chore: init commit

in worker.../repo/GITFOLDER.zip is the .git folder.

worker-toolkit-stocks-in-the-future/repo/test/policies/application_policy_test.rb

@@ -0,0 +1,129 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class ApplicationPolicyTest < ActiveSupport::TestCase
+  def setup
+    @admin = create(:admin)
+    @teacher = create(:teacher)
+    @student = create(:student)
+    @record = :some_record
+    @the_nil = nil
+  end
+
+  test "admin_required?" do
+    assert ApplicationPolicy.new(@admin, @record).admin_required?
+
+    [@teacher, @student, @the_nil].each do |target_user|
+      assert_not ApplicationPolicy.new(target_user, @record).admin_required?
+    end
+  end
+
+  test "teacher_required?" do
+    assert ApplicationPolicy.new(@teacher, @record).teacher_required?
+
+    [@admin, @student, @the_nil].each do |target_user|
+      assert_not ApplicationPolicy.new(target_user, @record).teacher_required?
+    end
+  end
+
+  test "student_required?" do
+    assert ApplicationPolicy.new(@student, @record).student_required?
+
+    [@admin, @teacher, @the_nil].each do |target_user|
+      assert_not ApplicationPolicy.new(target_user, @record).student_required?
+    end
+  end
+
+  test "teacher_or_admin_required?" do
+    [@admin, @teacher].each do |target_user|
+      assert ApplicationPolicy.new(target_user, @record).teacher_or_admin_required?
+    end
+
+    [@student, @the_nil].each do |target_user|
+      assert_not ApplicationPolicy.new(target_user, @record).teacher_or_admin_required?
+    end
+  end
+
+  test "index? returns false for all users" do
+    [@admin, @teacher, @student, @the_nil].each do |user|
+      policy = ApplicationPolicy.new(user, @record)
+
+      assert_not policy.index?
+    end
+  end
+
+  test "show? returns false for all users" do
+    [@admin, @teacher, @student, @the_nil].each do |user|
+      policy = ApplicationPolicy.new(user, @record)
+
+      assert_not policy.show?
+    end
+  end
+
+  test "create? returns false for all users" do
+    [@admin, @teacher, @student, @the_nil].each do |user|
+      policy = ApplicationPolicy.new(user, @record)
+
+      assert_not policy.create?
+    end
+  end
+
+  test "update? returns false for all users" do
+    [@admin, @teacher, @student, @the_nil].each do |user|
+      policy = ApplicationPolicy.new(user, @record)
+
+      assert_not policy.update?
+    end
+  end
+
+  test "destroy? returns false for all users" do
+    [@admin, @teacher, @student, @the_nil].each do |user|
+      policy = ApplicationPolicy.new(user, @record)
+
+      assert_not policy.destroy?
+    end
+  end
+
+  test "new? delegates to create?" do
+    policy = ApplicationPolicy.new(@admin, @record)
+
+    assert_equal policy.create?, policy.new?
+  end
+
+  test "edit? delegates to update?" do
+    policy = ApplicationPolicy.new(@admin, @record)
+
+    assert_equal policy.update?, policy.edit?
+  end
+
+  test "initialize stores user and record" do
+    policy = ApplicationPolicy.new(@admin, @record)
+
+    assert_equal @admin, policy.user
+    assert_equal @record, policy.record
+  end
+
+  test "initialize handles nil user" do
+    policy = ApplicationPolicy.new(@the_nil, @record)
+
+    assert_nil policy.user
+    assert_equal @record, policy.record
+  end
+
+  test "Scope initialize stores user and scope" do
+    scope = :some_scope
+    scope_instance = ApplicationPolicy::Scope.new(@admin, scope)
+
+    assert_equal @admin, scope_instance.send(:user)
+    assert_equal scope, scope_instance.send(:scope)
+  end
+
+  test "Scope resolve raises NoMethodError" do
+    scope_instance = ApplicationPolicy::Scope.new(@admin, :some_scope)
+    error = assert_raises(NoMethodError) do
+      scope_instance.resolve
+    end
+    assert_includes error.message, "You must define #resolve in ApplicationPolicy::Scope"
+  end
+end

worker-toolkit-stocks-in-the-future/repo/test/policies/classroom_policy_test.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class ClassroomPolicyTest < ActiveSupport::TestCase
+  test "factory" do
+    assert build(:classroom).validate!
+  end
+
+  test "classroom policy allows admin all the class routes" do
+    classroom = create(:classroom)
+    admin = create(:admin)
+
+    assert_permit admin, classroom, :index
+    assert_permit admin, classroom, :show
+    assert_permit admin, classroom, :new
+    assert_permit admin, classroom, :create
+    assert_permit admin, classroom, :edit
+    assert_permit admin, classroom, :update
+    assert_permit admin, classroom, :toggle_archive
+  end
+
+  test "classroom policy allows teacher only `index` and `show` classroom routes" do
+    classroom = create(:classroom)
+    teacher = create(:teacher)
+
+    assert_permit teacher, classroom, :index
+    assert_permit teacher, classroom, :show
+    refute_permit teacher, classroom, :new
+    refute_permit teacher, classroom, :create
+    refute_permit teacher, classroom, :edit
+    refute_permit teacher, classroom, :update
+    refute_permit teacher, classroom, :toggle_archive
+  end
+
+  test "classroom policy does not allow student any classroom routes" do
+    classroom = create(:classroom)
+    student = create(:student)
+
+    refute_permit student, classroom, :index
+    refute_permit student, classroom, :show
+    refute_permit student, classroom, :new
+    refute_permit student, classroom, :create
+    refute_permit student, classroom, :edit
+    refute_permit student, classroom, :update
+    refute_permit student, classroom, :toggle_archive
+  end
+
+  test "classroom policy allows admins access to all the classrooms" do
+    admin = create(:admin)
+    classroom1 = create(:classroom)
+    classroom2 = create(:classroom)
+
+    scope = ClassroomPolicy::Scope.new(admin, Classroom.all).resolve
+
+    assert_includes scope, classroom1
+    assert_includes scope, classroom2
+  end
+
+  test "classroom policy allows teachers access to their own classrooms only" do
+    teacher = create(:teacher)
+    classroom1 = create(:classroom)
+    classroom2 = create(:classroom)
+    teacher.classrooms << classroom1
+
+    scope = ClassroomPolicy::Scope.new(teacher, Classroom.all).resolve
+
+    assert_includes scope, classroom1
+    assert_not_includes scope, classroom2
+  end
+end

worker-toolkit-stocks-in-the-future/repo/test/policies/grade_book_policy_test.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class GradeBookPolicyTest < ActiveSupport::TestCase
+  def setup
+    @admin = create(:admin)
+    @owner_teacher = create(:teacher)
+    @other_teacher = create(:teacher)
+    @student = create(:student)
+
+    @classroom = create(:classroom)
+    @classroom.teachers << @owner_teacher
+
+    @grade_book = create(:grade_book, classroom: @classroom)
+  end
+
+  test "show? allows admin and owner teacher, denies others" do
+    assert_permit @admin, @grade_book, :show
+    assert_permit @owner_teacher, @grade_book, :show
+    refute_permit @other_teacher, @grade_book, :show
+    refute_permit @student, @grade_book, :show
+  end
+
+  test "update? allows admin and owner teacher, denies others" do
+    assert_permit @admin, @grade_book, :update
+    assert_permit @owner_teacher, @grade_book, :update
+    refute_permit @other_teacher, @grade_book, :update
+    refute_permit @student, @grade_book, :update
+  end
+
+  test "finalize? allows only admin, denies everyone else" do
+    assert_permit @admin, @grade_book, :finalize
+    refute_permit @owner_teacher, @grade_book, :finalize
+    refute_permit @other_teacher, @grade_book, :finalize
+    refute_permit @student, @grade_book, :finalize
+  end
+end

worker-toolkit-stocks-in-the-future/repo/test/policies/order_policy_test.rb

@@ -0,0 +1,110 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class OrderPolicyTest < ActiveSupport::TestCase
+  test "index?" do
+    order = build(:order, :buy)
+
+    assert_permit create(:admin), order, :index
+    assert_permit create(:teacher), order, :index
+    assert_permit create(:student), order, :index
+    refute_permit nil, order, :index
+  end
+
+  test "create? allows user to create order for their own portfolio" do
+    student = create(:student)
+    order = build(:order, :buy, user: student)
+
+    assert_permit student, order, :create
+  end
+
+  test "create? denies user from creating order for another user's portfolio" do
+    student1 = create(:student)
+    student2 = create(:student)
+    order = build(:order, :buy, user: student2)
+
+    refute_permit student1, order, :create
+  end
+
+  test "update? allows user to update their own order" do
+    stock = create(:stock)
+    student = create(:student)
+    portfolio = create(:portfolio, user: student)
+    create(:portfolio_stock, portfolio:, shares: 10, stock:)
+    order = create(:order, :sell, user: student, stock:)
+
+    assert_permit student, order, :update
+  end
+
+  test "update? denies user from updating another user's order" do
+    stock = create(:stock)
+    student1 = create(:student)
+    student2 = create(:student)
+    portfolio = create(:portfolio, user: student2)
+    create(:portfolio_stock, portfolio:, stock:, shares: 10)
+    order = create(:order, :sell, user: student2, stock:)
+
+    refute_permit student1, order, :update
+  end
+
+  test "cancel? allows user to cancel their own order" do
+    stock = create(:stock)
+    student = create(:student)
+    portfolio = create(:portfolio, user: student)
+    create(:portfolio_stock, portfolio:, stock:, shares: 10)
+    order = create(:order, :sell, user: student, stock:)
+
+    assert_permit student, order, :cancel
+  end
+
+  test "cancel? denies user from canceling another user's order" do
+    stock = create(:stock)
+    student1 = create(:student)
+    student2 = create(:student)
+    portfolio = create(:portfolio, user: student2)
+    create(:portfolio_stock, portfolio:, stock:, shares: 10)
+    order = create(:order, :sell, user: student2, stock:)
+
+    refute_permit student1, order, :cancel
+  end
+
+  test "Scope#resolve calls scope.all for admin" do
+    admin = create(:admin)
+
+    Order.expects(:all)
+
+    OrderPolicy::Scope.new(admin, Order).resolve
+  end
+
+  test "Scope#resolve calls scope.for_student for student" do
+    student = create(:student)
+
+    Order.expects(:for_student).with(student)
+
+    OrderPolicy::Scope.new(student, Order).resolve
+  end
+
+  test "Scope#resolve calls scope.for_teacher for teacher" do
+    teacher = create(:teacher)
+
+    Order.expects(:for_teacher).with(teacher)
+
+    OrderPolicy::Scope.new(teacher, Order).resolve
+  end
+
+  test "Scope#resolve calls scope.none for nil user" do
+    Order.expects(:none)
+
+    OrderPolicy::Scope.new(nil, Order).resolve
+  end
+
+  test "Scope#resolve calls scope.none for user without recognized role" do
+    user = build(:student)
+    user.stubs(:student?).returns(false)
+
+    Order.expects(:none)
+
+    OrderPolicy::Scope.new(user, Order).resolve
+  end
+end

worker-toolkit-stocks-in-the-future/repo/test/policies/portfolio_policy_test.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class PortfolioPolicyTest < ActiveSupport::TestCase
+  def setup
+    @classroom = create(:classroom)
+    @other_classroom = create(:classroom)
+    @student = User.create!(username: "student", type: "Student", password: "password", classroom: @classroom)
+    @other_student = User.create!(
+      username: "other_student", type: "Student", password: "password",
+      classroom: @other_classroom
+    )
+
+    @teacher = create(:teacher)
+    @admin = create(:admin)
+
+    @portfolio = Portfolio.create!(user: @student)
+    @other_portfolio = Portfolio.create!(user: @other_student)
+
+    TeacherClassroom.create!(teacher: @teacher, classroom: @classroom)
+  end
+
+  test "admin can show any portfolio" do
+    assert PortfolioPolicy.new(@admin, @portfolio).show?
+    assert PortfolioPolicy.new(@admin, @other_portfolio).show?
+  end
+
+  test "owner can show their portfolio" do
+    assert PortfolioPolicy.new(@student, @portfolio).show?
+  end
+
+  test "other students cannot show the portfolio" do
+    assert_not PortfolioPolicy.new(@other_student, @portfolio).show?
+  end
+
+  test "teacher can show portfolio of students in their classroom" do
+    assert PortfolioPolicy.new(@teacher, @portfolio).show?
+  end
+
+  test "teacher cannot show portfolio of student NOT in their classroom" do
+    assert_not PortfolioPolicy.new(@teacher, @other_portfolio).show?
+  end
+
+  test "guest cannot show any portfolio" do
+    assert_not PortfolioPolicy.new(nil, @portfolio).show?
+  end
+end

worker-toolkit-stocks-in-the-future/repo/test/policies/stock_policy_test.rb

@@ -0,0 +1,132 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class StockPolicyTest < ActiveSupport::TestCase
+  test "factory" do
+    assert build(:stock).validate!
+  end
+
+  test "student with portfolio can see holdings and trading links for active stocks" do
+    student = create(:student)
+    # ensure portfolio created for student factory
+    create(:portfolio, user: student)
+    stock = create(:stock, archived: false)
+
+    assert_permit student, stock, :show_trading_link
+    assert_permit student, stock, :show_holdings
+  end
+
+  test "student without portfolio cannot see holdings or trading links" do
+    # create a student but do not create a portfolio for them
+    student = create(:student)
+    # remove any auto-created portfolio if present
+    student.portfolio&.destroy
+    student.association(:portfolio).reset
+
+    stock = create(:stock, archived: false)
+
+    refute_permit student, stock, :show_trading_link
+    refute_permit student, stock, :show_holdings
+  end
+
+  test "teacher and admin cannot see trading links or holdings" do
+    teacher = create(:teacher)
+    admin = create(:admin)
+    stock = create(:stock, archived: false)
+
+    refute_permit teacher, stock, :show_trading_link
+    refute_permit teacher, stock, :show_holdings
+
+    refute_permit admin, stock, :show_trading_link
+    refute_permit admin, stock, :show_holdings
+  end
+
+  test "archived stock allows trading link only if student holds it" do
+    student = create(:student)
+    portfolio = create(:portfolio, user: student)
+    stock = create(:stock, archived: true)
+
+    refute_permit student, stock, :show_trading_link
+
+    create(:portfolio_stock, portfolio: portfolio, stock: stock)
+    assert_permit student, stock, :show_trading_link
+
+    # holdings may still be shown depending on policy; our policy hides only trading links
+    assert_permit student, stock, :show_holdings
+  end
+
+  test "index? allows any logged-in user and denies guests" do
+    stock = build(:stock)
+
+    assert_permit create(:admin), stock, :index
+    assert_permit create(:teacher), stock, :index
+    assert_permit create(:student), stock, :index
+
+    refute_permit nil, stock, :index
+  end
+
+  test "show? allows admins and teachers to view any stock" do
+    active_stock = create(:stock, archived: false)
+    archived_stock = create(:stock, archived: true)
+
+    admin = create(:admin)
+    teacher = create(:teacher)
+
+    assert_permit admin, active_stock, :show
+    assert_permit admin, archived_stock, :show
+
+    assert_permit teacher, active_stock, :show
+    assert_permit teacher, archived_stock, :show
+  end
+
+  test "show? allows students to view all stocks and denies guests" do
+    active_stock = create(:stock, archived: false)
+    archived_stock = create(:stock, archived: true)
+
+    student = create(:student)
+
+    assert_permit student, active_stock, :show
+    assert_permit student, archived_stock, :show
+
+    refute_permit nil, active_stock, :show
+    refute_permit nil, archived_stock, :show
+  end
+
+  test "CRUD actions are allowed only for admins" do
+    stock = build(:stock)
+
+    admin = create(:admin)
+    teacher = create(:teacher)
+    student = create(:student)
+
+    %i[new create edit update destroy].each do |action|
+      assert_permit admin, stock, action
+
+      refute_permit teacher, stock, action
+      refute_permit student, stock, action
+      refute_permit nil, stock, action
+    end
+  end
+
+  test "Scope resolves: all logged-in users see all stocks" do
+    admin = create(:admin)
+    teacher = create(:teacher)
+    student = create(:student)
+
+    active = create(:stock, archived: false)
+    archived = create(:stock, archived: true)
+
+    admin_scope = StockPolicy::Scope.new(admin, Stock.all).resolve
+    assert_includes admin_scope, active
+    assert_includes admin_scope, archived
+
+    teacher_scope = StockPolicy::Scope.new(teacher, Stock.all).resolve
+    assert_includes teacher_scope, active
+    assert_includes teacher_scope, archived
+
+    student_scope = StockPolicy::Scope.new(student, Stock.all).resolve
+    assert_includes student_scope, active
+    assert_includes student_scope, archived
+  end
+end