maverick/docbrown
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Ensuring users can preview already published posts (#17123)

Browse source 
Prior to this commit

This would have been a bug, if someone had:

1. Toggled on the :limit_post_creation_to_admins feature flag
2. Wasn't an admin
3. Already had a published post
4. Went to edit the post and attempted to preview it

Related to the following issues:

- forem/forem#16908
- forem/forem#16944
- forem/forem#16837
- forem/forem#16942
This commit is contained in:
Jeremy Friesen 2022-04-05 12:31:02 -04:00 • committed by GitHub
parent 78933d0636
commit 3c1206cf8f
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 28 additions and 26 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
app/policies/article_policy.rb
View file

@ -168,10 +168,10 @@ class ArticlePolicy < ApplicationPolicy
alias edit? update?
# [@jeremyf] I made a decision to compress preview? into create? However, someone editing a post
# should also be able to preview? Perhaps it would make sense to be "preview? is create? ||
# update?".
alias preview? create?
# The ArticlesController#preview method is very complicated but aspirationally, we want to ensure
# that someone can preview an article of their if they already have a published article or they
# can create new ones.
alias preview? has_existing_articles_or_can_create_new_ones?
def permitted_attributes
%i[title body_html body_markdown main_image published canonical_url

46
spec/policies/article_policy_spec.rb
View file

@ -51,7 +51,7 @@ RSpec.describe ArticlePolicy do
it { is_expected.to be_truthy }
end
%i[create? new? preview?].each do |method_name|
%i[create? new?].each do |method_name|
describe "##{method_name}" do
let(:policy_method) { method_name }
@ -63,32 +63,34 @@ RSpec.describe ArticlePolicy do
end
end
describe "#has_existing_articles_or_can_create_new_ones?" do
let(:policy_method) { :has_existing_articles_or_can_create_new_ones? }
%i[preview? has_existing_articles_or_can_create_new_ones?].each do |method_name|
describe method_name.to_s do
let(:policy_method) { method_name }
it_behaves_like "permitted roles", to: %i[anyone], limit_post_creation_to_admins?: false
it_behaves_like "permitted roles", to: %i[super_admin admin], limit_post_creation_to_admins?: true
it_behaves_like "disallowed roles", to: %i[anyone], limit_post_creation_to_admins?: true
it_behaves_like "permitted roles", to: %i[anyone], limit_post_creation_to_admins?: false
it_behaves_like "permitted roles", to: %i[super_admin admin], limit_post_creation_to_admins?: true
it_behaves_like "disallowed roles", to: %i[anyone], limit_post_creation_to_admins?: true
context "when user has published articles" do
before do
create(:article, published: true, user: user)
context "when user has published articles" do
before do
create(:article, published: true, user: user)
end
# Below are two scenarios: one with limit_post_creation_to_admins? as true and the other as
# limit_post_creation_to_admins? as false. In both cases, when the user has published
# articles, it doesn't matter if they can create an article or not, the
# `has_existing_articles_or_can_create_new_ones?` should return true (which is what the
# "permitted roles" shared spec verifies).
it_behaves_like "permitted roles", to: %i[anyone], limit_post_creation_to_admins?: false
it_behaves_like "permitted roles", to: %i[anyone], limit_post_creation_to_admins?: true
end
# Below are two scenarios: one with limit_post_creation_to_admins? as true and the other as
# limit_post_creation_to_admins? as false. In both cases, when the user has published
# articles, it doesn't matter if they can create an article or not, the
# `has_existing_articles_or_can_create_new_ones?` should return true (which is what the
# "permitted roles" shared spec verifies).
it_behaves_like "permitted roles", to: %i[anyone], limit_post_creation_to_admins?: false
it_behaves_like "permitted roles", to: %i[anyone], limit_post_creation_to_admins?: true
end
context "when user has no published articles" do
before { user.articles.delete_all }
context "when user has no published articles" do
before { user.articles.delete_all }
it_behaves_like "permitted roles", to: %i[anyone], limit_post_creation_to_admins?: false
it_behaves_like "disallowed roles", to: %i[anyone], limit_post_creation_to_admins?: true
it_behaves_like "permitted roles", to: %i[anyone], limit_post_creation_to_admins?: false
it_behaves_like "disallowed roles", to: %i[anyone], limit_post_creation_to_admins?: true
end
end
end