Trusted user _can_ use moderator comment (#20158)

* Trusted user _can_ use moderator comment

* Update spec to confirm cannot create

* Trusted user is trusted

* Better mod template access

app/controllers/comments_controller.rb

@@ -91,7 +91,7 @@ class CommentsController < ApplicationController
     return if rate_limiter.limit_by_action(:comment_creation)
 
     response_template = ResponseTemplate.find(params[:response_template][:id])
-    authorize response_template, :moderator_create?
+    authorize response_template, :use_template_for_moderator_comment?
 
     moderator = User.find(Settings::General.mascot_user_id)
     @comment = Comment.new(permitted_attributes(Comment))

app/policies/comment_policy.rb

@@ -40,8 +40,7 @@ class CommentPolicy < ApplicationPolicy
   end
 
   def moderator_create?
-    # NOTE: Here, when we say "moderator", we mean "tag_moderator"
-    user_moderator? || user_any_admin?
+    Authorizer.for(user: user).accesses_mod_response_templates?
   end
 
   def hide?

app/policies/response_template_policy.rb

@@ -20,7 +20,7 @@ class ResponseTemplatePolicy < ApplicationPolicy
   end
 
   def moderator_index?
-    user_moderator?
+    user_moderator? || user_trusted?
   end
 
   alias create? index?
@@ -30,9 +30,10 @@ class ResponseTemplatePolicy < ApplicationPolicy
   end
 
   # comes from comments_controller
-  def moderator_create?
-    user_moderator? && mod_comment?
+  def use_template_for_moderator_comment?
+    mod_comment? && (user_moderator? || user_trusted?)
   end
+  alias moderator_create? use_template_for_moderator_comment?
 
   def modify?
     if user_owner?
@@ -46,7 +47,7 @@ class ResponseTemplatePolicy < ApplicationPolicy
   alias destroy? modify?
 
   def permitted_attributes_for_create
-    if user_trusted?
+    if user_moderator?
       PERMITTED_ATTRIBUTES + [:type_of]
     else
       PERMITTED_ATTRIBUTES

spec/policies/comment_policy_spec.rb

@@ -83,6 +83,12 @@ RSpec.describe CommentPolicy, type: :policy do
           .for_action(:moderator_create)
       end
     end
+
+    context "when user is trusted" do
+      before { user.add_role(:trusted) }
+
+      it { is_expected.to permit_actions(%i[moderator_create]) }
+    end
   end
 
   context "when user is the author" do

spec/policies/response_template_policy_spec.rb

@@ -56,4 +56,12 @@ RSpec.describe ResponseTemplatePolicy, type: :policy do
 
     it { is_expected.to permit_actions(%i[moderator_index create moderator_create update destroy]) }
   end
+
+  context "when user is trusted" do
+    let(:user) { create(:user, :trusted) }
+    let(:response_template) { create(:response_template, type_of: "mod_comment", user: nil) }
+
+    it { is_expected.to permit_actions(%i[moderator_index moderator_create]) }
+    it { is_expected.not_to permit_actions(%i[create update destroy]) }
+  end
 end

spec/requests/response_templates_spec.rb

@@ -197,7 +197,7 @@ RSpec.describe "ResponseTemplate" do
         expect(response_template.type_of).to eq "personal_comment"
       end
 
-      it "successfully creates a mod_comment response template" do
+      it "**cannot** create a mod_comment response template" do
         post response_templates_path, params: {
           response_template: {
             title: attributes[:title],
@@ -206,11 +206,11 @@ RSpec.describe "ResponseTemplate" do
           }
         }
 
-        response_template = ResponseTemplate.last
-        expect(response_template.user_id).to be_nil
-        expect(response_template.title).to eq attributes[:title]
-        expect(response_template.content).to eq attributes[:content]
-        expect(response_template.type_of).to eq "mod_comment"
+        expect(ResponseTemplate.count).to be_zero
+        expect(response).to have_http_status(:redirect)
+
+        expect(response.redirect_url).to include user_settings_path(tab: "response-templates",
+                                                                    id: nil)
       end
 
       it "redirects to the edit page upon success" do