Admin access for spammers profiles and articles (#20721)

* Allow admins to visit spammers profiles and articles pages

* Added spam label to user profile and articles

* Unset cache control headers when providing admin access to spam content

* Removed unused comment

app/controllers/concerns/caching_headers.rb

@@ -37,6 +37,13 @@ module CachingHeaders
     )
   end
 
+  def unset_cache_control_headers
+    RequestStore.store[:edge_caching_in_place] = false
+    response.headers["Cache-Control"] = nil
+    response.headers["X-Accel-Expires"] = nil
+    response.headers["Surrogate-Control"] = nil
+  end
+
   # Sets Surrogate-Key HTTP header with one or more keys strips session data
   # from the request.
   def set_surrogate_key_header(*surrogate_keys)

app/controllers/stories_controller.rb

@@ -50,6 +50,14 @@ class StoriesController < ApplicationController
 
   private
 
+  # for spam content we need to remove cache control headers to access current_user to check admin access
+  # so that admins could have access to spam articles and profiles
+  def check_admin_access
+    unset_cache_control_headers if user_signed_in?
+    is_admin = user_signed_in? && current_user&.any_admin?
+    not_found unless is_admin
+  end
+
   def set_user_limit
     @user_limit = 50
   end
@@ -185,7 +193,9 @@ class StoriesController < ApplicationController
     end
     not_found if @user.username.include?("spam_") && @user.decorate.fully_banished?
     not_found unless @user.registered
-    not_found if @user.spam?
+
+    check_admin_access if @user.spam?
+
     if !user_signed_in? && (@user.suspended? && @user.has_no_published_content?)
       not_found
     end
@@ -264,7 +274,8 @@ class StoriesController < ApplicationController
   def assign_article_show_variables
     not_found if permission_denied?
     not_found unless @article.user
-    not_found if @article.user.spam?
+
+    check_admin_access if @article.user.spam?
 
     @pinned_article_id = PinnedArticle.id
 

app/views/articles/show.html.erb

@@ -122,6 +122,9 @@
                 </div>
                 <div class="pl-3 flex-1">
                   <a href="/<%= @user.username %>" class="crayons-link fw-bold"><%= @user.name %></a>
+                  <% if @user.spam? %>
+                    <span class="c-indicator c-indicator--danger">Spam</span>
+                  <% end %>
                   <% if @organization %>
                     <%= t("views.articles.for_org_html",
                           start: tag("span", { class: "color-base-60" }, true),

app/views/users/show.html.erb

@@ -32,8 +32,8 @@
           </span>
 
           <div class="profile-header__actions">
-              <button id="user-follow-butt" class="crayons-btn whitespace-nowrap follow-action-button follow-user" data-info='<%= DataInfo.to_json(object: @user) %>'><%= t("views.users.follow") %></button>
-        <div class="profile-dropdown ml-2 s:relative hidden" data-username="<%= @user.username %>">
+            <button id="user-follow-butt" class="crayons-btn whitespace-nowrap follow-action-button follow-user" data-info='<%= DataInfo.to_json(object: @user) %>'><%= t("views.users.follow") %></button>
+            <div class="profile-dropdown ml-2 s:relative hidden" data-username="<%= @user.username %>">
               <button id="user-profile-dropdown" aria-expanded="false" aria-controls="user-profile-dropdownmenu" aria-haspopup="true" class="crayons-btn crayons-btn--ghost-dimmed crayons-btn--icon">
                 <%= crayons_icon_tag("overflow-horizontal", class: "dropdown-icon", title: t("views.users.dropdown")) %>
               </button>
@@ -61,6 +61,9 @@
           <div class="items-center js-username-container mb-2">
             <h1 class="crayons-title lh-tight">
               <%= @user.name %>
+              <% if @user.spam? %>
+                &nbsp;<span class="c-indicator c-indicator--danger">Spam</span>
+              <% end %>
             </h1>
           </div>
 

spec/requests/articles/articles_show_spec.rb

@@ -2,6 +2,7 @@ require "rails_helper"
 
 RSpec.describe "ArticlesShow" do
   let(:user) { create(:user) }
+  let(:admin_user) { create(:user, :admin) }
   let(:article) { create(:article, user: user, published: true, organization: organization) }
   let(:organization) { create(:organization) }
   let(:doc) { Nokogiri::HTML(response.body) }
@@ -146,6 +147,13 @@ RSpec.describe "ArticlesShow" do
         get article.path
       end.to raise_error(ActiveRecord::RecordNotFound)
     end
+
+    it "renders successfully for admins", :aggregate_failures do
+      sign_in admin_user
+      get article.path
+      expect(response).to be_successful
+      expect(response.body).to include("Spam")
+    end
   end
 
   context "when user signed in" do

spec/requests/user/user_profile_spec.rb

@@ -223,10 +223,11 @@ RSpec.describe "UserProfiles" do
         expect { get spam_user.path }.to raise_error(ActiveRecord::RecordNotFound)
       end
 
-      it "renders spammer users for admins", skip: "to implement later" do
+      it "renders spammer users for admins", :aggregate_failures do
         sign_in admin_user
         get spam_user.path
         expect(response).to be_successful
+        expect(response.body).to include("Spam")
       end
 
       context "when a user is signed in" do