fe 2.3.2 → 2.4.0

data/spec/lib/fe/access_control_spec.rb

@@ -0,0 +1,173 @@
+require 'rails_helper'
+
+describe Fe do
+  describe '.allowed_answer_sheet_types' do
+    after { Fe.answer_sheet_types = nil }
+
+    it 'defaults to the answer sheet class and reference sheet' do
+      expect(Fe.allowed_answer_sheet_types).to eq(['Fe::Application', 'Fe::ReferenceSheet'])
+    end
+
+    it 'uses answer_sheet_types when set' do
+      Fe.answer_sheet_types = ['Foo']
+      expect(Fe.allowed_answer_sheet_types).to eq(['Foo'])
+    end
+  end
+
+  describe '.answer_sheet_class_for' do
+    it 'returns the default answer sheet class for a blank name' do
+      expect(Fe.answer_sheet_class_for(nil)).to eq(Fe::Application)
+      expect(Fe.answer_sheet_class_for('')).to eq(Fe::Application)
+    end
+
+    it 'returns an allowed class' do
+      expect(Fe.answer_sheet_class_for('Fe::ReferenceSheet')).to eq(Fe::ReferenceSheet)
+    end
+
+    ['Kernel', 'Fe::Element', '::Fe::Application', ' Fe::Application', 'fe::application'].each do |name|
+      it "rejects #{name.inspect}" do
+        expect { Fe.answer_sheet_class_for(name) }.to raise_error(ActiveRecord::RecordNotFound)
+      end
+    end
+  end
+
+  describe '.element_class_for' do
+    it 'returns an allowed class' do
+      expect(Fe.element_class_for('Fe::TextField')).to eq(Fe::TextField)
+    end
+
+    ['Fe::Question', 'Fe::Application', 'Kernel'].each do |name|
+      it "rejects #{name.inspect}" do
+        expect { Fe.element_class_for(name) }.to raise_error(ActiveRecord::RecordNotFound)
+      end
+    end
+  end
+
+  describe '.access_key_matches?' do
+    let(:sheet) { build(:reference_sheet, access_key: 'abc123') }
+
+    it 'is true for the sheet key' do
+      expect(Fe.access_key_matches?(sheet, 'abc123')).to be true
+    end
+
+    ['wrong', nil, '', ['abc123'], { 'abc123' => 'v' }].each do |key|
+      it "is false for #{key.inspect}" do
+        expect(Fe.access_key_matches?(sheet, key)).to be false
+      end
+    end
+
+    it 'is false when the sheet has no access key' do
+      sheet.access_key = nil
+      expect(Fe.access_key_matches?(sheet, 'abc123')).to be false
+      sheet.access_key = ''
+      expect(Fe.access_key_matches?(sheet, '')).to be false
+    end
+  end
+
+  describe '.verify_access_hooks!' do
+    let(:answer_hook) { :fe_can_use_answer_sheet? }
+
+    def stub_lists(answer: [], admin: [])
+      stub_const('Fe::ANSWER_SHEET_CONTROLLERS', answer)
+      stub_const('Fe::ADMIN_CONTROLLERS', admin)
+    end
+
+    it 'passes for the dummy app with the real lists' do
+      expect(Fe.verify_access_hooks!).to be_nil
+    end
+
+    it 'raises when an answer sheet controller has no hook' do
+      stub_const('FeNoHooksController', Class.new)
+      stub_lists(answer: %w[FeNoHooksController])
+
+      expect { Fe.verify_access_hooks! }.to raise_error(Fe::MissingAccessHook) { |e|
+        expect(e.message).to include('fe_can_use_answer_sheet?', 'FeNoHooksController', 'Access control')
+      }
+    end
+
+    it 'raises when an admin controller has no fe_admin?' do
+      stub_const('FeNoAdminController', Class.new)
+      stub_lists(admin: %w[FeNoAdminController])
+
+      expect { Fe.verify_access_hooks! }.to raise_error(Fe::MissingAccessHook) { |e|
+        expect(e.message).to include('fe_admin?', 'FeNoAdminController')
+      }
+    end
+
+    it 'requires fe_admin? on the answer sheets controller' do
+      klass = Class.new do
+        protected
+
+        def fe_can_use_answer_sheet?(*) = true
+      end
+      stub_const('Fe::AnswerSheetsController', klass)
+      stub_lists(answer: %w[Fe::AnswerSheetsController])
+
+      expect { Fe.verify_access_hooks! }.to raise_error(Fe::MissingAccessHook) { |e|
+        expect(e.message).to include('fe_admin?', 'Fe::AnswerSheetsController')
+        expect(e.message).not_to include('fe_can_use_answer_sheet?')
+      }
+    end
+
+    it 'names every missing method and class in one error' do
+      stub_const('FeNoHooksController', Class.new)
+      stub_const('FeNoAdminController', Class.new)
+      stub_lists(answer: %w[FeNoHooksController], admin: %w[FeNoAdminController])
+
+      expect { Fe.verify_access_hooks! }.to raise_error(Fe::MissingAccessHook) { |e|
+        expect(e.message).to include('fe_can_use_answer_sheet?', 'FeNoHooksController', 'fe_admin?', 'FeNoAdminController')
+      }
+    end
+
+    it 'passes when both hooks are inherited from a parent' do
+      parent = Class.new do
+        protected
+
+        def fe_can_use_answer_sheet?(*) = true
+        def fe_admin? = true
+      end
+      stub_const('FeChildAnswerController', Class.new(parent))
+      stub_const('FeChildAdminController', Class.new(parent))
+      stub_lists(answer: %w[FeChildAnswerController], admin: %w[FeChildAdminController])
+
+      expect(Fe.verify_access_hooks!).to be_nil
+    end
+
+    it 'passes when the hook comes from a prepended module' do
+      mod = Module.new do
+        def fe_can_use_answer_sheet?(*) = true
+      end
+      klass = Class.new
+      klass.prepend(mod)
+      stub_const('FePrependedController', klass)
+      stub_lists(answer: %w[FePrependedController])
+
+      expect(Fe.verify_access_hooks!).to be_nil
+    end
+
+    it 'passes when the hook is a protected method on the class itself' do
+      klass = Class.new do
+        protected
+
+        def fe_admin? = true
+      end
+      stub_const('FeProtectedController', klass)
+      stub_lists(admin: %w[FeProtectedController])
+
+      expect(Fe.verify_access_hooks!).to be_nil
+    end
+
+    it 'passes when the hooks are private methods' do
+      klass = Class.new do
+        private
+
+        def fe_can_use_answer_sheet?(*) = true
+        def fe_admin? = true
+      end
+      stub_const('FePrivateController', klass)
+      stub_lists(answer: %w[FePrivateController], admin: %w[FePrivateController])
+
+      expect(Fe.verify_access_hooks!).to be_nil
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: fe
 version: !ruby/object:Gem::Version
-  version: 2.3.2
+  version: 2.4.0
 platform: ruby
 authors:
 - CruGlobal
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-30 00:00:00.000000000 Z
+date: 2026-11-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -322,6 +322,7 @@ files:
 - app/assets/stylesheets/fe/fe.screen.css.scss.erb
 - app/assets/stylesheets/fe/reset.css
 - app/assets/stylesheets/fe/validation.css
+- app/controllers/concerns/fe/access_control_concern.rb
 - app/controllers/concerns/fe/admin/question_sheets_controller_concern.rb
 - app/controllers/concerns/fe/answer_pages_controller_concern.rb
 - app/controllers/concerns/fe/answer_sheets_controller_concern.rb
@@ -533,6 +534,7 @@ files:
 - lib/access_key_generator.rb
 - lib/distinct_distinct_patch.rb
 - lib/fe.rb
+- lib/fe/access_control.rb
 - lib/fe/engine.rb
 - lib/fe/version.rb
 - lib/tasks/fe_tasks.rake
@@ -543,7 +545,7 @@ files:
 - spec/controllers/fe/answer_pages_controller_spec.rb
 - spec/controllers/fe/answer_sheets_controller_spec.rb
 - spec/controllers/fe/optimistic_concurrency_spec.rb
-- spec/controllers/fe/reference_pages_controller.rb
+- spec/controllers/fe/reference_pages_controller_spec.rb
 - spec/controllers/fe/reference_sheets_controller_spec.rb
 - spec/controllers/fe/references_controller_spec.rb
 - spec/controllers/fe/submit_pages_controller_spec.rb
@@ -573,6 +575,7 @@ files:
 - spec/dummy/config/initializers/backtrace_silencers.rb
 - spec/dummy/config/initializers/cookies_serializer.rb
 - spec/dummy/config/initializers/fast_gettext.rb
+- spec/dummy/config/initializers/fe.rb
 - spec/dummy/config/initializers/filter_parameter_logging.rb
 - spec/dummy/config/initializers/inflections.rb
 - spec/dummy/config/initializers/mime_types.rb
@@ -611,12 +614,10 @@ files:
 - spec/dummy/db/migrate/20160204164613_add_visible_and_visibility_cache_key_to_reference_sheets.fe_engine.rb
 - spec/dummy/db/migrate/20181108201746_create_versions.rb
 - spec/dummy/db/schema.rb
-- spec/dummy/log/test.log
 - spec/dummy/public/404.html
 - spec/dummy/public/422.html
 - spec/dummy/public/500.html
 - spec/dummy/public/favicon.ico
-- spec/dummy/tmp/local_secret.txt
 - spec/factories/answer_sheet_question_sheets.rb
 - spec/factories/answer_sheets.rb
 - spec/factories/answers.rb
@@ -639,6 +640,7 @@ files:
 - spec/factories/reference_questions.rb
 - spec/factories/reference_sheets.rb
 - spec/jobs/fe/update_reference_sheet_visibility_job_spec.rb
+- spec/lib/fe/access_control_spec.rb
 - spec/mailers/fe/notifier_spec.rb
 - spec/models/fe/answer_sheet_question_sheet_spec.rb
 - spec/models/fe/answer_spec.rb
@@ -701,7 +703,7 @@ test_files:
 - spec/controllers/fe/answer_pages_controller_spec.rb
 - spec/controllers/fe/answer_sheets_controller_spec.rb
 - spec/controllers/fe/optimistic_concurrency_spec.rb
-- spec/controllers/fe/reference_pages_controller.rb
+- spec/controllers/fe/reference_pages_controller_spec.rb
 - spec/controllers/fe/reference_sheets_controller_spec.rb
 - spec/controllers/fe/references_controller_spec.rb
 - spec/controllers/fe/submit_pages_controller_spec.rb
@@ -730,6 +732,7 @@ test_files:
 - spec/dummy/config/initializers/backtrace_silencers.rb
 - spec/dummy/config/initializers/cookies_serializer.rb
 - spec/dummy/config/initializers/fast_gettext.rb
+- spec/dummy/config/initializers/fe.rb
 - spec/dummy/config/initializers/filter_parameter_logging.rb
 - spec/dummy/config/initializers/inflections.rb
 - spec/dummy/config/initializers/mime_types.rb
@@ -769,12 +772,10 @@ test_files:
 - spec/dummy/db/migrate/20160204164613_add_visible_and_visibility_cache_key_to_reference_sheets.fe_engine.rb
 - spec/dummy/db/migrate/20181108201746_create_versions.rb
 - spec/dummy/db/schema.rb
-- spec/dummy/log/test.log
 - spec/dummy/public/404.html
 - spec/dummy/public/422.html
 - spec/dummy/public/500.html
 - spec/dummy/public/favicon.ico
-- spec/dummy/tmp/local_secret.txt
 - spec/factories/answer_sheet_question_sheets.rb
 - spec/factories/answer_sheets.rb
 - spec/factories/answers.rb
@@ -797,6 +798,7 @@ test_files:
 - spec/factories/reference_questions.rb
 - spec/factories/reference_sheets.rb
 - spec/jobs/fe/update_reference_sheet_visibility_job_spec.rb
+- spec/lib/fe/access_control_spec.rb
 - spec/mailers/fe/notifier_spec.rb
 - spec/models/fe/answer_sheet_question_sheet_spec.rb
 - spec/models/fe/answer_spec.rb

data/spec/controllers/fe/reference_pages_controller.rb

@@ -1,4 +0,0 @@
-require 'rails_helper'
-
-describe Fe::ReferencePages do
-end