Allow moderators to hide diary entries and comments

diff --git a/app/abilities/ability.rb b/app/abilities/ability.rb
index d2864e452ab975c06ba98c4d2b6ac221f67ee693..897c3410c2e01858d763eb7b3e593f5e40d6229b 100644 (file)
--- a/app/abilities/ability.rb
+++ b/app/abilities/ability.rb
@@ -44,6 +44,7 @@ class Ability
         can [:account, :go_public, :make_friend, :remove_friend], User
 
         if user.moderator?
+          can [:hide, :hidecomment], DiaryEntry
           can [:index, :show, :resolve, :ignore, :reopen], Issue
           can :create, IssueComment
           can [:new, :create, :edit, :update, :destroy], Redaction
@@ -51,7 +52,7 @@ class Ability
         end
 
         if user.administrator?
-          can [:hide, :hidecomment], [DiaryEntry, DiaryComment]
+          can [:hide, :hidecomment], DiaryEntry
           can [:index, :show, :resolve, :ignore, :reopen], Issue
           can :create, IssueComment
           can [:set_status, :delete, :index], User

diff --git a/app/views/diary_entries/_diary_comment.html.erb b/app/views/diary_entries/_diary_comment.html.erb
index 9ee67534304e2c709582f28c40fc0b1ee5d17f1b..8679f5a08c44fe60fa21bb8e5911241c59ac76b0 100644 (file)
--- a/app/views/diary_entries/_diary_comment.html.erb
+++ b/app/views/diary_entries/_diary_comment.html.erb
@@ -7,7 +7,7 @@
   </p>
 
   <div class="richtext"><%= diary_comment.body.to_html %></div>
-  <% if current_user && current_user.administrator? %>
+  <% if can? :hidecomment, DiaryEntry %>
     <span>
       <%= link_to t(".hide_link"), hide_diary_comment_path(:display_name => diary_comment.diary_entry.user.display_name, :id => diary_comment.diary_entry.id, :comment => diary_comment.id), :method => :post, :data => { :confirm => t(".confirm") } %>
     </span>

diff --git a/app/views/diary_entries/_diary_entry.html.erb b/app/views/diary_entries/_diary_entry.html.erb
index fc1cca66e43fe7cea4217437e7c33d66d64c73cb..0aff1b113ef3c8c2c4b959eae74d00ff2d953356 100644 (file)
--- a/app/views/diary_entries/_diary_entry.html.erb
+++ b/app/views/diary_entries/_diary_entry.html.erb
@@ -37,7 +37,7 @@
       </li>
     <% end %>
 
-    <% if current_user && current_user.administrator? %>
+    <% if can? :hide, DiaryEntry %>
       <li>
         <%= link_to t(".hide_link"), hide_diary_entry_path(:display_name => diary_entry.user.display_name, :id => diary_entry.id), :method => :post, :data => { :confirm => t(".confirm") } %>
       </li>

diff --git a/test/abilities/abilities_test.rb b/test/abilities/abilities_test.rb
index f43b6bf50de811b2f5b5fcc66fdca7d82e99b299..99154b4b72cfaeb79ef35019ed4bdb0293f6c174 100644 (file)
--- a/test/abilities/abilities_test.rb
+++ b/test/abilities/abilities_test.rb
@@ -23,7 +23,6 @@ class GuestAbilityTest < AbilityTest
 
     [:create, :edit, :comment, :subscribe, :unsubscribe, :hide, :hidecomment].each do |action|
       assert ability.cannot?(action, DiaryEntry), "should not be able to #{action} DiaryEntries"
-      assert ability.cannot?(action, DiaryComment), "should not be able to #{action} DiaryEntries"
     end
   end
 
@@ -54,7 +53,6 @@ class UserAbilityTest < AbilityTest
 
     [:hide, :hidecomment].each do |action|
       assert ability.cannot?(action, DiaryEntry), "should not be able to #{action} DiaryEntries"
-      assert ability.cannot?(action, DiaryComment), "should not be able to #{action} DiaryEntries"
     end
 
     [:index, :show, :resolve, :ignore, :reopen].each do |action|
@@ -78,6 +76,10 @@ class ModeratorAbilityTest < AbilityTest
     [:grant, :revoke].each do |action|
       assert ability.cannot?(action, UserRole), "should not be able to #{action} UserRoles"
     end
+
+    [:hide, :hidecomment].each do |action|
+      assert ability.can?(action, DiaryEntry), "should be able to #{action} DiaryEntries"
+    end
   end
 end
 
@@ -87,10 +89,6 @@ class AdministratorAbilityTest < AbilityTest
     [:index, :rss, :show, :comments, :create, :edit, :comment, :subscribe, :unsubscribe, :hide, :hidecomment].each do |action|
       assert ability.can?(action, DiaryEntry), "should be able to #{action} DiaryEntries"
     end
-
-    [:hide, :hidecomment].each do |action|
-      assert ability.can?(action, DiaryComment), "should be able to #{action} DiaryComment"
-    end
   end
 
   test "User Roles permissions for an administrator" do

diff --git a/test/controllers/diary_entries_controller_test.rb b/test/controllers/diary_entries_controller_test.rb
index b1f2216c792e26eb39778be0e738f48982e62e43..b17d974d1f65deb85c9056304c2e672d43115c3f 100644 (file)
--- a/test/controllers/diary_entries_controller_test.rb
+++ b/test/controllers/diary_entries_controller_test.rb
@@ -713,9 +713,9 @@ class DiaryEntriesControllerTest < ActionController::TestCase
 
   def test_hide
     user = create(:user)
+    diary_entry = create(:diary_entry, :user => user)
 
     # Try without logging in
-    diary_entry = create(:diary_entry, :user => user)
     post :hide,
          :params => { :display_name => user.display_name, :id => diary_entry.id }
     assert_response :forbidden
@@ -729,6 +729,17 @@ class DiaryEntriesControllerTest < ActionController::TestCase
     assert_redirected_to :controller => :errors, :action => :forbidden
     assert_equal true, DiaryEntry.find(diary_entry.id).visible
 
+    # Now try as a moderator
+    post :hide,
+         :params => { :display_name => user.display_name, :id => diary_entry.id },
+         :session => { :user => create(:moderator_user) }
+    assert_response :redirect
+    assert_redirected_to :action => :index, :display_name => user.display_name
+    assert_equal false, DiaryEntry.find(diary_entry.id).visible
+
+    # Reset
+    diary_entry.reload.update(:visible => true)
+
     # Finally try as an administrator
     post :hide,
          :params => { :display_name => user.display_name, :id => diary_entry.id },
@@ -740,9 +751,9 @@ class DiaryEntriesControllerTest < ActionController::TestCase
 
   def test_hidecomment
     user = create(:user)
-    administrator_user = create(:administrator_user)
     diary_entry = create(:diary_entry, :user => user)
     diary_comment = create(:diary_comment, :diary_entry => diary_entry)
+
     # Try without logging in
     post :hidecomment,
          :params => { :display_name => user.display_name, :id => diary_entry.id, :comment => diary_comment.id }
@@ -757,10 +768,21 @@ class DiaryEntriesControllerTest < ActionController::TestCase
     assert_redirected_to :controller => :errors, :action => :forbidden
     assert_equal true, DiaryComment.find(diary_comment.id).visible
 
+    # Try as a moderator
+    post :hidecomment,
+         :params => { :display_name => user.display_name, :id => diary_entry.id, :comment => diary_comment.id },
+         :session => { :user => create(:moderator_user) }
+    assert_response :redirect
+    assert_redirected_to :action => :show, :display_name => user.display_name, :id => diary_entry.id
+    assert_equal false, DiaryComment.find(diary_comment.id).visible
+
+    # Reset
+    diary_comment.reload.update(:visible => true)
+
     # Finally try as an administrator
     post :hidecomment,
          :params => { :display_name => user.display_name, :id => diary_entry.id, :comment => diary_comment.id },
-         :session => { :user => administrator_user }
+         :session => { :user => create(:administrator_user) }
     assert_response :redirect
     assert_redirected_to :action => :show, :display_name => user.display_name, :id => diary_entry.id
     assert_equal false, DiaryComment.find(diary_comment.id).visible