From e031fd60ad9ee492fbbda319eaeb213098898d03 Mon Sep 17 00:00:00 2001
From: Jack Jennings <jack@standard-library.com>
Date: Tue, 30 May 2017 06:16:14 -0700
Subject: Move status reblog authorization into policy (#3425)

---
 spec/policies/status_policy_spec.rb | 32 +++++++++++++++++++++++++-------
 1 file changed, 25 insertions(+), 7 deletions(-)

(limited to 'spec/policies')

diff --git a/spec/policies/status_policy_spec.rb b/spec/policies/status_policy_spec.rb
index ee7060b98..b969988e9 100644
--- a/spec/policies/status_policy_spec.rb
+++ b/spec/policies/status_policy_spec.rb
@@ -7,6 +7,20 @@ RSpec.describe StatusPolicy, type: :model do
   let(:alice) { Fabricate(:account, username: 'alice') }
   let(:status) { Fabricate(:status, account: alice) }
 
+  permissions :show?, :reblog? do
+    it 'grants access when no viewer' do
+      expect(subject).to permit(nil, status)
+    end
+
+    it 'denies access when viewer is blocked' do
+      block = Fabricate(:block)
+      status.visibility = :private
+      status.account = block.target_account
+
+      expect(subject).to_not permit(block.account, status)
+    end
+  end
+
   permissions :show? do
     it 'grants access when direct and account is viewer' do
       status.visibility = :direct
@@ -54,17 +68,21 @@ RSpec.describe StatusPolicy, type: :model do
 
       expect(subject).to_not permit(viewer, status)
     end
+  end
 
-    it 'grants access when no viewer' do
-      expect(subject).to permit(nil, status)
+  permissions :reblog? do
+    it 'denies access when private' do
+      viewer = Fabricate(:account)
+      status.visibility = :private
+
+      expect(subject).to_not permit(viewer, status)
     end
 
-    it 'denies access when viewer is blocked' do
-      block = Fabricate(:block)
-      status.visibility = :private
-      status.account = block.target_account
+    it 'denies access when direct' do
+      viewer = Fabricate(:account)
+      status.visibility = :direct
 
-      expect(subject).to_not permit(block.account, status)
+      expect(subject).to_not permit(viewer, status)
     end
   end
 end
-- 
cgit