Allow :create Entry only for publishers on accounts, not on entries #836

aviav · 2017-08-13T19:37:33Z

No description provided.

coveralls · 2017-08-13T19:53:53Z

Coverage remained the same at 99.06% when pulling 0c7019b on aviav:fix-entry-policy into 3d34806 on codevise:master.

coveralls · 2017-08-13T19:53:53Z

Coverage remained the same at 99.06% when pulling 0c7019b on aviav:fix-entry-policy into 3d34806 on codevise:master.

tf · 2017-08-14T12:55:59Z

app/policies/pageflow/entry_policy.rb

@@ -87,7 +87,8 @@ def publish?
    end

    def create?
-      publish? && AccountPolicy::Scope.new(user, Account).entry_creatable.any?
+      query.has_at_least_account_role?(:publisher) &&
+        AccountPolicy::Scope.new(user, Account).entry_creatable.any?


So the idea is that an entry publisher should not be able to create an entry? I agree with that. But shouldn't this spec fail then?

I don't really get the second part of the condition. Doesn't that say, that I'm allowed to create an entry if there is at least one account where i can create an entry (which also just means being publisher in at least one account)

tf · 2017-08-16T05:57:25Z

Not sure why I am assigned here. What is the answer to the question?

aviav · 2017-08-16T09:54:21Z

I thought I understood that you wanted to look into those questions yourself. Maybe we need to clarify something here

houndci-bot · 2017-08-22T08:49:32Z

spec/policies/pageflow/entry_policy_spec.rb

                    to: :read,
                    topic: -> { create(:entry) }

    it_behaves_like 'a membership-based permission that',
                    allows: :previewer,
-                    of_entry: -> (topic) { topic },
-                    of_account: -> (topic) { topic.account },
+                    of_entry_or_its_account: -> (topic) { topic },


Do not use spaces between -> and opening brace in lambda literals

houndci-bot · 2017-08-22T08:49:32Z

spec/policies/pageflow/entry_policy_spec.rb

                    to: :preview,
                    topic: -> { create(:entry) }

    it_behaves_like 'a membership-based permission that',
                    allows: :previewer,
-                    of_entry: -> (topic) { topic },
-                    of_account: -> (topic) { topic.account },
+                    of_entry_or_its_account: -> (topic) { topic },


Do not use spaces between -> and opening brace in lambda literals

houndci-bot · 2017-08-22T08:49:32Z

spec/policies/pageflow/entry_policy_spec.rb

                    to: :confirm_encoding,
                    topic: -> { create(:entry) }

    it_behaves_like 'a membership-based permission that',
                    allows: :previewer,
-                    of_entry: -> (topic) { topic },
-                    of_account: -> (topic) { topic.account },
+                    of_entry_or_its_account: -> (topic) { topic },


Do not use spaces between -> and opening brace in lambda literals

houndci-bot · 2017-08-22T08:49:32Z

spec/policies/pageflow/entry_policy_spec.rb

                    to: :snapshot,
                    topic: -> { create(:entry) }

    it_behaves_like 'a membership-based permission that',
                    allows: :editor,
                    but_forbids: :previewer,
-                    of_entry: -> (topic) { topic },
-                    of_account: -> (topic) { topic.account },
+                    of_entry_or_its_account: -> (topic) { topic },


Do not use spaces between -> and opening brace in lambda literals

houndci-bot · 2017-08-22T08:49:32Z

spec/policies/pageflow/entry_policy_spec.rb

                    to: :restore,
                    topic: -> { create(:entry) }

    it_behaves_like 'a membership-based permission that',
                    allows: :editor,
                    but_forbids: :previewer,
-                    of_entry: -> (topic) { topic },
-                    of_account: -> (topic) { topic.account },
+                    of_entry_or_its_account: -> (topic) { topic },


Do not use spaces between -> and opening brace in lambda literals

houndci-bot · 2017-08-22T08:49:33Z

spec/policies/pageflow/entry_policy_spec.rb

                    to: :destroy_membership_on,
                    topic: -> { create(:entry) }

    it_behaves_like 'a membership-based permission that',
                    allows: :publisher,
                    but_forbids: :editor,
-                    of_entry: -> (topic) { topic },
-                    of_account: -> (topic) { topic.account },
+                    of_entry_or_its_account: -> (topic) { topic },


Do not use spaces between -> and opening brace in lambda literals

houndci-bot · 2017-08-22T08:49:33Z

spec/policies/pageflow/entry_policy_spec.rb

                    to: :edit_role_on,
                    topic: -> { create(:entry) }

    it_behaves_like 'a membership-based permission that',
                    allows: :manager,
                    but_forbids: :publisher,
-                    of_entry: -> (topic) { topic },
-                    of_account: -> (topic) { topic.account },
+                    of_entry_or_its_account: -> (topic) { topic },


Do not use spaces between -> and opening brace in lambda literals

houndci-bot · 2017-08-22T08:49:33Z

spec/policies/pageflow/entry_policy_spec.rb

                    to: :add_member_to,
                    topic: -> { create(:entry) }

    it_behaves_like 'a membership-based permission that',
                    allows: :manager,
                    but_forbids: :publisher,
-                    of_entry: -> (topic) { topic },
-                    of_account: -> (topic) { topic.account },
+                    of_entry_or_its_account: -> (topic) { topic },


Do not use spaces between -> and opening brace in lambda literals

houndci-bot · 2017-08-22T08:49:33Z

spec/policies/pageflow/entry_policy_spec.rb

                    to: :manage,
                    topic: -> { create(:entry) }

    it_behaves_like 'a membership-based permission that',
                    allows: :manager,
                    but_forbids: :publisher,
-                    of_entry: -> (topic) { topic },
-                    of_account: -> (topic) { topic.account },
+                    of_entry_or_its_account: -> (topic) { topic },


Do not use spaces between -> and opening brace in lambda literals

houndci-bot · 2017-08-22T08:49:33Z

spec/policies/pageflow/entry_policy_spec.rb

@@ -5,125 +5,115 @@ module Pageflow
    it_behaves_like 'a membership-based permission that',
                    allows: :manager,
                    but_forbids: :publisher,
-                    of_entry: -> (topic) { topic },
-                    of_account: -> (topic) { topic.account },
+                    of_entry_or_its_account: -> (topic) { topic },


Do not use spaces between -> and opening brace in lambda literals

Ensure specs for account and entry case can be generated in a single invocation of the shared example. Prevent overriding `let` in a loop causing only the last case to be used in specs.

* Fail if unknown option is passed. * Allow using `of_entry_or_its_account` instead of passing both `of_entry` and `of_account` options to make specs more readable. * Allow testing only the `forbid` case, by aliasing the `but_forbid` option and skipping specs for the `allow` case. * Make spec description generation more DRY.

The previous implementation also allowed entry publishers as long as they were also publishers of at least one (possibly unrelated) account.

houndci-bot · 2017-08-22T08:51:22Z

spec/policies/pageflow/membership_based_permission_shared_examples.rb

+      # `:of_account` params are present, the second iteration of the
+      # loop will override the definition of the first, causing the
+      # specs to be defined for the account case two times.
+      context do


Block has too many lines. [26/25]

houndci-bot · 2017-08-22T08:51:22Z

spec/policies/pageflow/membership_based_permission_shared_examples.rb

-    let(:topic) { instance_exec(&params[:topic]) }
-    let(:entity) { of.call(topic) }
-    let(:policy) { described_class.new(user, topic) }
+    allowed_params = [


Use %i or %I for an array of symbols.

houndci-bot · 2017-08-22T08:51:22Z

spec/policies/pageflow/entry_policy_spec.rb

                    to: :read,
                    topic: -> { create(:entry) }

    it_behaves_like 'a membership-based permission that',
                    allows: :previewer,
-                    of_entry: -> (topic) { topic },
-                    of_account: -> (topic) { topic.account },
+                    of_entry_or_its_account: -> (topic) { topic },


Do not use spaces between -> and opening brace in lambda literals

houndci-bot · 2017-08-22T08:51:22Z

spec/policies/pageflow/entry_policy_spec.rb

                    to: :preview,
                    topic: -> { create(:entry) }

    it_behaves_like 'a membership-based permission that',
                    allows: :previewer,
-                    of_entry: -> (topic) { topic },
-                    of_account: -> (topic) { topic.account },
+                    of_entry_or_its_account: -> (topic) { topic },


Do not use spaces between -> and opening brace in lambda literals

houndci-bot · 2017-08-22T08:51:22Z

spec/policies/pageflow/entry_policy_spec.rb

                    to: :snapshot,
                    topic: -> { create(:entry) }

    it_behaves_like 'a membership-based permission that',
                    allows: :editor,
                    but_forbids: :previewer,
-                    of_entry: -> (topic) { topic },
-                    of_account: -> (topic) { topic.account },
+                    of_entry_or_its_account: -> (topic) { topic },


Do not use spaces between -> and opening brace in lambda literals

houndci-bot · 2017-08-22T08:51:23Z

spec/policies/pageflow/entry_policy_spec.rb

                    to: :index_widgets_for,
                    topic: -> { create(:entry) }

    it_behaves_like 'a membership-based permission that',
                    allows: :editor,
                    but_forbids: :previewer,
-                    of_entry: -> (topic) { topic },
-                    of_account: -> (topic) { topic.account },
+                    of_entry_or_its_account: -> (topic) { topic },


Do not use spaces between -> and opening brace in lambda literals

houndci-bot · 2017-08-22T08:51:23Z

spec/policies/pageflow/entry_policy_spec.rb

                    to: :edit,
                    topic: -> { create(:entry) }

    it_behaves_like 'a membership-based permission that',
                    allows: :editor,
                    but_forbids: :previewer,
-                    of_entry: -> (topic) { topic },
-                    of_account: -> (topic) { topic.account },
+                    of_entry_or_its_account: -> (topic) { topic },


Do not use spaces between -> and opening brace in lambda literals

houndci-bot · 2017-08-22T08:51:23Z

spec/policies/pageflow/entry_policy_spec.rb

                    allows: :publisher,
                    but_forbids: :editor,
-                    of_entry: -> (topic) { topic },
-                    of_account: -> (topic) { topic.account },
+                    of_entry_or_its_account: -> (topic) { topic },


Do not use spaces between -> and opening brace in lambda literals

houndci-bot · 2017-08-22T08:51:23Z

spec/policies/pageflow/entry_policy_spec.rb

                    to: :edit_role_on,
                    topic: -> { create(:entry) }

    it_behaves_like 'a membership-based permission that',
                    allows: :manager,
                    but_forbids: :publisher,
-                    of_entry: -> (topic) { topic },
-                    of_account: -> (topic) { topic.account },
+                    of_entry_or_its_account: -> (topic) { topic },


Do not use spaces between -> and opening brace in lambda literals

houndci-bot · 2017-08-22T08:51:23Z

spec/policies/pageflow/entry_policy_spec.rb

                    to: :add_member_to,
                    topic: -> { create(:entry) }

    it_behaves_like 'a membership-based permission that',
                    allows: :manager,
                    but_forbids: :publisher,
-                    of_entry: -> (topic) { topic },
-                    of_account: -> (topic) { topic.account },
+                    of_entry_or_its_account: -> (topic) { topic },


Do not use spaces between -> and opening brace in lambda literals

coveralls · 2017-08-22T09:00:30Z

Coverage increased (+0.1%) to 99.167% when pulling 8b8d2a9 on aviav:fix-entry-policy into ffc8da5 on codevise:master.

coveralls · 2017-08-22T09:01:43Z

Coverage increased (+0.1%) to 99.167% when pulling 8b8d2a9 on aviav:fix-entry-policy into ffc8da5 on codevise:master.

coveralls · 2017-08-28T12:10:46Z

Coverage increased (+0.1%) to 99.137% when pulling b130927 on aviav:fix-entry-policy into 5f21f8e on codevise:master.

2017-11-07 [Compare changes](codevise/pageflow@12-0-stable...v12.1.0) - Include HLS in output presences of legacy files ([#872](codevise/pageflow#872), [#867](codevise/pageflow#867)) The database migration for Pageflow 12.0 which updates output presences of existing video files is missing the HLS variant. This causes HLS urls of existing video files to be rendered as `undefined`. To apply the fix, install migrations and migrate your database. This fix has previously been released as part of version 12.0.2. - Add Resque::Server to the generated routes ([#871](codevise/pageflow#871)) Mounting the Resque web server makes it easier to inspect background workers and restart jobs that have failed. See the issue description of [#856](codevise/pageflow#856) on how to add this to existing apps. - The theme configured on account level now only acts as a default for new entries. After enabling the `selectable_themes` feature, a theme selection dialog is available inside the editor from the "Title and Options > Appearance" tab. The dialog allows configuring the theme on a per revision basis. ([#781](codevise/pageflow#781), [#897](codevise/pageflow#897)) - Use page from url hash es landing page ([#832](codevise/pageflow#832)) - Do not record history when changing pages via scrolling ([#831](codevise/pageflow#831)) - Improve text tracks and info box display logic ([#826](codevise/pageflow#826)) - Bug fix: Fix order of public i18n fallback ([#883](codevise/pageflow#883)) - Bug fix: Prevent display of NaN duration in video controls ([#878](codevise/pageflow#878)) - Bug fix: Prevent 404 when share image has been deleted ([#816](codevise/pageflow#816)) - Use searchable select boxes in admin forms ([#888](codevise/pageflow#888)) - Remove sensitive data from active admin downloads ([#899](codevise/pageflow#899)) - Add config option to prevent multi account users ([#848](codevise/pageflow#848), [#868](codevise/pageflow#868)) - Add config options to restrict account manager permissions ([#849](codevise/pageflow#849)) - Fix N+1 query in account admin users tab ([#877](codevise/pageflow#877)) - Bug fix: Hide restore link and snapshot button for entry previewers ([#853](codevise/pageflow#853)) - Bug fix: Use copy of current_user in profile form ([#850](codevise/pageflow#850)) - Bug fix: Ensure new entry button is hidden for editors ([#847](codevise/pageflow#847)) - Bug fix: Show folder edit button only for publishers and above ([#838](codevise/pageflow#838)) - Bug fix: Allow :create entry only for publishers on accounts, not on entries ([#836](codevise/pageflow#836)) - Widget configuration ([#694](codevise/pageflow#694), [#809](codevise/pageflow#809)) - Bug fix: Ensure page order in editor preview stays up to date ([#898](codevise/pageflow#898)) - Bug fix: Switch off file meta data edit links when uploading ([#857](codevise/pageflow#857)) - Bug fix: Improve polling for HostedFile state ([#822](codevise/pageflow#822)) - Bug fix: Handle undefined page title. ([#763](codevise/pageflow#763)) - Use relative urls inside dash and hls playlists ([#842](codevise/pageflow#842)) - Use web audio api for volume fading if available ([#800](codevise/pageflow#800), [#863](codevise/pageflow#863)) - Add panorama_mask image file style ([#830](codevise/pageflow#830)) - Bug fix: Make url template generation more robust ([#876](codevise/pageflow#876)) - Themes can now be guarded by feature flags ([#765](codevise/pageflow#765)) - Extend EncodingConfirmation by public account attribute ([#817](codevise/pageflow#817)) - Extend query interface ([#815](codevise/pageflow#815)) - Accept options for accounts admin menu via config ([#811](codevise/pageflow#811)) - Add placeholder options to textareainputview ([#807](codevise/pageflow#807)) - Call hook on entry publication ([#806](codevise/pageflow#806)) - Add rake task and resque job to delete old auto snapshots ([#861](codevise/pageflow#861), [#882](codevise/pageflow#882)) - Generate a secure password in the seeds ([#775](codevise/pageflow#775)) - Allow specifying opacity of image variant logo ([#799](codevise/pageflow#799)) - Allow setting size of custom loading spinner background ([#798](codevise/pageflow#798)) - Add theme option to right align logo in desktop layout ([#797](codevise/pageflow#797)) - Add theme option to hide scroll indicator ([#790](codevise/pageflow#790)) - Make content text max width configurable ([#780](codevise/pageflow#780), [#804](codevise/pageflow#804)) - Import nginx-upload-module guide from wiki ([#814](codevise/pageflow#814), [#821](codevise/pageflow#821)) - Add documentation for versioning policy ([#866](codevise/pageflow#866)) - Fix small typos ([#787](codevise/pageflow#787)) - Precompile assets in Travis run ([#873](codevise/pageflow#873)) - Test workflow improvements ([#803](codevise/pageflow#803)) - Generate admins with account membership in specs ([#840](codevise/pageflow#840)) - Use rails 4.2.9 in tests ([#837](codevise/pageflow#837)) - Clean up memberships admin code ([#835](codevise/pageflow#835)) - Basic tests for UsersTab add user button ([#805](codevise/pageflow#805)) - Use codevise/teaspoon for logging backtraces on console ([#786](codevise/pageflow#786)) - Split vendored code from our own ([#885](codevise/pageflow#885)) - Introduce ApplicationRecord ([#889](codevise/pageflow#889)) - Move configuration into a concern ([#794](codevise/pageflow#794)) - Read the attribute instead of super ([#810](codevise/pageflow#810)) - Destroy widgets when parent subject is destroyed ([#834](codevise/pageflow#834)) - Fix dummy app generation on Travis for Rubygems 2.7 ([#893](codevise/pageflow#893)) - Update contents of gemspec ([#891](codevise/pageflow#891)) - Bug fix: Work around breaking change in resque_mailer 2.4.3 ([#894](codevise/pageflow#894)) See [12-0-stable](https://github.com/codevise/pageflow/blob/12-0-stable/CHANGELOG.md) branch for previous changes.

tf modified the milestone: v12.1 Aug 14, 2017

tf reviewed Aug 14, 2017

View reviewed changes

tf assigned aviav Aug 14, 2017

aviav assigned tf Aug 15, 2017

aviav unassigned tf Aug 16, 2017

tf force-pushed the fix-entry-policy branch from 0c7019b to a5b7459 Compare August 22, 2017 08:49

houndci-bot reviewed Aug 22, 2017

View reviewed changes

tf and others added 3 commits August 22, 2017 10:51

Fix shared example for membership bases permissions

c518af5

Ensure specs for account and entry case can be generated in a single invocation of the shared example. Prevent overriding `let` in a loop causing only the last case to be used in specs.

Allow :create Entry only for publishers on accounts, not on entries

82ac17e

The previous implementation also allowed entry publishers as long as they were also publishers of at least one (possibly unrelated) account.

tf force-pushed the fix-entry-policy branch from a5b7459 to 8b8d2a9 Compare August 22, 2017 08:51

houndci-bot reviewed Aug 22, 2017

View reviewed changes

tf assigned tf and unassigned aviav Aug 28, 2017

Use of_entry_or_its_account for readable policy specs

b130927

tf force-pushed the fix-entry-policy branch from 8b8d2a9 to b130927 Compare August 28, 2017 11:56

tf merged commit 2ef9fd9 into codevise:master Aug 28, 2017

tilsammans mentioned this pull request Nov 12, 2017

upgrade Pageflow scrollytelling/app#23

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Allow :create Entry only for publishers on accounts, not on entries #836

Allow :create Entry only for publishers on accounts, not on entries #836

aviav commented Aug 13, 2017

coveralls commented Aug 13, 2017

coveralls commented Aug 13, 2017

tf Aug 14, 2017 •

edited

Loading

tf commented Aug 16, 2017 •

edited

Loading

aviav commented Aug 16, 2017

houndci-bot Aug 22, 2017

houndci-bot Aug 22, 2017

houndci-bot Aug 22, 2017

houndci-bot Aug 22, 2017

houndci-bot Aug 22, 2017

houndci-bot Aug 22, 2017

houndci-bot Aug 22, 2017

houndci-bot Aug 22, 2017

houndci-bot Aug 22, 2017

houndci-bot Aug 22, 2017

houndci-bot Aug 22, 2017

houndci-bot Aug 22, 2017

houndci-bot Aug 22, 2017

houndci-bot Aug 22, 2017

houndci-bot Aug 22, 2017

houndci-bot Aug 22, 2017

houndci-bot Aug 22, 2017

houndci-bot Aug 22, 2017

houndci-bot Aug 22, 2017

houndci-bot Aug 22, 2017

coveralls commented Aug 22, 2017 •

edited

Loading

coveralls commented Aug 22, 2017 •

edited

Loading

coveralls commented Aug 28, 2017 •

edited

Loading

Allow :create Entry only for publishers on accounts, not on entries #836

Allow :create Entry only for publishers on accounts, not on entries #836

Conversation

aviav commented Aug 13, 2017

coveralls commented Aug 13, 2017

coveralls commented Aug 13, 2017

tf Aug 14, 2017 • edited Loading

Choose a reason for hiding this comment

tf commented Aug 16, 2017 • edited Loading

aviav commented Aug 16, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

coveralls commented Aug 22, 2017 • edited Loading

coveralls commented Aug 22, 2017 • edited Loading

coveralls commented Aug 28, 2017 • edited Loading

tf Aug 14, 2017 •

edited

Loading

tf commented Aug 16, 2017 •

edited

Loading

coveralls commented Aug 22, 2017 •

edited

Loading

coveralls commented Aug 22, 2017 •

edited

Loading

coveralls commented Aug 28, 2017 •

edited

Loading