AO3-7030 Only allow official users to apply to make skins public

app/controllers/skins_controller.rb

@@ -180,15 +180,19 @@ def destroy
   private
 
   def skin_params
-    params.require(:skin).permit(
-      :title, :description, :public, :css, :role, :ie_condition, :unusable,
-      :font, :base_em, :margin, :paragraph_margin, :background_color,
+    allowed_attributes = [
+      :title, :description, :css, :role, :ie_condition, :unusable, :font,
+      :base_em, :margin, :paragraph_margin, :background_color,
       :foreground_color, :headercolor, :accent_color, :icon,
       media: [],
       skin_parents_attributes: [
         :id, :position, :parent_skin_id, :parent_skin_title, :_destroy
       ]
-    )
+    ]
+
+    allowed_attributes += [:public] if current_user.is_a?(User) && current_user.official
+
+    params.require(:skin).permit(allowed_attributes)
   end
 
   def load_skin

app/views/skins/_form.html.erb

@@ -27,8 +27,10 @@
     <dt><%= f.label :icon, t(".icon") %></dt>
     <dd><%= f.file_field :icon %></dd>
 
-    <dt><%= f.label :public, t(".public") %> <%= link_to_help "skins-approval" %></dt>
-    <dd><%= f.check_box :public %></dd>
+    <% if @current_user&.official %>
+      <dt><%= f.label :public, t(".public") %></dt>
+      <dd><%= f.check_box :public %></dd>
+    <% end %>
   </dl>
 </fieldset>
 

app/views/skins/_skin_module.html.erb

@@ -8,9 +8,9 @@
     <% if skin.official? %> 
       <p class="status approved">(<%= ts('Approved') %>)</p>
     <% elsif skin.rejected? %>
-      <p class="status declined">(<%= ts('Declined:')%> <%= link_to_help 'skins-approval' %> <%= skin.admin_note %>)</p>
+      <p class="status declined">(<%= ts("Declined:") %> <%= skin.admin_note %>)</p>
     <% elsif skin.public? %> 
-      <p class="status unread">(<%= ts('Not yet reviewed') %>) <%= link_to_help 'skins-approval' %></p>
+      <p class="status unread">(<%= ts("Not yet reviewed") %>)</p>
     <% end %>
   <% end %>
 

features/admins/admin_skins.feature

@@ -12,8 +12,8 @@ Feature: Admin manage skins
     And I am logged in as a "superadmin" admin
   When I follow "Approved Skins"
     And I check "Cache"
-  Then I press "Update"
-    And I should see "The following skins were updated: public skin"
+    And I press "Update"
+  Then I should see "The following skins were updated: public skin"
   When I follow "Approved Skins"
     And I check "Uncache"
     And I press "Update"

features/other_b/skin_public.feature

@@ -129,3 +129,23 @@ Feature: Public skins
       And I press "unique skin"
     Then the page should have the cached skin "unique skin"
       And I should be on the works page
+
+  Scenario: A regular user can't apply to make a skin public
+  Given I am logged in
+  When I go to the new skin page
+  Then I should not see "Apply to make public"
+
+  Scenario: A user with the official role can apply to make a skin public
+  Given the user "SkinTeam" exists and has the role "official"
+    And I am logged in as "SkinTeam"
+  When I set up the skin "Skin We're Gonna Add"
+    And I attach a preview for the skin
+    And I check "Apply to make public"
+    And I submit
+  Then I should see "Skin was successfully created"
+
+  Scenario: Admins can't see the "Apply to make public" checkbox
+  Given the approved public skin "Usable Skin"
+    And I am logged in as a "superadmin" admin
+  When I edit the skin "Usable Skin"
+  Then I should not see "Apply to make public"

features/step_definitions/skin_steps.rb

@@ -59,6 +59,7 @@
   # creation dates, so that they will be listed in the right order:
   step "it is currently 1 second from now"
 
+  step %{the user "skinner" exists and has the role "official"}
   step %{I am logged in as "skinner"}
   step %{I set up the skin "#{skin_name}" with css "#{css}"}
   attach_file("skin_icon", "features/fixtures/skin_test_preview.png")
@@ -192,6 +193,10 @@
   visit preview_skin_path(skin)
 end
 
+When "I attach a preview for the skin" do
+  attach_file("skin_icon", "features/fixtures/skin_test_preview.png")
+end
+
 ### THEN
 
 Then "I should see a parent skin text field" do

features/step_definitions/user_steps.rb

@@ -195,6 +195,11 @@
   user.roles = [Role.find_or_create_by(name: "no_resets")]
 end
 
+Given "the user {string} has the official role" do |login|
+  user = User.find_by(login: login)
+  user.roles = [Role.find_or_create_by(name: "official")]
+end
+
 Given "the user {string} with the email {string} exists" do |login, email|
   FactoryBot.create(:user, login: login, email: email)
 end

lib/tasks/skin_tasks.rake

@@ -190,4 +190,11 @@ namespace :skins do
     Skin.where("id != ?", default_id).update_all(:official => false)
   end
 
+  desc "Clear unofficial public skins"
+  task(clear_unofficial_public_skins: :environment) do
+    Skin.where(public: true, official: false).update_all(rejected: false, public: false)
+
+    puts "Finished clearing unofficial public skins."
+    $stdout.flush
+  end
 end