Prevent alerts to be sent to users who don't have access to the related service

config/abilities/provider_any.rb

@@ -1,7 +1,8 @@
-# here we define abilities for all users of provider account, for members use
-# provider_member.rb
-Ability.define do |user|
-  if user && user.account.provider?
+# frozen_string_literal: true
+
+# here we define abilities for all users of provider account, for members use provider_member.rb
+Ability.define do |user| # rubocop:disable Metrics/BlockLength
+  if user&.account&.provider?
     account = user.account
 
     account.settings.switches.each do |switch, value|
@@ -17,17 +18,15 @@
     cannot :update_permissions, User, &:admin?
 
     # Can't destroy or update role of himself.
-    cannot [:destroy, :update_role], user
+    cannot %i[destroy update_role], user
 
     # Services
-    can [:read, :show, :edit, :update], Service, user.accessible_services.where_values_hash
+    can %i[read show edit update], Service, user.accessible_services.where_values_hash
 
     #
     # Events
     #
-    if user.has_permission?(:finance)
-      can [:show], BillingRelatedEvent
-    end
+    can [:show], BillingRelatedEvent if user.has_permission?(:finance)
 
     if user.has_permission?(:partners)
       can [:show], AccountRelatedEvent do |event|
@@ -41,10 +40,13 @@
     end
 
     if user.has_permission?(:monitoring)
-      can [:show], AlertRelatedEvent
+      can [:show], AlertRelatedEvent do |event|
+        user.has_access_to_service?(event.try(:service))
+      end
     end
+
     can [:show], Reports::CsvDataExportEvent do |event|
-      user.admin? && event.recipient.try!(:id) == user.id
+      user.admin? && event.recipient&.id == user.id
     end
 
     can :admin, :social_logins if account.settings.branding.visible?
@@ -72,13 +74,13 @@
     end
 
     can :reply, Topic do |topic|
-      forum = topic.forum || topic.category.try!(:forum)
+      forum = topic.forum || topic.category&.forum
       forum.account == account
     end
 
     if account.provider_can_use?(:new_notification_system)
-      can [:show, :edit, :update], NotificationPreferences, user_id: user.id
-      can [:show, :update], NotificationPreferences, &:new_record?
+      can %i[show edit update], NotificationPreferences, user_id: user.id
+      can %i[show update], NotificationPreferences, &:new_record?
     end
 
     if account.partner?
@@ -98,8 +100,6 @@
 
     can :manage, AccessToken, owner_id: user.id
 
-    if can?(:manage, :partners) && can?(:manage, account)
-      can :export, :data
-    end
+    can :export, :data if can?(:manage, :partners) && can?(:manage, account)
   end
 end

test/unit/abilities/provider_any_test.rb

@@ -69,6 +69,49 @@ def test_policies_not_tenant
       assert_cannot ability, :show, Accounts::AccountCreatedEvent.create(account, user)
     end
 
+    class ShowAlertRelatedEventTest < ProviderAnyTest
+      setup do
+        user.stubs(:has_permission?)
+
+        cinstance = FactoryBot.build_stubbed(:simple_cinstance)
+        alert = FactoryBot.build_stubbed(:limit_violation, cinstance: cinstance)
+        @limit_violation_reached_provider_event = Alerts::LimitViolationReachedProviderEvent.create(alert)
+      end
+
+      attr_reader :limit_violation_reached_provider_event
+
+      test 'cannot show AlertRelatedEvent when user does not have :monitoring' do
+        user.expects(:has_permission?).with(:monitoring).returns(false)
+
+        assert_cannot ability, :show, limit_violation_reached_provider_event
+      end
+
+      # This is related to the :service_permissions rolling update. Users created before it do not have the :services
+      # section included in their member permissions, which grants them access to all services.
+      test 'can show AlertRelatedEvent when user has :monitoring and the user has access to all services through the old permission system' do
+        user.expects(:has_permission?).with(:monitoring).returns(true)
+
+        assert_can ability, :show, limit_violation_reached_provider_event
+      end
+
+      test 'cannot show AlertRelatedEvent when user has :monitoring and does not have access to the service' do
+        user.stubs(:has_permission?).with(:monitoring).returns(true)
+        user.member_permissions.build(admin_section: :services, service_ids: [])
+
+        assert_cannot ability, :show, limit_violation_reached_provider_event
+      end
+
+      test 'can show AlertRelatedEvent when user has :monitoring and has access to the service' do
+        user.stubs(:has_permission?).with(:monitoring).returns(true)
+        user.member_permissions.build(
+          admin_section: :services,
+          service_ids: [limit_violation_reached_provider_event.service.id]
+        )
+
+        assert_can ability, :show, limit_violation_reached_provider_event
+      end
+    end
+
     private
 
     def ability