Gestionnaire can view dossier if he is invited on dossier

app/controllers/backoffice/dossiers_controller.rb

@@ -190,11 +190,10 @@ class Backoffice::DossiersController < Backoffice::DossiersListController
   private
 
   def ensure_gestionnaire_is_authorized
-    current_gestionnaire.dossiers.find(params[:id])
-
-  rescue ActiveRecord::RecordNotFound
-    flash.alert = t('errors.messages.dossier_not_found')
-    redirect_to url_for(controller: '/backoffice')
+    unless current_gestionnaire.can_view_dossier?(params[:id])
+      flash.alert = t('errors.messages.dossier_not_found')
+      redirect_to url_for(controller: '/backoffice')
+    end
   end
 
   def create_dossier_facade dossier_id

app/models/gestionnaire.rb

@@ -25,6 +25,11 @@ class Gestionnaire < ActiveRecord::Base
     self[:procedure_filter]
   end
 
+  def can_view_dossier?(dossier_id)
+    avis.where(dossier_id: dossier_id).any? ||
+      dossiers.where(id: dossier_id).any?
+  end
+
   def toggle_follow_dossier dossier_id
     dossier = dossier_id
     dossier = Dossier.find(dossier_id) unless dossier_id.class == Dossier

spec/models/gestionnaire_spec.rb

@@ -395,4 +395,27 @@ describe Gestionnaire, type: :model do
       it { is_expected.to eq(nil) }
     end
   end
+
+  describe '.can_view_dossier?' do
+    subject{ gestionnaire.can_view_dossier?(dossier.id) }
+
+    context 'when gestionnaire is assigned on dossier' do
+      let!(:dossier){ create(:dossier, procedure: procedure, state: 'received') }
+
+      it { expect(subject).to be true }
+    end
+
+    context 'when gestionnaire is invited on dossier' do
+      let(:dossier){ create(:dossier) }
+      let!(:avis){ create(:avis, dossier: dossier, gestionnaire: gestionnaire) }
+
+      it { expect(subject).to be true }
+    end
+
+    context 'when gestionnaire is neither assigned nor invited on dossier' do
+      let(:dossier){ create(:dossier) }
+
+      it { expect(subject).to be false }
+    end
+  end
 end