Merge pull request #151 from paviliondev/wizard-permissions

FIX: grant reply/edit permissions to topic author

extensions/guardian.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module CustomWizardGuardian
+  def can_edit_topic?(topic)
+    wizard_can_edit_topic?(topic) || super
+  end
+
+  def wizard_can_edit_topic?(topic)
+    created_by_wizard = !!topic.wizard_submission_id
+    (
+      is_my_own?(topic) &&
+      created_by_wizard &&
+      can_see_topic?(topic) &&
+      can_create_post_on_topic?(topic)
+    )
+  end
+end

lib/custom_wizard/action.rb

@@ -514,7 +514,12 @@ class CustomWizard::Action
 
   def basic_topic_params
     params = {
-      skip_validations: true
+      skip_validations: true,
+      topic_opts: {
+        custom_fields: {
+          wizard_submission_id: @wizard.current_submission.id
+        }
+      }
     }
 
     params[:title] = CustomWizard::Mapper.new(

plugin.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 # name: discourse-custom-wizard
 # about: Create custom wizards
-# version: 1.16.3
+# version: 1.16.4
 # authors: Angus McLeod
 # url: https://github.com/paviliondev/discourse-custom-wizard
 # contact emails: angus@thepavilion.io
@@ -108,6 +108,7 @@ after_initialize do
     ../serializers/custom_wizard/realtime_validation/similar_topics_serializer.rb
     ../extensions/extra_locales_controller.rb
     ../extensions/invites_controller.rb
+    ../extensions/guardian.rb
     ../extensions/users_controller.rb
     ../extensions/custom_field/preloader.rb
     ../extensions/custom_field/serializer.rb
@@ -125,6 +126,10 @@ after_initialize do
 
   Liquid::Template.register_filter(::CustomWizard::LiquidFilter::FirstNonEmpty)
 
+  add_to_class(:topic, :wizard_submission_id) do
+    custom_fields['wizard_submission_id']
+  end
+
   add_class_method(:wizard, :user_requires_completion?) do |user|
     wizard_result = self.new(user).requires_completion?
     return wizard_result if wizard_result
@@ -198,6 +203,7 @@ after_initialize do
   ::ExtraLocalesController.prepend ExtraLocalesControllerCustomWizard
   ::InvitesController.prepend InvitesControllerCustomWizard
   ::UsersController.prepend CustomWizardUsersController
+  ::Guardian.prepend CustomWizardGuardian
 
   full_path = "#{Rails.root}/plugins/discourse-custom-wizard/assets/stylesheets/wizard/wizard_custom.scss"
   if Stylesheet::Importer.respond_to?(:plugin_assets)

spec/extensions/guardian_extension_spec.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require_relative '../plugin_helper'
+
+describe ::Guardian do
+  fab!(:user) {
+    Fabricate(:user, name: "Angus", username: 'angus', email: "angus@email.com")
+  }
+  fab!(:category) { Fabricate(:category, name: 'cat1', slug: 'cat-slug') }
+  let(:wizard_template) {
+    JSON.parse(
+      File.open(
+        "#{Rails.root}/plugins/discourse-custom-wizard/spec/fixtures/wizard.json"
+      ).read
+    )
+  }
+
+  def create_topic_by_wizard(wizard)
+    wizard.create_updater(
+      wizard.steps.first.id,
+      step_1_field_1: "Topic Title",
+      step_1_field_2: "topic body"
+    ).update
+    wizard.create_updater(wizard.steps.second.id, {}).update
+    wizard.create_updater(wizard.steps.last.id,
+      step_3_field_3: category.id
+    ).update
+
+    topic = Topic.where(
+      title: "Topic Title",
+      category_id: category.id
+    ).first
+
+    topic
+  end
+
+  before do
+    CustomWizard::Template.save(wizard_template, skip_jobs: true)
+    @template = CustomWizard::Template.find('super_mega_fun_wizard')
+  end
+
+  context "topic created by user using wizard" do
+    it "allows editing the topic first post" do
+      wizard = CustomWizard::Builder.new(@template[:id], user).build
+      topic = create_topic_by_wizard(wizard)
+      expect(user.guardian.wizard_can_edit_topic?(topic)).to be_truthy
+    end
+  end
+
+  context "topic created by user without wizard" do
+    it "restricts editing the topic first post" do
+      topic_params = {
+        title: "Topic Title",
+        raw: "Topic body",
+        skip_validations: true
+      }
+      post = PostCreator.new(user, topic_params).create
+      expect(user.guardian.wizard_can_edit_topic?(post.topic)).to be_falsey
+    end
+  end
+end