Allow :create Entry only for publishers on accounts, not on entries

The previous implementation also allowed entry publishers as long as they were also publishers of at least one (possibly unrelated) account.
codevise · Aug 22, 2017 · 82ac17e · 82ac17e
1 parent 574c1e5
commit 82ac17e
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 2 deletions.
diff --git a/app/policies/pageflow/entry_policy.rb b/app/policies/pageflow/entry_policy.rb
@@ -87,7 +87,7 @@ def publish?
     end
 
     def create?
-      publish? && AccountPolicy::Scope.new(user, Account).entry_creatable.any?
+      query.has_at_least_account_role?(:publisher)
     end
 
     def duplicate?

diff --git a/spec/policies/pageflow/entry_policy_spec.rb b/spec/policies/pageflow/entry_policy_spec.rb
@@ -45,11 +45,16 @@ module Pageflow
     it_behaves_like 'a membership-based permission that',
                     allows: :publisher,
                     but_forbids: :editor,
-                    of_entry: -> (topic) { topic },
                     of_account: -> (topic) { topic.account },
                     to: :create,
                     topic: -> { create(:entry) }
 
+    it_behaves_like 'a membership-based permission that',
+                    forbids: :manager,
+                    of_entry: -> (topic) { topic },
+                    to: :create,
+                    topic: -> { create(:entry) }
+
     it_behaves_like 'a membership-based permission that',
                     allows: :publisher,
                     but_forbids: :editor,