Adjust BufferUpdatesController's authorization (#4070)

* Add back validation and add test

* Move article_admin?

* Adjust Buffer policy

* Create buffer_update_policy_spec

app/controllers/internal/buffer_updates_controller.rb

@@ -1,8 +1,8 @@
 class Internal::BufferUpdatesController < Internal::ApplicationController
   skip_before_action :authorize_admin # Instead, specific admin via authorize([:internal, Article])
-  before_action
+
   def create
-    raise unless current_user.has_role?(:single_resource_admin, Article) || current_user.has_role?(:super_admin) || current_user.has_role?(:admin) 
+    authorize([:internal, BufferUpdate])
     article_id = params[:article_id]
     article = Article.find(article_id) if article_id.present?
     fb_post = params[:fb_post]
@@ -26,7 +26,7 @@ class Internal::BufferUpdatesController < Internal::ApplicationController
   end
 
   def update
-    raise unless current_user.has_role?(:single_resource_admin, Article) || current_user.has_role?(:super_admin) || current_user.has_role?(:admin) 
+    authorize([:internal, BufferUpdate])
     BufferUpdate.upbuff!(params[:id], current_user.id, params[:body_text], params[:status])
     render body: nil
   end

app/models/article.rb

@@ -6,6 +6,7 @@ class Article < ApplicationRecord
   include Reactable
 
   acts_as_taggable_on :tags
+  resourcify
 
   attr_accessor :publish_under_org
   attr_writer :series

app/models/buffer_update.rb

@@ -1,4 +1,6 @@
 class BufferUpdate < ApplicationRecord
+  resourcify
+
   belongs_to :article
   validate :validate_body_text_recent_uniqueness
   validates :status, inclusion: { in: %w[pending sent_direct confirmed dismissed] }

app/models/role.rb

@@ -4,6 +4,10 @@ class Role < ApplicationRecord
   belongs_to :resource,
              polymorphic: true, optional: true
 
+  validates :resource_type,
+            inclusion: { in: Rolify.resource_types },
+            allow_nil: true
+
   validates :name,
             inclusion: {
               in: %w[

app/policies/application_policy.rb

@@ -63,10 +63,6 @@ class ApplicationPolicy
     user.has_role?(:super_admin) || user.has_role?(:admin)
   end
 
-  def article_admin?
-    user.has_role?(:single_resource_admin, Article) || user.has_role?(:super_admin) || user.has_role?(:admin)
-  end
-
   def user_admin?
     user.has_role?(:super_admin)
   end

app/policies/internal/article_policy.rb

@@ -10,4 +10,10 @@ class Internal::ArticlePolicy < ApplicationPolicy
   def update?
     article_admin?
   end
+
+  private
+
+  def article_admin?
+    user.has_role?(:single_resource_admin, Article) || user.has_role?(:super_admin) || user.has_role?(:admin)
+  end
 end

app/policies/internal/buffer_update_policy.rb

@@ -1,11 +1,15 @@
 class Internal::BufferUpdatePolicy < ApplicationPolicy
   def create?
-    return true
-    article_admin?
+    buffer_admin? || minimal_admin?
   end
 
   def update?
-    return true
-    article_admin?
+    buffer_admin? || minimal_admin?
+  end
+
+  private
+
+  def buffer_admin?
+    user.has_role?(:single_resource_admin, BufferUpdate)
   end
 end

spec/models/role_spec.rb

@@ -0,0 +1,7 @@
+require "rails_helper"
+
+RSpec.describe Role, type: :model do
+  it { is_expected.to belong_to(:resource).optional }
+  it { is_expected.to validate_inclusion_of(:resource_type).in_array(Rolify.resource_types) }
+  it { is_expected.to validate_inclusion_of(:name).in_array(%w[super_admin admin single_resource_admin tech_admin tag_moderator trusted banned warned workshop_pass chatroom_beta_tester comment_banned pro podcast_admin]) }
+end

spec/policies/internal/buffer_update_policy_spec.rb

@@ -0,0 +1,29 @@
+require "rails_helper"
+
+RSpec.describe Internal::BufferUpdatePolicy do
+  subject { described_class.new(user, BufferUpdate) }
+
+  let(:user) { build_stubbed(:user) }
+
+  context "when regular user" do
+    it { is_expected.to forbid_actions(%i[create update]) }
+  end
+
+  context "when user is permission to update buffers" do
+    before { user.add_role(:single_resource_admin, BufferUpdate) }
+
+    it { is_expected.to permit_actions(%i[create update]) }
+  end
+
+  context "when user is an admin" do
+    before { user.add_role(:admin) }
+
+    it { is_expected.to permit_actions(%i[create update]) }
+  end
+
+  context "when user is a super_admin" do
+    before { user.add_role(:super_admin) }
+
+    it { is_expected.to permit_actions(%i[create update]) }
+  end
+end