From e58a2ebfb642255273458c7cdc6657d2f0a45b94 Mon Sep 17 00:00:00 2001 From: Armin Kirchner Date: Mon, 14 Jul 2025 16:23:13 +0200 Subject: [PATCH 1/5] test: Add tests for comment policy Related to #2715 --- app/policies/comment_policy.rb | 2 +- spec/policies/comment_policy_spec.rb | 44 ++++++++++++++++++++++++++++ 2 files changed, 45 insertions(+), 1 deletion(-) create mode 100644 spec/policies/comment_policy_spec.rb diff --git a/app/policies/comment_policy.rb b/app/policies/comment_policy.rb index 64b221d73..6a8f84134 100644 --- a/app/policies/comment_policy.rb +++ b/app/policies/comment_policy.rb @@ -9,7 +9,7 @@ def show? everyone end - %i[new? destroy? update? edit?].each do |action| + %i[destroy? update? edit?].each do |action| define_method(action) { admin? || author? || teacher_in_study_group? } end diff --git a/spec/policies/comment_policy_spec.rb b/spec/policies/comment_policy_spec.rb new file mode 100644 index 000000000..b561e9eb6 --- /dev/null +++ b/spec/policies/comment_policy_spec.rb @@ -0,0 +1,44 @@ +# frozen_string_literal: true + +require 'rails_helper' + +RSpec.describe CommentPolicy do + let(:user_types) { %i[learner teacher admin] } + + permissions :create?, :show?, :index? do + let(:comment) { build_stubbed(:comment) } + + it 'grants access to all user types' do + user_types.each do |user_type| + expect(described_class).to permit(build_stubbed(user_type), comment) + end + end + end + + permissions :destroy?, :update?, :edit? do + let(:comment) { build_stubbed(:comment) } + + it 'grants access to the author' do + expect(described_class).to permit(comment.user, comment) + end + + it 'grants no access to other learners' do + expect(described_class).not_to permit(build_stubbed(:learner), comment) + end + + it 'grants no access to teachers not in study group' do + expect(described_class).not_to permit(build_stubbed(:teacher), comment) + end + + it 'grants access to teachers in study group' do + comment = create(:comment) + teacher = create(:teacher, study_groups: [comment.submission.study_group]) + + expect(described_class).to permit(teacher, comment) + end + + it 'grants access to admins' do + expect(described_class).to permit(build_stubbed(:admin), comment) + end + end +end From 74f394ae162993554d0332735f4bccfcb417822e Mon Sep 17 00:00:00 2001 From: Armin Kirchner Date: Thu, 17 Jul 2025 13:04:11 +0200 Subject: [PATCH 2/5] Update spec/policies/comment_policy_spec.rb Co-authored-by: Sebastian Serth --- spec/policies/comment_policy_spec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spec/policies/comment_policy_spec.rb b/spec/policies/comment_policy_spec.rb index b561e9eb6..0d69d2d49 100644 --- a/spec/policies/comment_policy_spec.rb +++ b/spec/policies/comment_policy_spec.rb @@ -26,7 +26,7 @@ expect(described_class).not_to permit(build_stubbed(:learner), comment) end - it 'grants no access to teachers not in study group' do + it 'does not grant access to teachers not in the same study group' do expect(described_class).not_to permit(build_stubbed(:teacher), comment) end From 424b8470b7a23356cbb5fc729feb47d31300077b Mon Sep 17 00:00:00 2001 From: Armin Kirchner Date: Thu, 17 Jul 2025 13:04:23 +0200 Subject: [PATCH 3/5] Update spec/policies/comment_policy_spec.rb Co-authored-by: Sebastian Serth --- spec/policies/comment_policy_spec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spec/policies/comment_policy_spec.rb b/spec/policies/comment_policy_spec.rb index 0d69d2d49..fc0e08902 100644 --- a/spec/policies/comment_policy_spec.rb +++ b/spec/policies/comment_policy_spec.rb @@ -30,7 +30,7 @@ expect(described_class).not_to permit(build_stubbed(:teacher), comment) end - it 'grants access to teachers in study group' do + it 'grants access to teachers in the same study group' do comment = create(:comment) teacher = create(:teacher, study_groups: [comment.submission.study_group]) From 16246f654ed71f92e16334a7f2c316383a65576d Mon Sep 17 00:00:00 2001 From: Armin Kirchner Date: Thu, 17 Jul 2025 13:15:35 +0200 Subject: [PATCH 4/5] Unify wording to use grants ... --- spec/policies/comment_policy_spec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spec/policies/comment_policy_spec.rb b/spec/policies/comment_policy_spec.rb index fc0e08902..9b07414f6 100644 --- a/spec/policies/comment_policy_spec.rb +++ b/spec/policies/comment_policy_spec.rb @@ -26,7 +26,7 @@ expect(described_class).not_to permit(build_stubbed(:learner), comment) end - it 'does not grant access to teachers not in the same study group' do + it 'grants no access to teachers not in the same study group' do expect(described_class).not_to permit(build_stubbed(:teacher), comment) end From b91d16ae962b4a65762dbddacefea43ead536b51 Mon Sep 17 00:00:00 2001 From: Armin Kirchner Date: Thu, 17 Jul 2025 14:52:04 +0200 Subject: [PATCH 5/5] Changed to does not grant access in description --- spec/policies/comment_policy_spec.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/spec/policies/comment_policy_spec.rb b/spec/policies/comment_policy_spec.rb index 9b07414f6..699c36550 100644 --- a/spec/policies/comment_policy_spec.rb +++ b/spec/policies/comment_policy_spec.rb @@ -22,11 +22,11 @@ expect(described_class).to permit(comment.user, comment) end - it 'grants no access to other learners' do + it 'does not grant access to other learners' do expect(described_class).not_to permit(build_stubbed(:learner), comment) end - it 'grants no access to teachers not in the same study group' do + it 'does not grant access to teachers not in the same study group' do expect(described_class).not_to permit(build_stubbed(:teacher), comment) end