a40efc6bbd
* Refactoring questions asked of user In this pull request, I'm extracting and normalizing role-based questions asked of the user. Prior to this commit, our codebase has asked two very similar questions of our user model: - `user.has_role?(:admin)` - `user.admin?` In asking `has_role?(:admin)` we are relying on implementation details of the rolify gem. In addition, the `has_role?` question asked throughout controllers or views means that it's harder to create hieararchies of permissions. In favoring `user.admin?` as our question, we can use that indirection as an opportunity to discuss and decide "Should someone with the `:super_admin` role be `user.admin? == true`?" The details of this commit is to do three primary things: 1. Ask the `has_role?` questions in "one place" in the code (e.g. the `Authorizer` module) 2. Extract the role based questions that are on the `User` model and provde backwards compatable delegation. 3. Structure the code so that it's harder to accidentally call `user.has_role?` (e.g., make `User#has_role?` and `User#has_any_role?` private). This is related to #15624 and the updates are informed by discussion in PR #15691. This commit supplants #15691. * Refactoring the liquid tag policy tests * Fixing typo * Bump for travis
86 lines
2.2 KiB
Ruby
86 lines
2.2 KiB
Ruby
require "rails_helper"
|
|
|
|
# rubocop:disable RSpec/PredicateMatcher
|
|
RSpec.describe Authorizer, type: :policy do
|
|
subject(:authorizer) { described_class.for(user: user) }
|
|
|
|
let(:user) { create(:user) }
|
|
|
|
describe "#any_admin?" do
|
|
# This test che
|
|
it "queries the user's roles" do
|
|
# I want to test `expect(authorizer.admin?)` but our rubocop
|
|
# version squaks.
|
|
expect(authorizer.admin?).to be_falsey
|
|
end
|
|
end
|
|
|
|
describe "#administrative_access_to?" do
|
|
subject(:method_call) { authorizer.administrative_access_to?(resource: resource) }
|
|
|
|
let(:resource) { nil }
|
|
|
|
context "when not an admin or super admin and not given a resource" do
|
|
let(:user) { build(:user) }
|
|
|
|
it { is_expected.to be_falsey }
|
|
end
|
|
|
|
context "when an admin and not given a resource" do
|
|
let(:user) { build(:user, :admin) }
|
|
|
|
it { is_expected.to be_truthy }
|
|
end
|
|
|
|
context "when a super_admin and not given a resource" do
|
|
let(:user) { build(:user, :super_admin) }
|
|
|
|
it { is_expected.to be_truthy }
|
|
end
|
|
|
|
context "when given a resource and the user is assigned singular administration" do
|
|
let(:resource) { Article }
|
|
|
|
before do
|
|
user.add_role(:single_resource_admin, resource)
|
|
end
|
|
|
|
it { is_expected.to be_truthy }
|
|
end
|
|
|
|
context "when given a resource and the user is assigned singular administration to another" do
|
|
let(:resource) { Article }
|
|
|
|
before do
|
|
user.add_role(:single_resource_admin, Comment)
|
|
end
|
|
|
|
it { is_expected.to be_falsey }
|
|
end
|
|
end
|
|
|
|
describe "#trusted?" do
|
|
# We don't need a saved user. Let's not require that.
|
|
let(:user) { instance_double(User, id: 123) }
|
|
|
|
it "memoizes the result from rolify" do
|
|
allow(Rails.cache)
|
|
.to receive(:fetch)
|
|
.with("user-#{user.id}/has_trusted_role", expires_in: 200.hours)
|
|
.and_return(false)
|
|
.once
|
|
|
|
2.times { authorizer.trusted? }
|
|
end
|
|
end
|
|
|
|
describe "#vomited_on?" do
|
|
subject(:method_call) { authorizer.vomited_on? }
|
|
|
|
# I included this test because I had mis-copied something and the
|
|
# system broke. This test is my "penance" for pushing up broken
|
|
# code.
|
|
it { is_expected.not_to be_nil }
|
|
end
|
|
end
|
|
# rubocop:enable RSpec/PredicateMatcher
|