sign_in super_admin
+        get authorization_create_post_button_path
+        expect(response).to have_http_status(:not_found)
+      end
+    end
+  end
+end

spec/requests/root_page_spec.rb

@@ -0,0 +1,31 @@
+require "rails_helper"
+
+RSpec.describe "Homepage", type: :request do
+  let(:user) { create(:user) }
+
+  describe "GET /" do
+    context "when limit post creation to admins" do
+      before { FeatureFlag.add("limit_post_creation_to_admins") }
+
+      after { FeatureFlag.remove("limit_post_creation_to_admins") }
+
+      it "does not render turbo frame when disabled" do
+        FeatureFlag.disable("limit_post_creation_to_admins")
+
+        sign_in user
+        get root_path
+
+        expect(response.body).not_to include("turbo-frame")
+      end
+
+      it "renders turbo frame when enabled" do
+        FeatureFlag.enable("limit_post_creation_to_admins")
+
+        sign_in user
+        get root_path
+
+        expect(response.body).to include("turbo-frame")
+      end
+    end
+  end
+end

yarn.lock

@@ -1527,6 +1527,11 @@
   resolved "https://registry.yarnpkg.com/@hotwired/stimulus/-/stimulus-3.0.1.tgz#141f15645acaa3b133b7c247cad58ae252ffae85"
   integrity sha512-oHsJhgY2cip+K2ED7vKUNd2P+BEswVhrCYcJ802DSsblJFv7mPFVk3cQKvm2vHgHeDVdnj7oOKrBbzp1u8D+KA==
 
+"@hotwired/turbo@^7.1.0":
+  version "7.1.0"
+  resolved "https://registry.yarnpkg.com/@hotwired/turbo/-/turbo-7.1.0.tgz#27e44e0e3dc5bd1d4bda0766d579cf5a14091cd7"
+  integrity sha512-Q8kGjqwPqER+CtpQudbH+3Zgs2X4zb6pBAlr6NsKTXadg45pAOvxI9i4QpuHbwSzR2+x87HUm+rot9F/Pe8rxA==
+
 "@humanwhocodes/config-array@^0.9.2":
   version "0.9.2"
   resolved "https://registry.yarnpkg.com/@humanwhocodes/config-array/-/config-array-0.9.2.tgz#68be55c737023009dfc5fe245d51181bb6476914"