FIX: Users can remove themselves from a PM even if they can still access it through a group. (#11693)

If a group you're a member of is invited to a PM, you can no longer remove yourself from it. This means you won't be able to remove the message from your inbox, and even if you archive it, it'll come back once someone replies.
This commit is contained in:
Roman Rizzi 2021-01-13 11:27:23 -03:00 committed by GitHub
parent 2b071ed930
commit e52ccaa51f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 32 additions and 1 deletions

View File

@ -163,7 +163,9 @@ class TopicViewDetailsSerializer < ApplicationSerializer
end
def allowed_users
object.topic.allowed_users.reject { |user| object.group_allowed_user_ids.include?(user.id) }
object.topic.allowed_users.reject do |user|
object.group_allowed_user_ids.include?(user.id) && user != scope.user
end
end
def include_allowed_users?

View File

@ -0,0 +1,29 @@
# frozen_string_literal: true
require 'rails_helper'
describe TopicViewDetailsSerializer do
describe '#allowed_users' do
it "add the current user to the allowed user's list even if they are an allowed group member" do
participant = Fabricate(:user)
another_participant = Fabricate(:user)
participant_group = Fabricate(:group)
participant_group.add(participant)
participant_group.add(another_participant)
pm = Fabricate(:private_message_topic,
topic_allowed_users: [
Fabricate.build(:topic_allowed_user, user: participant),
Fabricate.build(:topic_allowed_user, user: another_participant)
],
topic_allowed_groups: [Fabricate.build(:topic_allowed_group, group: participant_group)]
)
serializer = described_class.new(TopicView.new(pm, participant), scope: Guardian.new(participant))
allowed_users = serializer.as_json.dig(:topic_view_details, :allowed_users).map { |u| u[:id] }
expect(allowed_users).to contain_exactly(participant.id)
end
end
end