feat: keep profiles hidden for non participants

app/controllers/users_controller.rb

@@ -10,7 +10,9 @@ class UsersController < ApplicationController
 
   def index; end
 
-  def show; end
+  def show
+    raise ActiveRecord::RecordNotFound if current_user != user && user.events.none? && user.participants.none?
+  end
 
   def edit
     return unless current_user.missing_name?

spec/controllers/users_controller_spec.rb

@@ -30,13 +30,34 @@
     context 'when user has no email' do
       render_views
 
-      before { user.update!(email: nil) }
+      before do
+        user.update!(email: nil)
+        allow(@controller).to receive_messages(current_user: user)
+      end
 
       it 'does not fail' do
         get :show, params: { id: user.id }
         expect(response).to be_ok
       end
     end
+
+    context 'when player never participated' do
+      it 'renders not found' do
+        get :show, params: { id: user }
+        expect(response).to be_not_found
+      end
+    end
+
+    context 'when player views his own profile, but did not participate yet' do
+      before do
+        allow(@controller).to receive_messages(current_user: user)
+      end
+
+      it 'shows the user profile' do
+        get :show, params: { id: user }
+        expect(response).to be_ok
+      end
+    end
   end
 
   context 'GET :edit' do