diff --git a/app/helpers/search_helper.rb b/app/helpers/search_helper.rb index fe21b7d35..d81c25311 100644 --- a/app/helpers/search_helper.rb +++ b/app/helpers/search_helper.rb @@ -1,12 +1,12 @@ module SearchHelper - def check_posts_permissions - (current_user&.is_moderator || current_user&.is_admin ? Post : Post.undeleted) + # @param user [User] user to check + def get_accessible_posts(user) + (user&.is_moderator || user&.is_admin ? Post : Post.undeleted) .qa_only.list_includes end def search_posts - posts = check_posts_permissions - + posts = get_accessible_posts(current_user) qualifiers = params_to_qualifiers search_string = params[:search] diff --git a/test/helpers/search_helper_test.rb b/test/helpers/search_helper_test.rb index a82e92f6f..f09395e48 100644 --- a/test/helpers/search_helper_test.rb +++ b/test/helpers/search_helper_test.rb @@ -35,4 +35,22 @@ class SearchHelperTest < ActionView::TestCase assert_equal expect, date_value_sql(input) end end + + test 'get_accessible_posts should correctly check access' do + admin_user = users(:admin) + mod_user = users(:moderator) + standard_user = users(:standard_user) + + admin_posts = get_accessible_posts(admin_user) + mod_posts = get_accessible_posts(mod_user) + user_posts = get_accessible_posts(standard_user) + + can_admin_get_deleted_posts = admin_posts.any?(&:deleted) + can_mod_get_deleted_posts = mod_posts.any?(&:deleted) + can_user_get_deleted_posts = user_posts.any?(&:deleted) + + assert_equal can_admin_get_deleted_posts, true + assert_equal can_mod_get_deleted_posts, true + assert_equal can_user_get_deleted_posts, false + end end