From 33f669a5f851b4095fb6189147ae0fe6f8343d44 Mon Sep 17 00:00:00 2001 From: Jack Jennings Date: Tue, 30 May 2017 13:56:31 -0700 Subject: Add status destroy authorization to policy (#3453) * Add status destroy authorization to policy * Create explicit unreblog status authorization --- spec/policies/status_policy_spec.rb | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) (limited to 'spec/policies') diff --git a/spec/policies/status_policy_spec.rb b/spec/policies/status_policy_spec.rb index 8e85efb8e..bacb8fd9e 100644 --- a/spec/policies/status_policy_spec.rb +++ b/spec/policies/status_policy_spec.rb @@ -4,7 +4,9 @@ require 'pundit/rspec' RSpec.describe StatusPolicy, type: :model do subject { described_class } + let(:admin) { Fabricate(:user, admin: true) } let(:alice) { Fabricate(:account, username: 'alice') } + let(:bob) { Fabricate(:account, username: 'bob') } let(:status) { Fabricate(:status, account: alice) } permissions :show?, :reblog? do @@ -86,4 +88,22 @@ RSpec.describe StatusPolicy, type: :model do expect(subject).to_not permit(viewer, status) end end + + permissions :destroy?, :unreblog? do + it 'grants access when account is deleter' do + expect(subject).to permit(status.account, status) + end + + it 'grants access when account is admin' do + expect(subject).to permit(admin.account, status) + end + + it 'denies access when account is not deleter' do + expect(subject).to_not permit(bob, status) + end + + it 'denies access when no deleter' do + expect(subject).to_not permit(nil, status) + end + end end -- cgit