Hide brainstorm plans from index for non-authors

engine/app/controllers/coplan/plans_controller.rb

@@ -3,7 +3,10 @@ class PlansController < ApplicationController
     before_action :set_plan, only: [:show, :edit, :update, :update_status, :toggle_checkbox]
 
     def index
-      @plans = Plan.includes(:plan_type, :tags).order(updated_at: :desc)
+      @plans = Plan.includes(:plan_type, :tags)
+        .where.not(status: "brainstorm")
+        .or(Plan.where(created_by_user: current_user))
+        .order(updated_at: :desc)
       @plans = @plans.where(status: params[:status]) if params[:status].present?
       @plans = @plans.where(created_by_user: current_user) if params[:scope] == "mine"
       @plans = @plans.where(plan_type_id: params[:plan_type]) if params[:plan_type].present?

spec/requests/plans_spec.rb

@@ -139,6 +139,21 @@
     expect(response).to redirect_to(plan_path(plan))
   end
 
+  it "index hides other users brainstorm plans" do
+    brainstorm_plan # alice's brainstorm
+    sign_in_as(bob)
+    get plans_path
+    expect(response).to have_http_status(:success)
+    expect(response.body).not_to include(brainstorm_plan.title)
+  end
+
+  it "index shows own brainstorm plans" do
+    brainstorm_plan # alice's brainstorm
+    get plans_path
+    expect(response).to have_http_status(:success)
+    expect(response.body).to include(brainstorm_plan.title)
+  end
+
   it "can view brainstorm plan as non-author" do
     sign_in_as(bob)
     get plan_path(brainstorm_plan)