Merge pull request #2745 from evazion/fix-private-topics

Fix listing private topics in /forum_posts; fix private topic bumping

app/models/forum_post.rb

@@ -54,8 +54,12 @@ class ForumPost < ActiveRecord::Base
       where("forum_posts.is_deleted = false")
     end
 
+    def permitted
+      joins(:topic).where("min_level <= ?", CurrentUser.level)
+    end
+
     def search(params)
-      q = where("true")
+      q = permitted
       return q if params.blank?
 
       if params[:creator_id].present?

app/models/forum_topic.rb

@@ -57,8 +57,12 @@ class ForumTopic < ActiveRecord::Base
       where("is_deleted = false")
     end
 
+    def permitted
+      where("min_level <= ?", CurrentUser.level)
+    end
+
     def search(params)
-      q = where("true")
+      q = permitted
       return q if params.blank?
 
       if params[:title_matches].present?

app/models/user.rb

@@ -489,7 +489,7 @@ class User < ActiveRecord::Base
   module ForumMethods
     def has_forum_been_updated?
       return false unless is_gold?
-      max_updated_at = ForumTopic.active.maximum(:updated_at)
+      max_updated_at = ForumTopic.permitted.active.maximum(:updated_at)
       return false if max_updated_at.nil?
       return true if last_forum_read_at.nil?
       return max_updated_at > last_forum_read_at

test/factories/forum_topic.rb

@@ -4,5 +4,9 @@ FactoryGirl.define do
     is_sticky false
     is_locked false
     category_id 0
+
+    factory(:mod_up_forum_topic) do
+      min_level User::Levels::MODERATOR
+    end
   end
 end

test/functional/forum_posts_controller_test.rb

@@ -36,6 +36,31 @@ class ForumPostsControllerTest < ActionController::TestCase
           assert_equal(0, assigns(:forum_posts).size)
         end
       end
+
+      context "with private topics" do
+        setup do
+          @mod_topic = FactoryGirl.create(:mod_up_forum_topic)
+          @mod_posts = 2.times.map do
+            FactoryGirl.create(:forum_post, :topic_id => @mod_topic.id)
+          end
+          @mod_post_ids = ([@forum_post] + @mod_posts).map(&:id).reverse
+        end
+
+        should "list only permitted posts for members" do
+          get :index, {}, { :user_id => @user.id }
+
+          assert_response :success
+          assert_equal([@forum_post.id], assigns(:forum_posts).map(&:id))
+        end
+
+        should "list only permitted posts for mods" do
+          CurrentUser.user = @mod
+          get :index, {}, { :user_id => @mod.id }
+
+          assert_response :success
+          assert_equal(@mod_post_ids, assigns(:forum_posts).map(&:id))
+        end
+      end
     end
 
     context "edit action" do

test/functional/forum_topics_controller_test.rb

@@ -25,6 +25,26 @@ class ForumTopicsControllerTest < ActionController::TestCase
         get :show, {:id => @forum_topic.id}  
         assert_redirected_to forum_topics_path
       end
+
+      should "not bump the forum for users without access" do
+        @gold_user = FactoryGirl.create(:gold_user)
+        CurrentUser.user = @gold_user
+
+        # An open topic should bump...
+        @open_topic = FactoryGirl.create(:forum_topic)
+        assert_equal(true, @gold_user.has_forum_been_updated?)
+
+        # Marking it as read should clear it...
+        CurrentUser.scoped(@gold_user) do
+          post :mark_all_as_read, {}, {:user_id => @gold_user.id}
+        end
+        assert_redirected_to(forum_topics_path)
+        assert_equal(false, @gold_user.reload.has_forum_been_updated?)
+
+        # Then adding an unread private topic should not bump.
+        FactoryGirl.create(:forum_post, :topic_id => @forum_topic.id)
+        assert_equal(false, @gold_user.reload.has_forum_been_updated?)
+      end
     end
 
     context "show action" do