AO3-7010 AO3-7017 Fix error when trying to access subpage of hidden unrevealed work (otwcode#5219)

* AO3-7010 Fix error when trying to access subpage of hidden unrevealed work

* AO3-7017 Restrict access to subpages for draft and restricted works

Author: Bilka2

app/controllers/application_controller.rb

@@ -508,12 +508,11 @@ def check_permission_to_wrangle
   end
 
   # Checks if user is allowed to see related page if parent item is hidden or in unrevealed collection
+  # Checks if user is logged in if parent item is restricted
   def check_visibility_for(parent)
-    # Only admins and the owner can see related pages on something hidden by an admin.
-    logged_in_as_admin? || current_user_owns?(parent) || access_denied(redirect: root_path) if parent.try(:hidden_by_admin)
+    return if logged_in_as_admin? || current_user_owns?(parent) # Admins and the owner can see all related pages
 
-    # Only admins and the owner can see related pages on unrevealed works.
-    logged_in_as_admin? || current_user_owns?(parent) || access_denied(redirect: root_path) if parent.try(:in_unrevealed_collection)
+    access_denied(redirect: root_path) if parent.try(:hidden_by_admin) || parent.try(:in_unrevealed_collection) || (parent.respond_to?(:visible?) && !parent.visible?)
   end
 
   public

spec/controllers/bookmarks_controller_spec.rb

@@ -369,6 +369,15 @@ def it_redirects_to_user_login
 
       include_examples "denies access for work that isn't visible to user"
     end
+
+    context "denies access for restricted work to guest" do
+      let(:work) { create(:work, restricted: true) }
+
+      it "redirects with an error" do
+        get :index, params: { work_id: work }
+        it_redirects_to_with_error(root_path, "Sorry, you don't have permission to access the page you were trying to reach. Please log in.")
+      end
+    end
   end
 
   describe "show" do

spec/controllers/collections_controller_spec.rb

@@ -19,6 +19,15 @@
 
       include_examples "denies access for work that isn't visible to user"
     end
+
+    context "denies access for restricted work to guest" do
+      let(:work) { create(:work, restricted: true) }
+
+      it "redirects with an error" do
+        get :index, params: { work_id: work }
+        it_redirects_to_with_error(root_path, "Sorry, you don't have permission to access the page you were trying to reach. Please log in.")
+      end
+    end
   end
 
   describe "GET #show" do

spec/controllers/comments/default_rails_actions_spec.rb

@@ -1002,5 +1002,22 @@
 
       it_redirects_to_simple("/404")
     end
+
+    context "denies access for work that isn't visible to user" do
+      subject { get :index, params: { work_id: work } }
+      let(:success) { expect(response).to render_template("index") }
+      let(:success_admin) { success }
+
+      include_examples "denies access for work that isn't visible to user"
+    end
+
+    context "denies access for restricted work to guest" do
+      let(:work) { create(:work, restricted: true) }
+
+      it "redirects with an error" do
+        get :index, params: { work_id: work }
+        it_redirects_to(new_user_session_path(restricted_commenting: true))
+      end
+    end
   end
 end

spec/controllers/kudos_controller_spec.rb

@@ -238,5 +238,14 @@
 
       include_examples "denies access for work that isn't visible to user"
     end
+
+    context "denies access for restricted work to guest" do
+      let(:work) { create(:work, restricted: true) }
+
+      it "redirects with an error" do
+        get :index, params: { work_id: work }
+        it_redirects_to_with_error(root_path, "Sorry, you don't have permission to access the page you were trying to reach. Please log in.")
+      end
+    end
   end
 end

spec/controllers/works/works_controller_spec.rb

@@ -14,5 +14,14 @@
 
       include_examples "denies access for work that isn't visible to user"
     end
+
+    context "denies access for restricted work to guest" do
+      let(:work) { create(:work, restricted: true) }
+
+      it "redirects with an error" do
+        get :navigate, params: { id: work.id }
+        it_redirects_to_with_error(root_path, "Sorry, you don't have permission to access the page you were trying to reach. Please log in.")
+      end
+    end
   end
 end

spec/support/shared_examples/access_shared_examples.rb

@@ -67,4 +67,16 @@
 
     include_examples "denies access to random user"
   end
+
+  context "hidden and unrevealed work" do
+    let(:work) { create(:work, authors: [creator.default_pseud], collections: [create(:unrevealed_collection)], hidden_by_admin: true) }
+
+    include_examples "denies access to random user"
+  end
+
+  context "draft work" do
+    let(:work) { create(:draft, authors: [creator.default_pseud]) }
+
+    include_examples "denies access to random user"
+  end
 end