discourse/plugins/discourse-assign/test/javascripts/acceptance/group-assignments-test.js
Isaac Janzen de960665f4
FIX: Assignments tab can render for groups whose member list is forbidden, leading to a guaranteed 403 (#40006)
## Summary

This patch fixes a UI inconsistency where the Group Assignments tab
remained visible to users who lacked permission to view a group's
members. Although the backend correctly enforced these permissions by
returning a 403 error, the UI failed to hide the entry point, leading to
a broken user experience.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/887

---

🤖 Auto-generated from the patch diff via Patch Triage. Review carefully
before merging.
2026-05-13 15:27:11 -05:00

56 lines
2.1 KiB
JavaScript
Vendored

import { visit } from "@ember/test-helpers";
import { test } from "qunit";
import { cloneJSON } from "discourse/lib/object";
import GroupFixtures from "discourse/tests/fixtures/group-fixtures";
import {
acceptance,
updateCurrentUser,
} from "discourse/tests/helpers/qunit-helpers";
import AssignedTopics from "../fixtures/assigned-group-assignments-fixtures";
import GroupMembers from "../fixtures/group-members-fixtures";
let canSeeMembers = true;
acceptance("GroupAssignments", function (needs) {
needs.user();
needs.settings({ assign_enabled: true, assigns_user_url_path: "/" });
needs.hooks.beforeEach(() => {
canSeeMembers = true;
});
needs.pretender((server, helper) => {
const groupPath = "/topics/group-topics-assigned/discourse.json";
const memberPath = "/topics/messages-assigned/ahmedgagan6.json";
const getMembersPath = "/assign/members/discourse";
const groupAssigns = AssignedTopics[groupPath];
const memberAssigns = AssignedTopics[memberPath];
const getMembers = GroupMembers[getMembersPath];
server.get("/groups/discourse.json", () => {
const response = cloneJSON(GroupFixtures["/groups/discourse.json"]);
response.group.can_show_assigned_tab = true;
response.group.can_see_members = canSeeMembers;
return helper.response(response);
});
server.get(groupPath, () => helper.response(groupAssigns));
server.get(memberPath, () => helper.response(memberAssigns));
server.get(getMembersPath, () => helper.response(getMembers));
});
test("Group Assignments Everyone", async function (assert) {
await visit("/g/discourse/assigned");
assert.dom(".topic-list-item").exists({ count: 1 });
});
test("Group Assignments Ahmedgagan", async function (assert) {
await visit("/g/discourse/assigned/ahmedgagan6");
assert.dom(".topic-list-item").exists({ count: 1 });
});
test("does not show the Assignments tab when group members are hidden", async function (assert) {
updateCurrentUser({ can_assign: true });
canSeeMembers = false;
await visit("/g/discourse");
assert.dom(".assigned-topic-list").doesNotExist();
});
});