From 82167008580d4ba43d45686038dd83d07c85c780 Mon Sep 17 00:00:00 2001
From: Joshua Wehner <joshua@forem.com>
Date: Tue, 26 Sep 2023 16:24:37 +0200
Subject: [PATCH] Trusted user _can_ use moderator comment (#20158)

* Trusted user _can_ use moderator comment

* Update spec to confirm cannot create

* Trusted user is trusted

* Better mod template access
---
 app/controllers/comments_controller.rb         |  2 +-
 app/policies/comment_policy.rb                 |  3 +--
 app/policies/response_template_policy.rb       |  9 +++++----
 spec/policies/comment_policy_spec.rb           |  6 ++++++
 spec/policies/response_template_policy_spec.rb |  8 ++++++++
 spec/requests/response_templates_spec.rb       | 12 ++++++------
 6 files changed, 27 insertions(+), 13 deletions(-)

diff --git a/app/controllers/comments_controller.rb b/app/controllers/comments_controller.rb
index 47f2a59bd..2ad70c09e 100644
--- a/app/controllers/comments_controller.rb
+++ b/app/controllers/comments_controller.rb
@@ -91,7 +91,7 @@ class CommentsController < ApplicationController
     return if rate_limiter.limit_by_action(:comment_creation)
 
     response_template = ResponseTemplate.find(params[:response_template][:id])
-    authorize response_template, :moderator_create?
+    authorize response_template, :use_template_for_moderator_comment?
 
     moderator = User.find(Settings::General.mascot_user_id)
     @comment = Comment.new(permitted_attributes(Comment))
diff --git a/app/policies/comment_policy.rb b/app/policies/comment_policy.rb
index 49c1704ac..4822ef32b 100644
--- a/app/policies/comment_policy.rb
+++ b/app/policies/comment_policy.rb
@@ -40,8 +40,7 @@ class CommentPolicy < ApplicationPolicy
   end
 
   def moderator_create?
-    # NOTE: Here, when we say "moderator", we mean "tag_moderator"
-    user_moderator? || user_any_admin?
+    Authorizer.for(user: user).accesses_mod_response_templates?
   end
 
   def hide?
diff --git a/app/policies/response_template_policy.rb b/app/policies/response_template_policy.rb
index f91c505e2..69c4efcfb 100644
--- a/app/policies/response_template_policy.rb
+++ b/app/policies/response_template_policy.rb
@@ -20,7 +20,7 @@ class ResponseTemplatePolicy < ApplicationPolicy
   end
 
   def moderator_index?
-    user_moderator?
+    user_moderator? || user_trusted?
   end
 
   alias create? index?
@@ -30,9 +30,10 @@ class ResponseTemplatePolicy < ApplicationPolicy
   end
 
   # comes from comments_controller
-  def moderator_create?
-    user_moderator? && mod_comment?
+  def use_template_for_moderator_comment?
+    mod_comment? && (user_moderator? || user_trusted?)
   end
+  alias moderator_create? use_template_for_moderator_comment?
 
   def modify?
     if user_owner?
@@ -46,7 +47,7 @@ class ResponseTemplatePolicy < ApplicationPolicy
   alias destroy? modify?
 
   def permitted_attributes_for_create
-    if user_trusted?
+    if user_moderator?
       PERMITTED_ATTRIBUTES + [:type_of]
     else
       PERMITTED_ATTRIBUTES
diff --git a/spec/policies/comment_policy_spec.rb b/spec/policies/comment_policy_spec.rb
index 4e17535fd..b52a7e74a 100644
--- a/spec/policies/comment_policy_spec.rb
+++ b/spec/policies/comment_policy_spec.rb
@@ -83,6 +83,12 @@ RSpec.describe CommentPolicy, type: :policy do
           .for_action(:moderator_create)
       end
     end
+
+    context "when user is trusted" do
+      before { user.add_role(:trusted) }
+
+      it { is_expected.to permit_actions(%i[moderator_create]) }
+    end
   end
 
   context "when user is the author" do
diff --git a/spec/policies/response_template_policy_spec.rb b/spec/policies/response_template_policy_spec.rb
index 6feedf59d..62a93db2e 100644
--- a/spec/policies/response_template_policy_spec.rb
+++ b/spec/policies/response_template_policy_spec.rb
@@ -56,4 +56,12 @@ RSpec.describe ResponseTemplatePolicy, type: :policy do
 
     it { is_expected.to permit_actions(%i[moderator_index create moderator_create update destroy]) }
   end
+
+  context "when user is trusted" do
+    let(:user) { create(:user, :trusted) }
+    let(:response_template) { create(:response_template, type_of: "mod_comment", user: nil) }
+
+    it { is_expected.to permit_actions(%i[moderator_index moderator_create]) }
+    it { is_expected.not_to permit_actions(%i[create update destroy]) }
+  end
 end
diff --git a/spec/requests/response_templates_spec.rb b/spec/requests/response_templates_spec.rb
index 0e9b0850e..352ca32d9 100644
--- a/spec/requests/response_templates_spec.rb
+++ b/spec/requests/response_templates_spec.rb
@@ -197,7 +197,7 @@ RSpec.describe "ResponseTemplate" do
         expect(response_template.type_of).to eq "personal_comment"
       end
 
-      it "successfully creates a mod_comment response template" do
+      it "**cannot** create a mod_comment response template" do
         post response_templates_path, params: {
           response_template: {
             title: attributes[:title],
@@ -206,11 +206,11 @@ RSpec.describe "ResponseTemplate" do
           }
         }
 
-        response_template = ResponseTemplate.last
-        expect(response_template.user_id).to be_nil
-        expect(response_template.title).to eq attributes[:title]
-        expect(response_template.content).to eq attributes[:content]
-        expect(response_template.type_of).to eq "mod_comment"
+        expect(ResponseTemplate.count).to be_zero
+        expect(response).to have_http_status(:redirect)
+
+        expect(response.redirect_url).to include user_settings_path(tab: "response-templates",
+                                                                    id: nil)
       end
 
       it "redirects to the edit page upon success" do