Allow managers to read investment suggestions

When creating a budget investment with an unverified manager (for
example, a manager who isn't part of the local census), there's a
request to `Budgets::InvestmentsController#suggest`. Since the manager
isn't verified, suggestions can't be obtained.

There are serveral ways to fix this problem:

* Add a `suggest` action to Management::Budgets::InvestmentsController,
doing the same thing the main `suggest` action does.
* Give unverified users permission to access investment suggestions
* Give managers permission to access investment suggestions

I've chosen the last one because I thought it was simple and only
changed existing behaviour for managers, but any other solution would be
as valid. I haven't added the `phase: "accepting"` condition to keep it
simple, since a read-only action like this one in the management portal
isn't gonna create security risks.
This commit is contained in:
Javi Martín
2019-09-20 12:39:33 +02:00
parent dde9caf7fd
commit 53670602e0
3 changed files with 36 additions and 0 deletions

View File

@@ -94,6 +94,29 @@ describe "Budget Investments" do
expect(page).to have_content "User is not verified"
end
scenario "Shows suggestions to unverified managers", :js do
expect(manager.user.level_two_or_three_verified?).to be false
create(:budget_investment, budget: budget, title: "More parks")
create(:budget_investment, budget: budget, title: "No more parks")
create(:budget_investment, budget: budget, title: "Plant trees")
login_managed_user(create(:user, :level_two))
click_link "Create budget investment"
within "#budget_#{budget.id}" do
click_link "Create budget investment"
end
fill_in "Title", with: "Park"
fill_in_ckeditor "Description", with: "Wish I had one"
within(".js-suggest") do
expect(page).to have_content "More parks"
expect(page).to have_content "No more parks"
expect(page).not_to have_content "Plant trees"
end
end
end
context "Searching" do