discourse/spec/lib/post_localization_updater_spec.rb
Natalie Tay 71b96243e1
FIX: Also check if user can see post or topic prior to letting them localize it (#36749)
There exists a `localization_guardian` that checks if a user can
localize based on settings like
- `content_localization_allowed_groups`
- `content_localization_allow_author_localization`

However, it missed out checking if the user can even see the model.

This commit fixes that by adding the checks. This issue was found as I was
adding a new model (`tags`) and discovered they were absent for the
older models.

This commit also introduces a small refactor that `.find`s the model first
on the controller and passes the object, so that the subsequent services
do not have to `.find` them again.
2025-12-18 02:12:58 +08:00

75 lines
2.4 KiB
Ruby

# frozen_string_literal: true
describe PostLocalizationUpdater do
fab!(:user)
fab!(:post) { Fabricate(:post, version: 99) }
fab!(:group)
fab!(:post_localization) do
Fabricate(:post_localization, post: post, locale: "ja", raw: "古いバージョン")
end
fab!(:locale) { "ja" }
let(:new_raw) { "新しいバージョンです" }
before do
SiteSetting.content_localization_enabled = true
SiteSetting.content_localization_allowed_groups = group.id.to_s
group.add(user)
end
it "updates an existing localization" do
localization = described_class.update(post:, locale:, raw: new_raw, user:)
expect(localization).to have_attributes(
raw: new_raw,
cooked: PrettyText.cook(new_raw),
localizer_user_id: user.id,
post_version: post.version,
)
end
it "returns the localization unchanged if the raw content is the same" do
localization = described_class.update(post:, locale:, raw: post_localization.raw, user:)
expect(localization.id).to eq(post_localization.id)
expect(localization.localizer_user_id).not_to eq(user.id)
end
it "enqueues ProcessLocalizedCook job" do
loc = described_class.update(post:, locale:, raw: new_raw, user:)
expect_job_enqueued(job: :process_localized_cooked, args: { post_localization_id: loc.id })
end
it "raises not found if the localization is missing" do
expect { described_class.update(post:, locale: "nope", raw: new_raw, user:) }.to raise_error(
Discourse::NotFound,
)
end
context "with author localization" do
fab!(:author, :user)
fab!(:author_post) { Fabricate(:post, user: author) }
fab!(:other_post, :post)
fab!(:post_localization) { Fabricate(:post_localization, post: author_post, locale:) }
before { SiteSetting.content_localization_allow_author_localization = true }
it "allows post author to create localization for their own post" do
localization = described_class.update(post: author_post, locale:, raw: new_raw, user: author)
expect(localization).to have_attributes(
post_id: author_post.id,
locale:,
raw: new_raw,
localizer_user_id: author.id,
)
end
it "raises permission error if user is not the post author" do
expect {
described_class.update(post: other_post, locale:, raw: new_raw, user: author)
}.to raise_error(Discourse::InvalidAccess)
end
end
end