Add comprehensive authorization tests for Book privacy - #1470
Open
drusepth wants to merge 2 commits into
Open
Conversation
Books default to private via the privacy column default, and a book created outside a universe has no way to become public: every universe-based branch in BookAuthorizer#readable_by? is guarded by a universe.present? check, and HasPrivacy#is_public joins against a NULL universes.privacy that cannot match 'public'. These tests pin that behavior down, and document the one case where a book is readable despite its own privacy being 'private': when it belongs to a public universe. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FndSaxFpDnyhC2pShjxR4h
A book in a public universe is readable by anyone even when its own privacy is 'private', but the settings sidebar showed a plain "Book is Private" and the reader view told the author only they could see it. Both now report the inherited visibility: - the status banner reads "Public (through its universe)" - a notice links to the universe and explains that making the universe private is what restores access control - the private-chapter warning now also fires on inherited visibility, and points at the universe rather than the book's own toggle Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FndSaxFpDnyhC2pShjxR4h
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #
Changes proposed:
Test Plan:
All authorization scenarios are covered by the new test suite. Run with:
rails test test/authorizers/book_authorizer_test.rbThe tests verify the HasPrivacy concern implementation for books, including edge cases like universe-less books and privacy inheritance from parent universes.
@indentlabs/contributors
https://claude.ai/code/session_01FndSaxFpDnyhC2pShjxR4h