Change requirement for response_template (#18601)

app/policies/response_template_policy.rb

@@ -25,15 +25,21 @@ class ResponseTemplatePolicy < ApplicationPolicy
 
   alias create? index?
 
+  def admin_create?
+    user.admin? || user.super_moderator?
+  end
+
   # comes from comments_controller
   def moderator_create?
     user_moderator? && mod_comment?
   end
 
   def modify?
-    return true if mod_comment? && user_trusted?
-
-    user_owner?
+    if user_owner?
+      true
+    else
+      mod_comment? && (user.admin? || user.super_moderator?)
+    end
   end
 
   alias update? modify?

app/views/users/_response_template.html.erb

@@ -4,10 +4,12 @@
       <%= response_template.title %>
     </div>
     <div class="flex">
-      <%= form_with url: response_template_path(response_template.id), method: :delete, local: true, html: { onsubmit: "return confirm('#{t('views.settings.extensions.comment.confirm', template: response_template.title)}');" } do %>
-        <button type="submit" class="crayons-btn crayons-btn--secondary"><%= t("views.settings.extensions.comment.remove") %></button>
+      <% if policy(response_template).modify? %>
+        <%= form_with url: response_template_path(response_template.id), method: :delete, local: true, html: { onsubmit: "return confirm('#{t('views.settings.extensions.comment.confirm', template: response_template.title)}');" } do %>
+          <button type="submit" class="crayons-btn crayons-btn--secondary"><%= t("views.settings.extensions.comment.remove") %></button>
+        <% end %>
+        <a class="crayons-btn crayons-btn--secondary ml-2" href="/settings/response-templates/<%= response_template.id %>" role="button"><%= t("views.settings.extensions.comment.edit") %></a>
       <% end %>
-      <a class="crayons-btn crayons-btn--secondary ml-2" href="/settings/response-templates/<%= response_template.id %>" role="button"><%= t("views.settings.extensions.comment.edit") %></a>
     </div>
   </div>
 </div>

app/views/users/_response_templates.html.erb

@@ -55,7 +55,7 @@
         <%= f.text_area :content, value: content, class: "crayons-textfield" %>
       </div>
 
-      <% if current_user.has_trusted_role? && @response_template.new_record? %>
+      <% if policy(ResponseTemplate).admin_create? && @response_template.new_record? %>
         <div class="crayons-field">
           <fieldset>
             <legend class="screen-reader-only">Template type</legend>

spec/policies/response_template_policy_spec.rb

@@ -39,8 +39,8 @@ RSpec.describe ResponseTemplatePolicy, type: :policy do
     let(:user) { create(:user, :tag_moderator) }
     let(:response_template) { create(:response_template, type_of: "mod_comment", user: nil) }
 
-    it { is_expected.to permit_actions(%i[moderator_index create moderator_create update destroy]) }
-    it { is_expected.to forbid_actions(%i[admin_index]) }
+    it { is_expected.to permit_actions(%i[moderator_index create moderator_create]) }
+    it { is_expected.to forbid_actions(%i[admin_index update destroy]) }
   end
 
   context "when user is an admin" do
@@ -49,4 +49,11 @@ RSpec.describe ResponseTemplatePolicy, type: :policy do
 
     it { is_expected.to permit_actions(%i[moderator_index create moderator_create admin_index update destroy]) }
   end
+
+  context "when user is an super_moderator" do
+    let(:user) { create(:user, :super_moderator) }
+    let(:response_template) { create(:response_template, type_of: "mod_comment", user: nil) }
+
+    it { is_expected.to permit_actions(%i[moderator_index create moderator_create update destroy]) }
+  end
 end

spec/requests/response_templates_spec.rb

@@ -258,6 +258,19 @@ RSpec.describe "ResponseTemplate", type: :request do
 
       let(:response_template) { create :response_template, user: nil, type_of: "mod_comment" }
 
+      it "does not permit the action" do
+        title = "something else"
+        expect do
+          patch response_template_path(response_template.id), params: { response_template: { title: title } }
+        end.to raise_error(Pundit::NotAuthorizedError)
+      end
+    end
+
+    context "when signed-in as super_moderator user updating a mod_comment template" do
+      before { sign_in create(:user, :super_moderator) }
+
+      let(:response_template) { create :response_template, user: nil, type_of: "mod_comment" }
+
       it "successfully updates the response template" do
         title = "something else"
         patch response_template_path(response_template.id), params: { response_template: { title: title } }