pundit: convert post replacements to pundit.

test/functional/post_replacements_controller_test.rb

@@ -3,8 +3,8 @@ require 'test_helper'
 class PostReplacementsControllerTest < ActionDispatch::IntegrationTest
   context "The post replacements controller" do
     setup do
-      @user = create(:moderator_user, can_approve_posts: true, created_at: 1.month.ago)
-      @user.as_current do
+      @mod = create(:moderator_user, can_approve_posts: true, created_at: 1.month.ago)
+      as(@mod) do
         @post = create(:post, source: "https://google.com")
         @post_replacement = create(:post_replacement, post: @post)
       end
@@ -20,19 +20,25 @@ class PostReplacementsControllerTest < ActionDispatch::IntegrationTest
           }
         }
 
-        assert_difference(-> { @post.replacements.size }) do
-          post_auth post_replacements_path, @user, params: params
-          @post.reload
+        assert_difference("PostReplacement.count") do
+          post_auth post_replacements_path, @mod, params: params
+          assert_response :success
         end
 
         travel(PostReplacement::DELETION_GRACE_PERIOD + 1.day)
         perform_enqueued_jobs
 
-        assert_response :success
-        assert_equal("https://cdn.donmai.us/original/d3/4e/d34e4cf0a437a5d65f8e82b7bcd02606.jpg", @post.source)
+        assert_equal("https://cdn.donmai.us/original/d3/4e/d34e4cf0a437a5d65f8e82b7bcd02606.jpg", @post.reload.source)
         assert_equal("d34e4cf0a437a5d65f8e82b7bcd02606", @post.md5)
         assert_equal("d34e4cf0a437a5d65f8e82b7bcd02606", Digest::MD5.file(@post.file(:original)).hexdigest)
       end
+
+      should "not allow non-mods to replace posts" do
+        assert_difference("PostReplacement.count", 0) do
+          post_auth post_replacements_path(post_id: @post.id), create(:user), params: { post_replacement: { replacement_url: "https://cdn.donmai.us/original/d3/4e/d34e4cf0a437a5d65f8e82b7bcd02606.jpg" }}
+          assert_response 403
+        end
+      end
     end
 
     context "update action" do
@@ -46,9 +52,9 @@ class PostReplacementsControllerTest < ActionDispatch::IntegrationTest
           }
         }
 
-        put_auth post_replacement_path(@post_replacement), @user, params: params
-        @post_replacement.reload
-        assert_equal(23, @post_replacement.file_size_was)
+        put_auth post_replacement_path(@post_replacement), @mod, params: params
+        assert_response :success
+        assert_equal(23, @post_replacement.reload.file_size_was)
         assert_equal(42, @post_replacement.file_size)
       end
     end