diff --git a/app/controllers/backoffice/dossiers_controller.rb b/app/controllers/backoffice/dossiers_controller.rb index ac7135587..14f04fe45 100644 --- a/app/controllers/backoffice/dossiers_controller.rb +++ b/app/controllers/backoffice/dossiers_controller.rb @@ -190,11 +190,10 @@ class Backoffice::DossiersController < Backoffice::DossiersListController private def ensure_gestionnaire_is_authorized - current_gestionnaire.dossiers.find(params[:id]) - - rescue ActiveRecord::RecordNotFound - flash.alert = t('errors.messages.dossier_not_found') - redirect_to url_for(controller: '/backoffice') + unless current_gestionnaire.can_view_dossier?(params[:id]) + flash.alert = t('errors.messages.dossier_not_found') + redirect_to url_for(controller: '/backoffice') + end end def create_dossier_facade dossier_id diff --git a/app/models/gestionnaire.rb b/app/models/gestionnaire.rb index 3c12cf790..6492cca64 100644 --- a/app/models/gestionnaire.rb +++ b/app/models/gestionnaire.rb @@ -25,6 +25,11 @@ class Gestionnaire < ActiveRecord::Base self[:procedure_filter] end + def can_view_dossier?(dossier_id) + avis.where(dossier_id: dossier_id).any? || + dossiers.where(id: dossier_id).any? + end + def toggle_follow_dossier dossier_id dossier = dossier_id dossier = Dossier.find(dossier_id) unless dossier_id.class == Dossier diff --git a/spec/models/gestionnaire_spec.rb b/spec/models/gestionnaire_spec.rb index 27cb3502e..fbfbfd76f 100644 --- a/spec/models/gestionnaire_spec.rb +++ b/spec/models/gestionnaire_spec.rb @@ -395,4 +395,27 @@ describe Gestionnaire, type: :model do it { is_expected.to eq(nil) } end end + + describe '.can_view_dossier?' do + subject{ gestionnaire.can_view_dossier?(dossier.id) } + + context 'when gestionnaire is assigned on dossier' do + let!(:dossier){ create(:dossier, procedure: procedure, state: 'received') } + + it { expect(subject).to be true } + end + + context 'when gestionnaire is invited on dossier' do + let(:dossier){ create(:dossier) } + let!(:avis){ create(:avis, dossier: dossier, gestionnaire: gestionnaire) } + + it { expect(subject).to be true } + end + + context 'when gestionnaire is neither assigned nor invited on dossier' do + let(:dossier){ create(:dossier) } + + it { expect(subject).to be false } + end + end end