pundit: convert saved searches to pundit.

app/controllers/saved_searches_controller.rb

@@ -2,43 +2,36 @@ class SavedSearchesController < ApplicationController
   respond_to :html, :xml, :json, :js
 
   def index
-    @saved_searches = saved_searches.paginated_search(params, count_pages: true)
+    @saved_searches = authorize SavedSearch.where(user: CurrentUser.user).paginated_search(params, count_pages: true)
     respond_with(@saved_searches)
   end
 
   def labels
+    authorize SavedSearch
     @labels = SavedSearch.search_labels(CurrentUser.id, params[:search]).take(params[:limit].to_i || 10)
     respond_with(@labels)
   end
 
   def create
-    @saved_search = saved_searches.create(saved_search_params)
+    @saved_search = authorize SavedSearch.new(user: CurrentUser.user, **permitted_attributes(SavedSearch))
+    @saved_search.save
     respond_with(@saved_search)
   end
 
   def destroy
-    @saved_search = saved_searches.find(params[:id])
+    @saved_search = authorize SavedSearch.find(params[:id])
     @saved_search.destroy
     respond_with(@saved_search)
   end
 
   def edit
-    @saved_search = saved_searches.find(params[:id])
+    @saved_search = authorize SavedSearch.find(params[:id])
+    respond_with(@saved_search)
   end
 
   def update
-    @saved_search = saved_searches.find(params[:id])
-    @saved_search.update(saved_search_params)
+    @saved_search = authorize SavedSearch.find(params[:id])
+    @saved_search.update(permitted_attributes(@saved_search))
     respond_with(@saved_search, :location => saved_searches_path)
   end
-
-  private
-
-  def saved_searches
-    CurrentUser.user.saved_searches
-  end
-
-  def saved_search_params
-    params.fetch(:saved_search, {}).permit(%i[query label_string disable_labels])
-  end
 end

app/models/saved_search.rb

@@ -169,7 +169,7 @@ class SavedSearch < ApplicationRecord
   end
 
   def disable_labels=(value)
-    CurrentUser.update(disable_categorized_saved_searches: true) if value.to_s.truthy?
+    user.update(disable_categorized_saved_searches: true) if value.to_s.truthy?
   end
 
   def self.available_includes

app/policies/saved_search_policy.rb

@@ -0,0 +1,21 @@
+class SavedSearchPolicy < ApplicationPolicy
+  def index?
+    user.is_member?
+  end
+
+  def create?
+    user.is_member?
+  end
+
+  def update?
+    record.user_id == user.id
+  end
+
+  def labels?
+    index?
+  end
+
+  def permitted_attributes
+    [:query, :label_string, :disable_labels]
+  end
+end

test/functional/saved_searches_controller_test.rb

@@ -4,9 +4,7 @@ class SavedSearchesControllerTest < ActionDispatch::IntegrationTest
   context "The saved searches controller" do
     setup do
       @user = create(:user)
-      as_user do
-        @saved_search = create(:saved_search, user: @user)
-      end
+      @saved_search = create(:saved_search, user: @user)
     end
 
     context "index action" do
@@ -17,24 +15,29 @@ class SavedSearchesControllerTest < ActionDispatch::IntegrationTest
       end
     end
 
+    context "labels action" do
+      should "render" do
+        get_auth labels_saved_searches_path, @user, as: :json
+        assert_response :success
+      end
+    end
+
     context "create action" do
       should "render" do
         post_auth saved_searches_path, @user, params: { saved_search: { query: "bkub", label_string: "artist" }}
-        assert_response :redirect
+        assert_redirected_to SavedSearch.last
       end
 
       should "disable labels when the disable_labels param is given" do
         post_auth saved_searches_path, @user, params: { saved_search: { query: "bkub", disable_labels: "1" }}
+        assert_redirected_to SavedSearch.last
         assert_equal(true, @user.reload.disable_categorized_saved_searches)
       end
     end
 
     context "edit action" do
       should "render" do
-        as_user do
-          @saved_search = create(:saved_search, user: @user)
-        end
-
+        @saved_search = create(:saved_search, user: @user)
         get_auth edit_saved_search_path(@saved_search), @user, params: { id: @saved_search.id }
         assert_response :success
       end
@@ -42,24 +45,33 @@ class SavedSearchesControllerTest < ActionDispatch::IntegrationTest
 
     context "update action" do
       should "render" do
-        as_user do
-          @saved_search = create(:saved_search, user: @user)
-        end
-        params = { id: @saved_search.id, saved_search: { label_string: "foo" } }
-        put_auth saved_search_path(@saved_search), @user, params: params
+        put_auth saved_search_path(@saved_search), @user, params: { saved_search: { label_string: "foo" }}
         assert_redirected_to saved_searches_path
         assert_equal(["foo"], @saved_search.reload.labels)
       end
+
+      should "not allow users to update saved searches belonging to other users" do
+        put_auth saved_search_path(@saved_search), create(:user), params: { saved_search: { label_string: "foo" }}
+        assert_response 403
+        assert_not_equal(["foo"], @saved_search.reload.labels)
+      end
     end
 
     context "destroy action" do
       should "render" do
-        as_user do
-          @saved_search = create(:saved_search, user: @user)
+        @saved_search = create(:saved_search, user: @user)
+        assert_difference("SavedSearch.count", -1) do
+          delete_auth saved_search_path(@saved_search), @user
+          assert_redirected_to saved_searches_path
         end
+      end
 
-        delete_auth saved_search_path(@saved_search), @user
-        assert_redirected_to saved_searches_path
+      should "not allow users to destroy saved searches belonging to other users" do
+        @saved_search = create(:saved_search, user: @user)
+        assert_difference("SavedSearch.count", 0) do
+          delete_auth saved_search_path(@saved_search), create(:user)
+          assert_response 403
+        end
       end
     end
   end