[deploy] Fix showing unpublished article edit link (#9511)

* Fix showing unpublished article edit link

* Change if clauses to surround only edit link

* Fix: use ArticlePolicy.update? instead of checking article update authority manually

app/views/articles/show.html.erb

@@ -95,7 +95,9 @@
       <% if !@article.published %>
         <div class="crayons-notice crayons-notice--danger mb-4">
           <strong>Unpublished Post.</strong> This URL is public but secret, so share at your own discretion.
-          <a href="<%= @article.path %>/edit" class="fw-bold">Click to edit</a>.
+          <% if user_signed_in? && policy(@article.object).update? %>
+            <a href="<%= @article.path %>/edit" class="fw-bold">Click to edit</a>.
+          <% end %>
         </div>
       <% end %>
 

spec/system/articles/user_visits_an_article_spec.rb

@@ -118,4 +118,51 @@ RSpec.describe "Views an article", type: :system do
       # rubocop:enable RSpec/ExampleLength
     end
   end
+
+  describe "when an article is not published" do
+    let(:article) { create(:article, user: article_user, published: false) }
+    let(:article_path) { article.path + query_params }
+    let(:href) { "#{article.path}/edit" }
+    let(:link_text) { "Click to edit" }
+
+    context "with the article password, and the logged-in user is authorized to update the article" do
+      let(:query_params) { "?preview=#{article.password}" }
+      let(:article_user) { user }
+
+      it "shows the article edit link" do
+        visit article_path
+        expect(page).to have_link(link_text, href: href)
+      end
+    end
+
+    context "with the article password, and the logged-in user is not authorized to update the article" do
+      let(:query_params) { "?preview=#{article.password}" }
+      let(:article_user) { create(:user) }
+
+      it "does not the article edit link" do
+        visit article_path
+        expect(page).not_to have_link(link_text, href: href)
+      end
+    end
+
+    context "with the article password, and the user is not logged-in" do
+      let(:query_params) { "?preview=#{article.password}" }
+      let(:article_user) { user }
+
+      it "does not the article edit link" do
+        sign_out user
+        visit article_path
+        expect(page).not_to have_link(link_text, href: href)
+      end
+    end
+
+    context "without the article password" do
+      let(:query_params) { "" }
+      let(:article_user) { user }
+
+      it "raises ActiveRecord::RecordNotFound" do
+        expect { visit article_path }.to raise_error(ActiveRecord::RecordNotFound)
+      end
+    end
+  end
 end