Refs:#3478@10h;

   Policy Refactoring and Policy Test Completion

   - All policies (and all permissions) under test.
   - Common patterns and potential problems identified...
   - ... and documented in DEVNOTES.md

   - some simply refactorings

14 files changed, 563 insertions, 18 deletions

diff --git a/spec/policies/access_link_policy_spec.rb b/spec/policies/access_link_policy_spec.rb
new file mode 100644
index 000000000..6194ae55c
--- /dev/null
+++ b/spec/policies/access_link_policy_spec.rb
@@ -0,0 +1,20 @@
+RSpec.describe AccessLinkPolicy, type: :policy do
+
+  let( :record ){ build_stubbed :access_link }
+
+  permissions :create? do
+      it_behaves_like 'permitted policy and same organisation', "access_links.create", archived: true
+  end
+  permissions :destroy? do
+      it_behaves_like 'permitted policy and same organisation', "access_links.destroy", archived: true
+  end
+  permissions :edit? do
+      it_behaves_like 'permitted policy and same organisation', "access_links.update", archived: true
+  end
+  permissions :new? do
+      it_behaves_like 'permitted policy and same organisation', "access_links.create", archived: true
+  end
+  permissions :update? do
+      it_behaves_like 'permitted policy and same organisation', "access_links.update", archived: true
+  end
+end
diff --git a/spec/policies/access_point_policy_spec.rb b/spec/policies/access_point_policy_spec.rb
new file mode 100644
index 000000000..b6bc46eb4
--- /dev/null
+++ b/spec/policies/access_point_policy_spec.rb
@@ -0,0 +1,20 @@
+RSpec.describe AccessPointPolicy, type: :policy do
+
+  let( :record ){ build_stubbed :access_point }
+
+  permissions :create? do
+      it_behaves_like 'permitted policy and same organisation', "access_points.create", archived: true
+  end
+  permissions :destroy? do
+      it_behaves_like 'permitted policy and same organisation', "access_points.destroy", archived: true
+  end
+  permissions :edit? do
+      it_behaves_like 'permitted policy and same organisation', "access_points.update", archived: true
+  end
+  permissions :new? do
+      it_behaves_like 'permitted policy and same organisation', "access_points.create", archived: true
+  end
+  permissions :update? do
+      it_behaves_like 'permitted policy and same organisation', "access_points.update", archived: true
+  end
+end
diff --git a/spec/policies/calendar_policy_spec.rb b/spec/policies/calendar_policy_spec.rb
new file mode 100644
index 000000000..f4423fb82
--- /dev/null
+++ b/spec/policies/calendar_policy_spec.rb
@@ -0,0 +1,47 @@
+RSpec.describe CalendarPolicy, type: :policy do
+
+  let( :record ){ build_stubbed :calendar }
+
+  shared_examples 'authorizes on archived and same organisation only' do
+    | permission, archived: false|
+    context 'same organisation →' do
+      before do
+        user.organisation_id = referential.organisation_id
+      end
+      it "allows a user with the same organisation" do
+        expect_it.to permit(user_context, record)
+      end
+      if archived
+        it 'removes permission for archived referentials' do
+          referential.archived_at = 42.seconds.ago
+          expect_it.not_to permit(user_context, record)
+        end
+      end
+    end
+
+    context 'different organisations →' do
+      before do
+        add_permissions(permission, for_user: user)
+      end
+      it "denies a user with a different organisation" do
+        expect_it.not_to permit(user_context, record)
+      end
+    end
+  end
+
+  permissions :create? do
+    it_behaves_like 'authorizes on archived and same organisation only', 'calendars.create', archived: true
+  end
+  permissions :destroy? do
+    it_behaves_like 'authorizes on archived and same organisation only', 'calendars.destroy', archived: true
+  end
+  permissions :edit? do
+    it_behaves_like 'authorizes on archived and same organisation only', 'calendars.update', archived: true
+  end
+  permissions :new? do
+    it_behaves_like 'authorizes on archived and same organisation only', 'calendars.create', archived: true
+  end
+  permissions :update? do
+    it_behaves_like 'authorizes on archived and same organisation only', 'calendars.update', archived: true
+  end
+end
diff --git a/spec/policies/company_policy_spec.rb b/spec/policies/company_policy_spec.rb
new file mode 100644
index 000000000..2d249a2be
--- /dev/null
+++ b/spec/policies/company_policy_spec.rb
@@ -0,0 +1,42 @@
+RSpec.describe CompanyPolicy, type: :policy do
+
+  let( :record ){ build_stubbed :company }
+  before { stub_policy_scope(record) }
+
+
+  #
+  #  Non Destructive
+  #  ---------------
+
+  context 'Non Destructive actions →' do
+    permissions :index? do
+      it_behaves_like 'always allowed', 'anything', archived: true
+    end
+    permissions :show? do
+      it_behaves_like 'always allowed', 'anything', archived: true
+    end
+  end
+
+
+  #
+  #  Destructive
+  #  -----------
+
+  context 'Destructive actions →' do
+    permissions :create? do
+      it_behaves_like 'always forbidden', 'companies.create', archived: true
+    end
+    permissions :destroy? do
+      it_behaves_like 'always forbidden', 'companies.destroy', archived: true
+    end
+    permissions :edit? do
+      it_behaves_like 'always forbidden', 'companies.update', archived: true
+    end
+    permissions :new? do
+      it_behaves_like 'always forbidden', 'companies.create', archived: true
+    end
+    permissions :update? do
+      it_behaves_like 'always forbidden', 'companies.update', archived: true
+    end
+  end
+end
diff --git a/spec/policies/connection_link_policy_spec.rb b/spec/policies/connection_link_policy_spec.rb
new file mode 100644
index 000000000..23e40abe3
--- /dev/null
+++ b/spec/policies/connection_link_policy_spec.rb
@@ -0,0 +1,20 @@
+RSpec.describe ConnectionLinkPolicy, type: :policy do
+
+  let( :record ){ build_stubbed :connection_link }
+
+  permissions :create? do
+      it_behaves_like 'permitted policy and same organisation', "connection_links.create", archived: true
+  end
+  permissions :destroy? do
+      it_behaves_like 'permitted policy and same organisation', "connection_links.destroy", archived: true
+  end
+  permissions :edit? do
+      it_behaves_like 'permitted policy and same organisation', "connection_links.update", archived: true
+  end
+  permissions :new? do
+      it_behaves_like 'permitted policy and same organisation', "connection_links.create", archived: true
+  end
+  permissions :update? do
+      it_behaves_like 'permitted policy and same organisation', "connection_links.update", archived: true
+  end
+end
diff --git a/spec/policies/group_of_line_policy_spec.rb b/spec/policies/group_of_line_policy_spec.rb
new file mode 100644
index 000000000..29fbb1bfb
--- /dev/null
+++ b/spec/policies/group_of_line_policy_spec.rb
@@ -0,0 +1,42 @@
+RSpec.describe GroupOfLinePolicy, type: :policy do
+
+  let( :record ){ build_stubbed :group_of_line }
+  before { stub_policy_scope(record) }
+
+
+  #
+  #  Non Destructive
+  #  ---------------
+
+  context 'Non Destructive actions →' do
+    permissions :index? do
+      it_behaves_like 'always allowed', 'anything', archived: true
+    end
+    permissions :show? do
+      it_behaves_like 'always allowed', 'anything', archived: true
+    end
+  end
+
+
+  #
+  #  Destructive
+  #  -----------
+
+  context 'Destructive actions →' do
+    permissions :create? do
+      it_behaves_like 'always forbidden', 'group_of_lines.create', archived: true
+    end
+    permissions :destroy? do
+      it_behaves_like 'always forbidden', 'group_of_lines.destroy', archived: true
+    end
+    permissions :edit? do
+      it_behaves_like 'always forbidden', 'group_of_lines.update', archived: true
+    end
+    permissions :new? do
+      it_behaves_like 'always forbidden', 'group_of_lines.create', archived: true
+    end
+    permissions :update? do
+      it_behaves_like 'always forbidden', 'group_of_lines.update', archived: true
+    end
+  end
+end
diff --git a/spec/policies/journey_pattern_policy_spec.rb b/spec/policies/journey_pattern_policy_spec.rb
new file mode 100644
index 000000000..39f849277
--- /dev/null
+++ b/spec/policies/journey_pattern_policy_spec.rb
@@ -0,0 +1,20 @@
+RSpec.describe JourneyPatternPolicy, type: :policy do
+
+  let( :record ){ build_stubbed :journey_pattern }
+
+  permissions :create? do
+      it_behaves_like 'permitted policy and same organisation', "journey_patterns.create", archived: true
+  end
+  permissions :destroy? do
+      it_behaves_like 'permitted policy and same organisation', "journey_patterns.destroy", archived: true
+  end
+  permissions :edit? do
+      it_behaves_like 'permitted policy and same organisation', "journey_patterns.update", archived: true
+  end
+  permissions :new? do
+      it_behaves_like 'permitted policy and same organisation', "journey_patterns.create", archived: true
+  end
+  permissions :update? do
+      it_behaves_like 'permitted policy and same organisation', "journey_patterns.update", archived: true
+  end
+end
diff --git a/spec/policies/line_policy_spec.rb b/spec/policies/line_policy_spec.rb
index e720b2bc7..d9e684847 100644
--- a/spec/policies/line_policy_spec.rb
+++ b/spec/policies/line_policy_spec.rb
@@ -1,21 +1,163 @@
 RSpec.describe LinePolicy, type: :policy do
 
   let( :record ){ build_stubbed :line }
+  before { stub_policy_scope(record) }
 
 
-  %w{create destroy edit}.each do | permission |
-    footnote_permission = "#{permission}_footnote"
-    permissions "#{footnote_permission}?".to_sym do
-      it_behaves_like 'permitted policy', "footnotes.#{permission}", archived: true
+  #
+  #  Non Destructive
+  #  ---------------
+
+  context 'Non Destructive actions →' do
+    permissions :index? do
+      it_behaves_like 'always allowed', 'anything', archived: true
+    end
+    permissions :show? do
+      it_behaves_like 'always allowed', 'anything', archived: true
+    end
+  end
+
+
+  #
+  #  Destructive
+  #  -----------
+
+  context 'Destructive actions →' do
+    permissions :create? do
+      it_behaves_like 'always forbidden', 'lines.create', archived: true
+    end
+    permissions :destroy? do
+      it_behaves_like 'always forbidden', 'lines.destroy', archived: true
+    end
+    permissions :edit? do
+      it_behaves_like 'always forbidden', 'lines.update', archived: true
+    end
+    permissions :new? do
+      it_behaves_like 'always forbidden', 'lines.create', archived: true
+    end
+    permissions :update? do
+      it_behaves_like 'always forbidden', 'lines.update', archived: true
+    end
+  end
+
+
+  #
+  #  Custom Footnote Permissions
+  #  ---------------------------
+
+  permissions :create_footnote? do
+    context 'permission present →' do
+      before do
+        add_permissions('footnotes.create', for_user: user)
+      end
+
+      it 'authorized for unarchived referentials' do
+        expect_it.to permit(user_context, record)
+      end
+
+      it 'forbidden for archived referentials' do
+        referential.archived_at = 1.second.ago
+        expect_it.not_to permit(user_context, record)
+      end
+    end
+
+    context 'permission absent →' do 
+      it 'is forbidden' do
+        expect_it.not_to permit(user_context, record)
+      end
+    end
+  end
+
+  permissions :destroy_footnote? do
+    context 'permission present →' do
+      before do
+        add_permissions('footnotes.destroy', for_user: user)
+      end
+
+      it 'authorized for unarchived referentials' do
+        expect_it.to permit(user_context, record)
+      end
+
+      it 'forbidden for archived referentials' do
+        referential.archived_at = 1.second.ago
+        expect_it.not_to permit(user_context, record)
+      end
+    end
+
+    context 'permission absent →' do 
+      it 'is forbidden' do
+        expect_it.not_to permit(user_context, record)
+      end
+    end
+  end
+
+  permissions :edit_footnote? do
+    context 'permission present →' do
+      before do
+        add_permissions('footnotes.update', for_user: user)
+      end
+
+      it 'authorized for unarchived referentials' do
+        expect_it.to permit(user_context, record)
+      end
+
+      it 'forbidden for archived referentials' do
+        referential.archived_at = 1.second.ago
+        expect_it.not_to permit(user_context, record)
+      end
+    end
+
+    context 'permission absent →' do 
+      it 'is forbidden' do
+        expect_it.not_to permit(user_context, record)
+      end
     end
   end
 
   permissions :new_footnote? do
-    it_behaves_like 'permitted policy', 'footnotes.create', archived: true
+    context 'permission present →' do
+      before do
+        add_permissions('footnotes.create', for_user: user)
+      end
+
+      it 'authorized for unarchived referentials' do
+        expect_it.to permit(user_context, record)
+      end
+
+      it 'forbidden for archived referentials' do
+        referential.archived_at = 1.second.ago
+        expect_it.not_to permit(user_context, record)
+      end
+    end
+
+    context 'permission absent →' do 
+      it 'is forbidden' do
+        expect_it.not_to permit(user_context, record)
+      end
+    end
   end
 
   permissions :update_footnote? do
-    it_behaves_like 'permitted policy', 'footnotes.edit', archived: true
+    context 'permission present →' do
+      before do
+        add_permissions('footnotes.update', for_user: user)
+      end
+
+      it 'authorized for unarchived referentials' do
+        expect_it.to permit(user_context, record)
+      end
+
+      it 'forbidden for archived referentials' do
+        referential.archived_at = 1.second.ago
+        expect_it.not_to permit(user_context, record)
+      end
+    end
+
+    context 'permission absent →' do 
+      it 'is forbidden' do
+        expect_it.not_to permit(user_context, record)
+      end
+    end
   end
 
 end
diff --git a/spec/policies/network_policy_spec.rb b/spec/policies/network_policy_spec.rb
new file mode 100644
index 000000000..ae4ffa03a
--- /dev/null
+++ b/spec/policies/network_policy_spec.rb
@@ -0,0 +1,42 @@
+RSpec.describe NetworkPolicy, type: :policy do
+
+  let( :record ){ build_stubbed :network }
+  before { stub_policy_scope(record) }
+
+
+  #
+  #  Non Destructive
+  #  ---------------
+
+  context 'Non Destructive actions →' do
+    permissions :index? do
+      it_behaves_like 'always allowed', 'anything', archived: true
+    end
+    permissions :show? do
+      it_behaves_like 'always allowed', 'anything', archived: true
+    end
+  end
+
+
+  #
+  #  Destructive
+  #  -----------
+
+  context 'Destructive actions →' do
+    permissions :create? do
+      it_behaves_like 'always forbidden', 'networks.create', archived: true
+    end
+    permissions :destroy? do
+      it_behaves_like 'always forbidden', 'networks.destroy', archived: true
+    end
+    permissions :edit? do
+      it_behaves_like 'always forbidden', 'networks.update', archived: true
+    end
+    permissions :new? do
+      it_behaves_like 'always forbidden', 'networks.create', archived: true
+    end
+    permissions :update? do
+      it_behaves_like 'always forbidden', 'networks.update', archived: true
+    end
+  end
+end
diff --git a/spec/policies/referential_policy_spec.rb b/spec/policies/referential_policy_spec.rb
new file mode 100644
index 000000000..d060317f9
--- /dev/null
+++ b/spec/policies/referential_policy_spec.rb
@@ -0,0 +1,102 @@
+RSpec.describe ReferentialPolicy, type: :policy do
+
+  let( :record ){ build_stubbed :referential }
+
+
+  #
+  # Collection Based Permissions differ from standard as there is no referential yet
+  # --------------------------------------------------------------------------------
+
+  permissions :create? do
+    it 'permissions present → allowed' do
+      add_permissions('referentials.create', for_user: user)
+      expect_it.to permit(user_context, record)
+    end
+    it 'permissions absent → forbidden' do
+      expect_it.not_to permit(user_context, record)
+    end
+  end
+
+  permissions :new? do
+    it 'permissions present → allowed' do
+      add_permissions('referentials.create', for_user: user)
+      expect_it.to permit(user_context, record)
+    end
+    it 'permissions absent → forbidden' do
+      expect_it.not_to permit(user_context, record)
+    end
+  end
+
+  #
+  # Standard Destructive Action Permissions
+  # ---------------------------------------
+
+  permissions :destroy? do
+    it_behaves_like 'permitted policy and same organisation', 'referentials.destroy', archived: true
+  end
+  permissions :edit? do
+    it_behaves_like 'permitted policy and same organisation', 'referentials.update', archived: true
+  end
+  permissions :update? do
+    it_behaves_like 'permitted policy and same organisation', 'referentials.update', archived: true
+  end
+
+  #
+  # Custom Permissions
+  # ------------------
+
+  permissions :clone? do
+    it_behaves_like 'permitted policy and same organisation', 'referentials.create', archived: true
+  end
+
+  permissions :archive? do
+
+    context 'permission present →' do
+      before do
+        add_permissions('referentials.update', for_user: user)
+      end
+
+      it 'allowed for unarchived referentials' do
+        expect_it.to permit(user_context, record)
+      end
+
+      it 'forbidden for archived referentials' do
+        record.archived_at = 1.second.ago
+        expect_it.not_to permit(user_context, record)
+      end
+    end
+
+    context 'permission absent →' do 
+      it 'is forbidden' do
+        expect_it.not_to permit(user_context, record)
+      end
+    end
+
+  end
+
+  permissions :unarchive? do
+
+    context 'permission present →' do
+      before do
+        add_permissions('referentials.update', for_user: user)
+      end
+
+      it 'forbidden for unarchived referentials' do
+        expect_it.not_to permit(user_context, record)
+      end
+
+      it 'allowed for archived referentials' do
+        record.archived_at = 1.second.ago
+        expect_it.to permit(user_context, record)
+      end
+    end
+
+    context 'permission absent →' do 
+      it 'is forbidden' do
+        record.archived_at = 1.second.ago
+        expect_it.not_to permit(user_context, record)
+      end
+    end
+
+  end
+end
diff --git a/spec/policies/route_policy_spec.rb b/spec/policies/route_policy_spec.rb
index cc949ff45..6be517048 100644
--- a/spec/policies/route_policy_spec.rb
+++ b/spec/policies/route_policy_spec.rb
@@ -11,7 +11,7 @@ RSpec.describe RoutePolicy, type: :policy do
   end
 
   permissions :edit? do
-    it_behaves_like 'permitted policy and same organisation', 'routes.edit', archived: true
+    it_behaves_like 'permitted policy and same organisation', 'routes.update', archived: true
   end
 
   permissions :new? do
@@ -19,6 +19,6 @@ RSpec.describe RoutePolicy, type: :policy do
   end
 
   permissions :update? do
-    it_behaves_like 'permitted policy and same organisation', 'routes.edit', archived: true
+    it_behaves_like 'permitted policy and same organisation', 'routes.update', archived: true
   end
 end
diff --git a/spec/policies/routing_constraint_zone_policy_spec.rb b/spec/policies/routing_constraint_zone_policy_spec.rb
index f91313390..2ef15fa95 100644
--- a/spec/policies/routing_constraint_zone_policy_spec.rb
+++ b/spec/policies/routing_constraint_zone_policy_spec.rb
@@ -12,7 +12,7 @@ RSpec.describe RoutingConstraintZonePolicy, type: :policy do
   end
 
   permissions :edit? do
-    it_behaves_like 'permitted policy and same organisation', 'routing_constraint_zones.edit', archived: true
+    it_behaves_like 'permitted policy and same organisation', 'routing_constraint_zones.update', archived: true
   end
 
   permissions :new? do
@@ -20,6 +20,6 @@ RSpec.describe RoutingConstraintZonePolicy, type: :policy do
   end
 
   permissions :update? do
-    it_behaves_like 'permitted policy and same organisation', 'routing_constraint_zones.edit', archived: true
+    it_behaves_like 'permitted policy and same organisation', 'routing_constraint_zones.update', archived: true
   end
 end
diff --git a/spec/policies/stop_area_policy_spec.rb b/spec/policies/stop_area_policy_spec.rb
new file mode 100644
index 000000000..8fe59c8e3
--- /dev/null
+++ b/spec/policies/stop_area_policy_spec.rb
@@ -0,0 +1,42 @@
+RSpec.describe StopAreaPolicy, type: :policy do
+
+  let( :record ){ build_stubbed :stop_area }
+  before { stub_policy_scope(record) }
+
+
+  #
+  #  Non Destructive
+  #  ---------------
+
+  context 'Non Destructive actions →' do
+    permissions :index? do
+      it_behaves_like 'always allowed', 'anything', archived: true
+    end
+    permissions :show? do
+      it_behaves_like 'always allowed', 'anything', archived: true
+    end
+  end
+
+
+  #
+  #  Destructive
+  #  -----------
+
+  context 'Destructive actions →' do
+    permissions :create? do
+      it_behaves_like 'always forbidden', 'stop_areas.create', archived: true
+    end
+    permissions :destroy? do
+      it_behaves_like 'always forbidden', 'stop_areas.destroy', archived: true
+    end
+    permissions :edit? do
+      it_behaves_like 'always forbidden', 'stop_areas.update', archived: true
+    end
+    permissions :new? do
+      it_behaves_like 'always forbidden', 'stop_areas.create', archived: true
+    end
+    permissions :update? do
+      it_behaves_like 'always forbidden', 'stop_areas.update', archived: true
+    end
+  end
+end
diff --git a/spec/policies/time_table_policy_spec.rb b/spec/policies/time_table_policy_spec.rb
index 6c19362d2..dad3c13bc 100644
--- a/spec/policies/time_table_policy_spec.rb
+++ b/spec/policies/time_table_policy_spec.rb
@@ -2,17 +2,23 @@ RSpec.describe TimeTablePolicy, type: :policy do
 
   let( :record ){ build_stubbed :time_table }
 
+  permissions :create? do
+    it_behaves_like 'permitted policy and same organisation', 'time_tables.create', archived: true
+  end
+
+  permissions :destroy? do
+    it_behaves_like 'permitted policy and same organisation', 'time_tables.destroy', archived: true
+  end
 
-  %w{create duplicate}.each do | permission |
-    permissions "#{permission}?".to_sym do
-      it_behaves_like 'permitted policy and same organisation', 'time_tables.create', archived: true
-    end
+  permissions :edit? do
+    it_behaves_like 'permitted policy and same organisation', 'time_tables.update', archived: true
   end
 
-  %w{destroy edit}.each do | permission |
-    permissions "#{permission}?".to_sym do
-      it_behaves_like 'permitted policy and same organisation', "time_tables.#{permission}", archived: true
-    end
+  permissions :new? do
+    it_behaves_like 'permitted policy and same organisation', 'time_tables.create', archived: true
   end
 
+  permissions :update? do
+    it_behaves_like 'permitted policy and same organisation', 'time_tables.update', archived: true
+  end
 end