diff --git a/engine/app/controllers/coplan/plans_controller.rb b/engine/app/controllers/coplan/plans_controller.rb index 1fb7b1d..a2e8241 100644 --- a/engine/app/controllers/coplan/plans_controller.rb +++ b/engine/app/controllers/coplan/plans_controller.rb @@ -3,7 +3,10 @@ class PlansController < ApplicationController before_action :set_plan, only: [:show, :edit, :update, :update_status, :toggle_checkbox] def index - @plans = Plan.includes(:plan_type, :tags).order(updated_at: :desc) + @plans = Plan.includes(:plan_type, :tags) + .where.not(status: "brainstorm") + .or(Plan.where(created_by_user: current_user)) + .order(updated_at: :desc) @plans = @plans.where(status: params[:status]) if params[:status].present? @plans = @plans.where(created_by_user: current_user) if params[:scope] == "mine" @plans = @plans.where(plan_type_id: params[:plan_type]) if params[:plan_type].present? diff --git a/spec/requests/plans_spec.rb b/spec/requests/plans_spec.rb index 32b2521..7233aad 100644 --- a/spec/requests/plans_spec.rb +++ b/spec/requests/plans_spec.rb @@ -139,6 +139,21 @@ expect(response).to redirect_to(plan_path(plan)) end + it "index hides other users brainstorm plans" do + brainstorm_plan # alice's brainstorm + sign_in_as(bob) + get plans_path + expect(response).to have_http_status(:success) + expect(response.body).not_to include(brainstorm_plan.title) + end + + it "index shows own brainstorm plans" do + brainstorm_plan # alice's brainstorm + get plans_path + expect(response).to have_http_status(:success) + expect(response.body).to include(brainstorm_plan.title) + end + it "can view brainstorm plan as non-author" do sign_in_as(bob) get plan_path(brainstorm_plan)