diff --git a/lib/guardian/topic_guardian.rb b/lib/guardian/topic_guardian.rb index 9e49f538663..ce5882de041 100644 --- a/lib/guardian/topic_guardian.rb +++ b/lib/guardian/topic_guardian.rb @@ -143,7 +143,7 @@ module TopicGuardian def can_recover_topic?(topic) if is_staff? || (topic&.category && is_category_group_moderator?(topic.category)) || - (SiteSetting.tl4_delete_posts_and_topics && user.has_trust_level?(TrustLevel[4])) + (SiteSetting.tl4_delete_posts_and_topics && user&.has_trust_level?(TrustLevel[4])) !!(topic && topic.deleted_at) else topic && can_recover_post?(topic.ordered_posts.first) @@ -212,7 +212,7 @@ module TopicGuardian def can_see_deleted_topics?(category) is_staff? || is_category_group_moderator?(category) || - (SiteSetting.tl4_delete_posts_and_topics && user.has_trust_level?(TrustLevel[4])) + (SiteSetting.tl4_delete_posts_and_topics && user&.has_trust_level?(TrustLevel[4])) end # Accepts an array of `Topic#id` and returns an array of `Topic#id` which the user can see. diff --git a/spec/lib/guardian/topic_guardian_spec.rb b/spec/lib/guardian/topic_guardian_spec.rb index dbdc67c0893..7bddc0e9e46 100644 --- a/spec/lib/guardian/topic_guardian_spec.rb +++ b/spec/lib/guardian/topic_guardian_spec.rb @@ -94,6 +94,38 @@ RSpec.describe TopicGuardian do SiteSetting.tl4_delete_posts_and_topics = true expect(Guardian.new(tl4_user).can_see_deleted_topics?(topic.category)).to eq(true) end + + it "returns false for anonymous user" do + SiteSetting.tl4_delete_posts_and_topics = true + expect(Guardian.new.can_see_deleted_topics?(topic.category)).to be_falsey + end + end + + describe "#can_recover_topic?" do + fab!(:deleted_topic) { Fabricate(:topic, category: category, deleted_at: 1.day.ago) } + it "returns true for staff" do + expect(Guardian.new(admin).can_recover_topic?(Topic.with_deleted.last)).to eq(true) + end + + it "returns true for group moderator" do + SiteSetting.enable_category_group_moderation = true + expect(Guardian.new(user).can_recover_topic?(Topic.with_deleted.last)).to eq(false) + category.update!(reviewable_by_group_id: group.id) + group.add(user) + topic.update!(category: category) + expect(Guardian.new(user).can_recover_topic?(Topic.with_deleted.last)).to eq(true) + end + + it "returns true when tl4 can delete posts and topics" do + expect(Guardian.new(tl4_user).can_recover_topic?(Topic.with_deleted.last)).to eq(false) + SiteSetting.tl4_delete_posts_and_topics = true + expect(Guardian.new(tl4_user).can_recover_topic?(Topic.with_deleted.last)).to eq(true) + end + + it "returns false for anonymous user" do + SiteSetting.tl4_delete_posts_and_topics = true + expect(Guardian.new.can_recover_topic?(Topic.with_deleted.last)).to eq(false) + end end describe "#can_edit_topic?" do