From 17ffe3590a1c386d8160d588d5875438a11397b6 Mon Sep 17 00:00:00 2001
From: evazion <noizave@gmail.com>
Date: Mon, 2 May 2022 15:43:44 -0500
Subject: [PATCH] Fix #4982: Add route to remove a post from a favorite group

---
 app/controllers/favorite_groups_controller.rb |  8 ++++++
 app/policies/favorite_group_policy.rb         |  4 +++
 app/views/favorite_groups/remove_post.js.erb  |  7 +++++
 config/routes.rb                              |  1 +
 .../favorite_groups_controller_test.rb        | 27 +++++++++++++++++++
 5 files changed, 47 insertions(+)
 create mode 100644 app/views/favorite_groups/remove_post.js.erb

diff --git a/app/controllers/favorite_groups_controller.rb b/app/controllers/favorite_groups_controller.rb
index a5ba8ee6d..5869ae604 100644
--- a/app/controllers/favorite_groups_controller.rb
+++ b/app/controllers/favorite_groups_controller.rb
@@ -59,4 +59,12 @@ class FavoriteGroupsController < ApplicationController
 
     respond_with(@favorite_group)
   end
+
+  def remove_post
+    @favorite_group = authorize FavoriteGroup.find(params[:id])
+    @post = Post.find(params[:post_id])
+    @favorite_group.remove(@post)
+
+    respond_with(@favorite_group)
+  end
 end
diff --git a/app/policies/favorite_group_policy.rb b/app/policies/favorite_group_policy.rb
index b201ab70a..5bd377284 100644
--- a/app/policies/favorite_group_policy.rb
+++ b/app/policies/favorite_group_policy.rb
@@ -17,6 +17,10 @@ class FavoriteGroupPolicy < ApplicationPolicy
     update?
   end
 
+  def remove_post?
+    update?
+  end
+
   def can_enable_privacy?
     record.creator.is_gold?
   end
diff --git a/app/views/favorite_groups/remove_post.js.erb b/app/views/favorite_groups/remove_post.js.erb
new file mode 100644
index 000000000..485d88ecf
--- /dev/null
+++ b/app/views/favorite_groups/remove_post.js.erb
@@ -0,0 +1,7 @@
+<% if @favorite_group.errors.any? %>
+  Danbooru.notice("<%= j @favorite_group.errors.full_messages.join("; ") %>");
+<% else %>
+  Danbooru.notice("Removed post from favorite group <%= j @favorite_group.pretty_name %>");
+<% end %>
+
+$("#add-to-favgroup-dialog").dialog("close");
diff --git a/config/routes.rb b/config/routes.rb
index ca9b90873..737536a67 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -125,6 +125,7 @@ Rails.application.routes.draw do
   resources :favorite_groups do
     member do
       put :add_post
+      put :remove_post
     end
     resource :order, :only => [:edit], :controller => "favorite_group_orders"
   end
diff --git a/test/functional/favorite_groups_controller_test.rb b/test/functional/favorite_groups_controller_test.rb
index bba7a91ce..6e9c22194 100644
--- a/test/functional/favorite_groups_controller_test.rb
+++ b/test/functional/favorite_groups_controller_test.rb
@@ -116,6 +116,7 @@ class FavoriteGroupsControllerTest < ActionDispatch::IntegrationTest
       should "render" do
         @post = create(:post)
         put_auth add_post_favorite_group_path(@favgroup), @user, params: {post_id: @post.id, format: "js"}
+
         assert_response :success
         assert_equal([@post.id], @favgroup.reload.post_ids)
       end
@@ -123,7 +124,33 @@ class FavoriteGroupsControllerTest < ActionDispatch::IntegrationTest
       should "not add posts to favgroups belonging to other users" do
         @post = create(:post)
         put_auth add_post_favorite_group_path(@favgroup), create(:user), params: {post_id: @post.id, format: "js"}
+
         assert_response 403
+        assert_equal([], @favgroup.reload.post_ids)
+      end
+    end
+
+    context "remove_post action" do
+      should "render" do
+        @post = create(:post)
+        @favgroup.add(@post)
+        assert_equal([@post.id], @favgroup.reload.post_ids)
+
+        put_auth remove_post_favorite_group_path(@favgroup), @user, params: { post_id: @post.id, format: "js" }
+
+        assert_response :success
+        assert_equal([], @favgroup.reload.post_ids)
+      end
+
+      should "not remove posts from favgroups belonging to other users" do
+        @post = create(:post)
+        @favgroup.add(@post)
+        assert_equal([@post.id], @favgroup.reload.post_ids)
+
+        put_auth remove_post_favorite_group_path(@favgroup), create(:user), params: { post_id: @post.id, format: "js" }
+
+        assert_response 403
+        assert_equal([@post.id], @favgroup.reload.post_ids)
       end
     end