benwbrum / fromthepage / 25374915455

70%

push

github

Restrict collection export paths to owners only (#5442)

* Initial plan

* Fix collection export paths visible to non-owners

Add owner authorization checks to ExportController#index and
BulkExportController#new and #create to prevent non-owners from
accessing collection export paths.

- Add require_owner before_action to ExportController that redirects
  non-owners and unauthenticated users to the dashboard
- Add require_collection_owner before_action to BulkExportController
  for new/create actions that redirects non-owners to the dashboard
- Add tests for unauthorized access to export#index and bulk_export#new

Agent-Logs-Url: https://github.com/benwbrum/fromthepage/sessions/ae92c34d-edaf-41d3-a0cf-207c645bf47f

Co-authored-by: benwbrum <199961+benwbrum@users.noreply.github.com>

* Fix bulk_export#new test: add work to public collection for show_to? check

Agent-Logs-Url: https://github.com/benwbrum/fromthepage/sessions/ae92c34d-edaf-41d3-a0cf-207c645bf47f

Co-authored-by: benwbrum <199961+benwbrum@users.noreply.github.com>

* Remove override for admins #5441

* Fix bulk_export#new admin test: admin non-owner should redirect

Agent-Logs-Url: https://github.com/benwbrum/fromthepage/sessions/e31444f4-c0ca-4b7d-856f-0a4b51a7619d

Co-authored-by: benwbrum <199961+benwbrum@users.noreply.github.com>

* Fix rubocop Layout/EmptyLinesAroundBlockBody in bulk_export_controller_spec

Agent-Logs-Url: https://github.com/benwbrum/fromthepage/sessions/21024050-b996-4ca2-b941-3296ea5fa01d

Co-authored-by: benwbrum <199961+benwbrum@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: benwbrum <199961+benwbrum@users.noreply.github.com>
Co-authored-by: Ben W. Brumfield <benwbrum@gmail.com>

2424 of 3977 branches covered (60.95%)

Branch coverage included in aggregate %.

8 of 8 new or added lines in 2 files covered. (100.0%)

9973 of 13778 relevant lines covered (72.38%)

154.83 hits per line