Initial commit

spec/policies/account_auth_policy_spec.rb

@@ -0,0 +1,92 @@
+require "rails_helper"
+
+RSpec.describe AccountAuthPolicy, type: :policy  do
+  subject { described_class }
+
+  let(:account_auth) { build(:account_auth) }
+  let(:member_account_auth) { create(:account_auth, account: user.primary_account) }
+  let(:non_member_account_auth) { create(:account_auth) }
+  let(:user_context) { build(:user_context, user: user, account: user.primary_account) }
+
+  context "for an associate" do
+    let(:user) { create(:user, :associate) }
+
+    permissions :create? do
+      it { is_expected.not_to permit(user_context, AccountAuth) }
+    end
+    permissions :update? do
+      it { is_expected.not_to permit(user_context, account_auth) }
+    end
+    permissions :destroy? do
+      it { is_expected.not_to permit(user_context, account_auth) }
+    end
+
+    permissions ".scope" do
+      subject { Pundit.policy_scope!(user_context, AccountAuth) }
+      
+      it { is_expected.to be_empty }
+    end
+  end
+
+  context "for a manager" do
+    let(:user) { create(:user, :manager) }
+
+    permissions :create? do
+      it { is_expected.not_to permit(user_context, AccountAuth) }
+    end
+    permissions :update? do
+      it { is_expected.not_to permit(user_context, account_auth) }
+    end
+    permissions :destroy? do
+      it { is_expected.not_to permit(user_context, account_auth) }
+    end
+
+    permissions ".scope" do
+      subject { Pundit.policy_scope!(user_context, AccountAuth) }
+      
+      it { is_expected.to be_empty }
+    end
+  end
+
+  context "for an account manager" do
+    let(:user) { create(:user, :account_manager) }
+
+    permissions :create? do
+      it { is_expected.to permit(user_context, AccountAuth) }
+    end
+    permissions :update? do
+      it { is_expected.to permit(user_context, account_auth) }
+    end
+    permissions :destroy? do
+      it { is_expected.to permit(user_context, account_auth) }
+    end
+
+    permissions ".scope" do
+      subject { Pundit.policy_scope!(user_context, AccountAuth) }
+      
+      it { is_expected.to include(member_account_auth) }
+      it { is_expected.not_to include(non_member_account_auth) }
+    end
+  end
+
+  context "for an admin" do
+    let(:user) { create(:user, :admin) }
+
+    permissions :create? do
+      it { is_expected.to permit(user_context, AccountAuth) }
+    end
+    permissions :update? do
+      it { is_expected.to permit(user_context, account_auth) }
+    end
+    permissions :destroy? do
+      it { is_expected.to permit(user_context, account_auth) }
+    end
+
+    permissions ".scope" do
+      subject { Pundit.policy_scope!(user_context, AccountAuth) }
+      
+      it { is_expected.to include(member_account_auth) }
+      it { is_expected.to include(non_member_account_auth) }
+    end
+  end
+end

spec/policies/account_policy_spec.rb

@@ -0,0 +1,45 @@
+require "rails_helper"
+
+RSpec.describe AccountPolicy do
+  subject { described_class }
+
+  let(:user_context) { UserContext.new(user, build(:account)) }
+
+  context "when user is admin" do
+    let(:user) { create(:user, :admin) }
+
+    permissions :create? do
+      it { is_expected.to permit(user_context, :create) }
+    end
+
+    permissions :show? do
+      it { is_expected.to permit(user_context, :show) }
+    end
+
+    permissions :update? do
+      it { is_expected.to permit(user_context, :show) }
+    end
+
+    permissions ".scope" do
+      subject { Pundit.policy_scope!(user, Account) }
+      it { is_expected.not_to be_empty }
+    end
+  end
+
+  context "when user is NOT admin" do
+    let(:user) { create(:user, :associate) }
+
+    permissions :create? do
+      it { is_expected.not_to permit(user_context, :create) }
+    end
+
+    permissions :show? do
+      it { is_expected.not_to permit(user_context, :show) }
+    end
+
+    permissions ".scope" do
+      subject { Pundit.policy_scope!(user, Account) }
+      it { is_expected.to eq(user.accounts) }
+    end
+  end
+end

spec/policies/acquired_media_release_policy_spec.rb

@@ -0,0 +1,29 @@
+require "rails_helper"
+
+describe AcquiredMediaReleasePolicy do
+  let(:user_context) { build(:user_context) }
+
+  subject { described_class }
+
+  permissions :create? do
+    it { is_expected.to permit(:create) }
+  end
+
+  permissions :show? do
+    it { is_expected.to permit(:show) }
+  end
+
+  permissions :update? do
+    context "for a native release" do
+      it { is_expected.not_to permit(user_context, build(:acquired_media_release, :native)) }
+    end
+
+    context "for a non-native release" do
+      it { is_expected.to permit(user_context, build(:acquired_media_release, :non_native)) }
+    end
+  end
+
+  permissions :destroy? do
+    it { is_expected.to permit(:destroy) }
+  end
+end

spec/policies/appearance_release_policy_spec.rb

@@ -0,0 +1,29 @@
+require "rails_helper"
+
+describe AppearanceReleasePolicy do
+  let(:user_context) { build(:user_context) }
+
+  subject { described_class }
+
+  permissions :create? do
+    it { is_expected.to permit(:create) }
+  end
+
+  permissions :show? do
+    it { is_expected.to permit(:show) }
+  end
+
+  permissions :update? do
+    context "for a native release" do
+      it { is_expected.not_to permit(user_context, build(:appearance_release, :native)) }
+    end
+
+    context "for a non-native release" do
+      it { is_expected.to permit(user_context, build(:appearance_release, :non_native)) }
+    end
+  end
+
+  permissions :destroy? do
+    it { is_expected.to permit(:destroy) }
+  end
+end

spec/policies/audio_confirmation_policy_spec.rb

@@ -0,0 +1,15 @@
+require "rails_helper"
+
+RSpec.describe AudioConfirmationPolicy do
+  let(:user_context) { build(:user_context) }
+
+  subject { described_class }
+
+  permissions :create? do
+    it { is_expected.to permit(:create) }
+  end
+
+  permissions :destroy? do
+    it { is_expected.to permit(:destroy) }
+  end
+end

spec/policies/blank_contract_policy_spec.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe BlankContractPolicy do
+  let(:user_context) { create(:user_context, user: user, account: user.primary_account) }
+
+  subject { described_class }
+
+  context 'for an associate' do
+    let(:user) { create(:user, :associate) }
+
+    permissions :show? do
+      it { is_expected.to permit(user_context, :show) }
+    end
+  end
+
+  context 'for a manager' do
+    let(:user) { create(:user, :manager) }
+
+    permissions :show? do
+      it { is_expected.to permit(user_context, :show) }
+    end
+  end
+
+  context 'for an account manager' do
+    let(:user) { create(:user, :account_manager) }
+
+    permissions :show? do
+      it { is_expected.to permit(user_context, :show) }
+    end
+  end
+end

spec/policies/bookmark_policy_spec.rb

@@ -0,0 +1,15 @@
+require 'rails_helper'
+
+describe BookmarkPolicy do
+  let(:user_context) { build(:user_context) }
+
+  subject { described_class }
+
+  permissions :create? do
+    it { is_expected.to permit(:create) }
+  end
+
+  permissions :destroy? do
+    it { is_expected.to permit(:destroy) }
+  end
+end

spec/policies/broadcast_policy_spec.rb

@@ -0,0 +1,67 @@
+require "rails_helper"
+
+describe BroadcastPolicy do
+  subject { described_class }
+
+  let(:user_context) { build(:user_context, user: user, account: user.primary_account) }
+
+  context "for an associate" do
+    let(:user) { create(:user, :associate, admin: false) }
+
+    permissions :index? do
+      it { is_expected.to permit(user_context, subject) }
+    end
+
+    permissions :create? do
+      it { is_expected.not_to permit(user_context, subject) }
+    end
+
+    permissions :show? do
+      it { is_expected.to permit(user_context, subject) }
+    end
+
+    permissions :destroy? do
+      it { is_expected.not_to permit(user_context, subject) }
+    end
+  end
+
+  context "for a project manager" do
+    let(:user) { create(:user, :manager, admin: false) }
+
+    permissions :index? do
+      it { is_expected.to permit(user_context, subject) }
+    end
+
+    permissions :create? do
+      it { is_expected.to permit(user_context, subject) }
+    end
+
+    permissions :show? do
+      it { is_expected.to permit(user_context, subject) }
+    end
+    
+    permissions :destroy? do
+      it { is_expected.to permit(user_context, subject) }
+    end
+  end
+  
+  context "for account managers" do
+    let(:user) { create(:user, :account_manager, admin: false) }
+
+    permissions :index? do
+      it { is_expected.to permit(user_context, subject) }
+    end
+
+    permissions :create? do
+      it { is_expected.to permit(user_context, subject) }
+    end
+    
+    permissions :show? do
+      it { is_expected.to permit(user_context, subject) }
+    end
+    
+    permissions :destroy? do
+      it { is_expected.to permit(user_context, subject) }
+    end
+  end
+end

spec/policies/contract_policy_spec.rb

@@ -0,0 +1,23 @@
+require 'rails_helper'
+
+RSpec.describe ContractPolicy do
+  let(:user_context) { create(:user_context, user: user, account: user.primary_account) }
+
+  subject { described_class }
+
+  context "for an associate" do
+    let(:user) { create(:user, :associate) }
+
+    permissions :show? do
+      it { is_expected.not_to permit(user_context, :show) }
+    end
+  end
+
+  context "for a manager" do
+    let(:user) { create(:user, :manager) }
+
+    permissions :show? do
+      it { is_expected.to permit(user_context, :show) }
+    end
+  end
+end

spec/policies/contract_template_policy_spec.rb

@@ -0,0 +1,117 @@
+require "rails_helper"
+
+describe ContractTemplatePolicy do
+  let(:user) { create(:user) }
+  let(:project) { create(:project, account: user.primary_account) }
+  let(:contract_template) { build(:contract_template, project: project) }
+  let(:user_context) { build(:user_context, user: user, account: user.primary_account) }
+
+  subject { described_class }
+
+  context "for an associate" do
+    let(:user) { create(:user, :associate) }
+
+    permissions :create? do
+      it { is_expected.not_to permit(user_context, :create) }
+    end
+
+    permissions :show? do
+      it { is_expected.to permit(user_context, :show) }
+    end
+
+    permissions :destroy? do
+      it { is_expected.not_to permit(user_context, contract_template) }
+
+      context "when there are associated releases" do
+        let(:contract_template) { create(:contract_template, appearance_releases: build_list(:appearance_release, 1)) }
+
+        it { is_expected.not_to permit(user_context, contract_template) }
+      end
+    end
+  end
+
+  context "for a manager" do
+    let(:user) { create(:user, :manager) }
+
+    permissions :create? do
+      it { is_expected.to permit(user_context, :create) }
+    end
+
+    permissions :show? do
+      it { is_expected.to permit(user_context, :show) }
+    end
+
+    permissions :destroy? do
+      it { is_expected.to permit(user_context, contract_template) }
+
+      context "when there are associated releases" do
+        let(:contract_template) { create(:contract_template, appearance_releases: build_list(:appearance_release, 1)) }
+
+        it { is_expected.to permit(user_context, contract_template) }
+      end
+    end
+  end
+
+  context "for an account manager" do
+    let(:user) { create(:user, :account_manager) }
+
+    permissions :create? do
+      it { is_expected.to permit(user_context, :create) }
+    end
+
+    permissions :show? do
+      it { is_expected.to permit(user_context, :show) }
+    end
+
+    permissions :destroy? do
+      it { is_expected.to permit(user_context, contract_template) }
+
+      context "when there are associated releases" do
+        let(:contract_template) { create(:contract_template, appearance_releases: build_list(:appearance_release, 1)) }
+
+        it { is_expected.to permit(user_context, contract_template) }
+      end
+    end
+  end
+
+  permissions ".scope" do
+    let!(:member_project) do
+      create(:project_with_contract_template, name: "Member Project", members: user, account: account)
+    end
+    let!(:non_member_project) do
+      create(:project_with_contract_template, name: "Non-Member Project", account: account)
+    end
+    let!(:outside_project) do
+      create(:project_with_contract_template, name: "Outside Project", account: build(:account))
+    end
+
+    let(:account) { build(:account) }
+    let(:user_context) { build(:user_context, user: user, account: account) }
+
+    subject { Pundit.policy_scope!(user_context, ContractTemplate) }
+
+    context "for an account manager" do
+      let(:user) { create(:user, :account_manager, primary_account: account)}
+
+      it { is_expected.to include(member_project.contract_templates.first) }
+      it { is_expected.to include(non_member_project.contract_templates.first) }
+      it { is_expected.not_to include(outside_project.contract_templates.first) }
+    end
+
+    context "for manager" do
+      let(:user) { create(:user, :manager, primary_account: account) }
+
+      it { is_expected.to include(member_project.contract_templates.first) }
+      it { is_expected.not_to include(non_member_project.contract_templates.first) }
+      it { is_expected.not_to include(outside_project.contract_templates.first) }
+    end
+
+    context "for associate" do
+      let(:user) { create(:user, :associate, primary_account: account) }
+
+      it { is_expected.to include(member_project.contract_templates.first) }
+      it { is_expected.not_to include(non_member_project.contract_templates.first) }
+      it { is_expected.not_to include(outside_project.contract_templates.first) }
+    end
+  end
+end

spec/policies/directory_policy_spec.rb

@@ -0,0 +1,110 @@
+require "rails_helper"
+
+describe DirectoryPolicy do
+  subject { described_class }
+
+  let(:user_context) { build(:user_context, user: user, account: user.primary_account) }
+
+  context "for an associate" do
+    let(:user) { create(:user, :associate, admin: false) }
+
+    permissions :create? do
+      it { is_expected.to permit(user_context, subject) }
+    end
+    permissions :show? do
+      it { is_expected.to permit(user_context, subject) }
+    end
+    permissions :update? do
+      it { is_expected.to permit(user_context, subject) }
+    end
+    permissions :destroy? do
+      it { is_expected.to permit(user_context, subject) }
+    end
+    permissions :new_file? do
+      it { is_expected.to permit(user_context, subject) }
+    end
+    permissions :download_file? do
+      it { is_expected.to permit(user_context, subject) }
+    end
+    permissions :destroy_file? do
+      it { is_expected.to permit(user_context, subject) }
+    end
+    permissions :can_view_permissions_settings? do
+      it { is_expected.not_to permit(user_context, subject) }
+    end
+
+    permissions ".scope" do
+      let!(:project) { create(:project_with_directories, name: "Project", members: user, account: user.primary_account) }
+
+      subject { Pundit.policy_scope!(user_context, project.directories) }
+      
+      it "returns all directories for associate" do
+        names = subject.map(&:name)
+
+        expect(names).to include("Shared")
+        expect(names).not_to include("Financial Documents")
+        expect(names).not_to include("Salaries")
+      end
+    end
+  end
+
+  context "for a project manager" do
+    let(:user) { create(:user, :manager, admin: false) }
+
+    permissions :create? do
+      it { is_expected.to permit(user_context, subject) }
+    end
+    permissions :show? do
+      it { is_expected.to permit(user_context, subject) }
+    end
+    permissions :update? do
+      it { is_expected.to permit(user_context, subject) }
+    end
+    permissions :destroy? do
+      it { is_expected.to permit(user_context, subject) }
+    end
+    permissions :new_file? do
+      it { is_expected.to permit(user_context, subject) }
+    end
+    permissions :download_file? do
+      it { is_expected.to permit(user_context, subject) }
+    end
+    permissions :destroy_file? do
+      it { is_expected.to permit(user_context, subject) }
+    end
+    permissions :can_view_permissions_settings? do
+      it { is_expected.to permit(user_context, subject) }
+    end
+
+    permissions ".scope" do
+      let!(:project) { create(:project_with_directories, name: "Project", members: user, account: user.primary_account) }
+
+      subject { Pundit.policy_scope!(user_context, project.directories) }
+      
+      it "returns all directories for manager" do
+        names = subject.map(&:name)
+
+        expect(names).to include("Shared")
+        expect(names).to include("Financial Documents")
+        expect(names).not_to include("Salaries")
+      end
+    end
+  end
+  
+  context "for account managers" do
+    permissions ".scope" do
+      let(:user) { create(:user, :account_manager) }
+      let!(:project) { create(:project_with_directories, name: "Project", account: user.primary_account) }
+
+      subject { Pundit.policy_scope!(user_context, project.directories) }
+      
+      it "returns all directories for manager" do
+        names = subject.map(&:name)
+
+        expect(names).to include("Shared")
+        expect(names).to include("Financial Documents")
+        expect(names).to include("Salaries")
+      end
+    end
+  end
+end

spec/policies/excel_reports/audio_reports/bray_innovation_group_music_cue_report_policy_spec.rb

@@ -0,0 +1,15 @@
+require "rails_helper"
+
+module ExcelReports
+  module AudioReports
+    RSpec.describe BrayInnovationGroupMusicCueReportPolicy do
+      let(:user_context) { build(:user_context) }
+
+      subject { described_class }
+
+      permissions :show? do
+        it { is_expected.to permit(:show) }
+      end
+    end
+  end
+end

spec/policies/excel_reports/audio_reports/discovery_music_cue_report_policy_spec.rb

@@ -0,0 +1,15 @@
+require "rails_helper"
+
+module ExcelReports
+  module AudioReports
+    RSpec.describe DiscoveryMusicCueReportPolicy do
+      let(:user_context) { build(:user_context) }
+
+      subject { described_class }
+
+      permissions :show? do
+        it { is_expected.to permit(:show) }
+      end
+    end
+  end
+end

spec/policies/excel_reports/audio_reports/nat_geo_music_cue_sheet_policy_spec.rb

@@ -0,0 +1,15 @@
+require "rails_helper"
+
+module ExcelReports
+  module AudioReports
+    RSpec.describe NatGeoMusicCueSheetPolicy do
+      let(:user_context) { build(:user_context) }
+
+      subject { described_class }
+
+      permissions :show? do
+        it { is_expected.to permit(:show) }
+      end
+    end
+  end
+end

spec/policies/excel_reports/audio_reports/nat_geo_original_music-log_policy_spec.rb

@@ -0,0 +1,15 @@
+require "rails_helper"
+
+module ExcelReports
+  module AudioReports
+    RSpec.describe NatGeoOriginalMusicLogPolicy do
+      let(:user_context) { build(:user_context) }
+
+      subject { described_class }
+
+      permissions :show? do
+        it { is_expected.to permit(:show) }
+      end
+    end
+  end
+end

spec/policies/excel_reports/audio_reports/nat_geo_original_music_log_policy_spec.rb

@@ -0,0 +1,15 @@
+require "rails_helper"
+
+module ExcelReports
+  module AudioReports
+    RSpec.describe NatGeoOriginalMusicLogPolicy do
+      let(:user_context) { build(:user_context) }
+
+      subject { described_class }
+
+      permissions :show? do
+        it { is_expected.to permit(:show) }
+      end
+    end
+  end
+end

spec/policies/excel_reports/graphic_reports/discovery_gfx_cue_list_policy_spec.rb

@@ -0,0 +1,15 @@
+require 'rails_helper'
+
+module ExcelReports
+  module GraphicReports
+    RSpec.describe DiscoveryGfxCueListPolicy do
+      let(:user_context) { build(:user_context) }
+
+      subject { described_class }
+
+      permissions :show? do
+        it { is_expected.to permit(:show) }
+      end
+    end
+  end
+end

spec/policies/excel_reports/graphic_reports/nat_geo_text_graphics_log_policy_spec.rb

@@ -0,0 +1,15 @@
+require "rails_helper"
+
+module ExcelReports
+  module GraphicReports
+    RSpec.describe NatGeoTextGraphicsLogPolicy do
+      let(:user_context) { build(:user_context) }
+
+      subject { described_class }
+
+      permissions :show? do
+        it { is_expected.to permit(:show) }
+      end
+    end
+  end
+end

spec/policies/excel_reports/issues_and_concerns_reports/issues_and_concerns_report_policy_spec.rb

@@ -0,0 +1,15 @@
+require "rails_helper"
+
+module ExcelReports
+  module IssuesAndConcernsReports
+    RSpec.describe IssuesAndConcernsReportPolicy do
+      let(:user_context) { build(:user_context) }
+
+      subject { described_class }
+
+      permissions :show? do
+        it { is_expected.to permit(:show) }
+      end
+    end
+  end
+end

spec/policies/excel_reports/video_reports/discovery_production_elements_log_policy_spec.rb

@@ -0,0 +1,15 @@
+require "rails_helper"
+
+module ExcelReports
+  module VideoReports
+    RSpec.describe DiscoveryProductionElementsLogPolicy do
+      let(:user_context) { build(:user_context) }
+
+      subject { described_class }
+
+      permissions :show? do
+        it { is_expected.to permit(:show) }
+      end
+    end
+  end
+end

spec/policies/excel_reports/video_reports/nat_geo_legal_binder_log_policy_spec.rb

@@ -0,0 +1,15 @@
+require "rails_helper"
+
+module ExcelReports
+  module VideoReports
+    RSpec.describe NatGeoLegalBinderLogPolicy do
+      let(:user_context) { build(:user_context) }
+
+      subject { described_class }
+
+      permissions :show? do
+        it { is_expected.to permit(:show) }
+      end
+    end
+  end
+end

spec/policies/graphics_element_policy_spec.rb

@@ -0,0 +1,19 @@
+require "rails_helper"
+
+RSpec.describe GraphicsElementPolicy do
+  let(:user_context) { build(:user_context) }
+
+  subject { described_class }
+
+  permissions :create? do
+    it { is_expected.to permit(:create) }
+  end
+
+  permissions :update? do
+    it { is_expected.to permit(:update) }
+  end
+
+  permissions :destroy? do
+    it { is_expected.to permit(:destroy) }
+  end
+end

spec/policies/import_policy_spec.rb

@@ -0,0 +1,11 @@
+require 'rails_helper'
+
+describe ImportPolicy do
+  let(:user_context) { build(:user_context) }
+
+  subject { described_class }
+
+  permissions :create? do
+    it { is_expected.to permit(:create) }
+  end
+end

spec/policies/location_release_policy_spec.rb

@@ -0,0 +1,37 @@
+require "rails_helper"
+
+describe LocationReleasePolicy do
+  let(:user_context) { build(:user_context) }
+
+  subject { described_class }
+
+  permissions :create? do
+    it { is_expected.to permit(:create?) }
+  end
+
+  permissions :show? do
+    it { is_expected.to permit(:show) }
+  end
+
+  permissions :update? do
+    context 'for a native release' do
+      it { is_expected.not_to permit(user_context, build(:location_release, :native)) }
+    end
+
+    context 'for a non-native release' do
+      it { is_expected.to permit(user_context, build(:location_release, :non_native)) }
+    end
+  end
+
+  permissions :destroy? do
+    it { is_expected.to permit(:destroy) }
+  end
+
+  permissions :edit_photos? do
+    it { is_expected.to permit(:edit_photos) }
+  end
+
+  permissions :update_photos? do
+    it { is_expected.to permit(:update_photos) }
+  end
+end

spec/policies/material_release_policy_spec.rb

@@ -0,0 +1,37 @@
+require "rails_helper"
+
+describe MaterialReleasePolicy do
+  let(:user_context) { build(:user_context) }
+
+  subject { described_class }
+
+  permissions :create? do
+    it { is_expected.to permit(:create) }
+  end
+
+  permissions :show? do
+    it { is_expected.to permit(:show) }
+  end
+
+  permissions :update? do
+    context "for a native release" do
+      it { is_expected.not_to permit(user_context, build(:material_release, :native)) }
+    end
+
+    context "for a non-native release" do
+      it { is_expected.to permit(user_context, build(:material_release, :non_native)) }
+    end
+  end
+
+  permissions :destroy? do
+    it { is_expected.to permit(:destroy) }
+  end
+
+  permissions :edit_photos? do
+    it { is_expected.to permit(:edit_photos) }
+  end
+
+  permissions :update_photos? do
+    it { is_expected.to permit(:update_photos) }
+  end
+end

spec/policies/music_release_policy_spec.rb

@@ -0,0 +1,23 @@
+require "rails_helper"
+
+RSpec.describe MusicReleasePolicy do
+  let(:user_context) { build(:user_context) }
+
+  subject { described_class }
+
+  permissions :create? do
+    it { is_expected.to permit(:create) }
+  end
+
+  permissions :show? do
+    it { is_expected.to permit(:show) }
+  end
+
+  permissions :update? do
+    it { is_expected.to permit(:update) }
+  end
+
+  permissions :destroy? do
+    it { is_expected.to permit(:destroy) }
+  end
+end

spec/policies/note_policy_spec.rb

@@ -0,0 +1,11 @@
+require "rails_helper"
+
+describe NotePolicy do
+  let(:user_context) { build(:user_context) }
+
+  subject { described_class }
+
+  permissions :create? do
+    it { is_expected.to permit(:create) }
+  end
+end

spec/policies/profile_policy_spec.rb

@@ -0,0 +1,22 @@
+require "rails_helper"
+
+describe ProfilePolicy do
+  subject { described_class }
+
+  let(:current_user) { build(:user) }
+  let(:user_context) { build(:user_context, user: current_user) }
+
+  context "for my own record" do
+    permissions :show? do
+      it { is_expected.to permit(user_context, current_user) }
+    end
+  end
+
+  context "for another record" do
+    let(:another_user) { build(:user) }
+
+    permissions :show? do
+      it { is_expected.not_to permit(user_context, another_user) }
+    end
+  end
+end

spec/policies/project_membership_policy_spec.rb

@@ -0,0 +1,29 @@
+require "rails_helper"
+
+RSpec.describe ProjectMembershipPolicy, type: :policy do
+  subject { described_class }
+
+  let(:user_context) { build(:user_context, user: user, account: user.primary_account) }
+
+  context "for an associate" do
+    let(:user) { create(:user, :associate) }
+
+    permissions :create? do
+      it { is_expected.not_to permit(user_context, subject) }
+    end
+    permissions :destroy? do
+      it { is_expected.not_to permit(user_context, subject) }
+    end
+  end
+
+  context "for manager" do
+    let(:user) { create(:user, :manager) }
+
+    permissions :create? do
+      it { is_expected.to permit(user_context, subject) }
+    end
+    permissions :destroy? do
+      it { is_expected.to permit(user_context, subject) }
+    end
+  end
+end

spec/policies/project_policy_spec.rb

@@ -0,0 +1,115 @@
+require "rails_helper"
+
+describe ProjectPolicy do
+  subject { described_class }
+
+  let(:account) { build(:account) }
+  let(:project) { build(:project, account: account) }
+  let(:user_context) { build(:user_context, user: user, account: account) }
+
+  shared_examples "requires project membership" do
+    context "without a project membership" do
+      let(:project) { create(:project, members: [], account: account) }
+
+      it { is_expected.not_to permit(user_context, project) }
+    end
+
+    context "with a project membership" do
+      let(:project) { create(:project, members: user, account: account) }
+
+      it { is_expected.to permit(user_context, project) }
+    end
+  end
+
+  context "for an associate" do
+    let(:user) { create(:user, :associate, primary_account: account) }
+
+    permissions :index? do
+      it { is_expected.to permit(user_context, project) }
+    end
+    permissions :create? do
+      it { is_expected.not_to permit(user_context, project) }
+    end
+    permissions :show? do
+      include_examples "requires project membership"
+    end
+    permissions :update? do
+      it { is_expected.not_to permit(user_context, project) }
+    end
+    permissions :destroy? do
+      it { is_expected.not_to permit(user_context, project) }
+    end
+  end
+
+  context "for a manager" do
+    let(:user) { create(:user, :manager, primary_account: account) }
+
+    permissions :index? do
+      it { is_expected.to permit(user_context, project) }
+    end
+    permissions :create? do
+      it { is_expected.not_to permit(user_context, project) }
+    end
+    permissions :show? do
+      include_examples "requires project membership"
+    end
+    permissions :update? do
+      it { is_expected.to permit(user_context, project) }
+    end
+    permissions :destroy? do
+      it { is_expected.not_to permit(user_context, project) }
+    end
+  end
+
+  context "for an account manager" do
+    let(:user) { create(:user, :account_manager, primary_account: account) }
+
+    permissions :index? do
+      it { is_expected.to permit(user_context, project) }
+    end
+    permissions :create? do
+      it { is_expected.to permit(user_context, project) }
+    end
+    permissions :show? do
+      it { is_expected.to permit(user_context, project) }
+    end
+    permissions :update? do
+      it { is_expected.to permit(user_context, project) }
+    end
+    permissions :destroy? do
+      it { is_expected.not_to permit(user_context, project) }
+    end
+  end
+
+  permissions ".scope" do
+    let!(:member_project) { create(:project, name: "Member Project", members: user, account: account) }
+    let!(:non_member_project) { create(:project, name: "Non-Member Project", account: account) }
+    let!(:outside_project) { create(:project, name: "Outside Project", account: build(:account)) }
+
+    subject { Pundit.policy_scope!(user_context, Project) }
+
+    context "for an associate" do
+      let(:user) { create(:user, :associate, primary_account: account) }
+
+      it { is_expected.to include(member_project) }
+      it { is_expected.not_to include(non_member_project) }
+      it { is_expected.not_to include(outside_project) }
+    end
+
+    context "for a manager" do
+      let(:user) { create(:user, :manager, primary_account: account) }
+
+      it { is_expected.to include(member_project) }
+      it { is_expected.not_to include(non_member_project) }
+      it { is_expected.not_to include(outside_project) }
+    end
+
+    context "for an account manager" do
+      let(:user) { create(:user, :account_manager, primary_account: account) }
+
+      it { is_expected.to include(member_project) }
+      it { is_expected.to include(non_member_project) }
+      it { is_expected.not_to include(outside_project) }
+    end
+  end
+end

spec/policies/qr_code_policy_spec.rb

@@ -0,0 +1,23 @@
+require 'rails_helper'
+
+describe QrCodePolicy do
+  let(:user_context) { build(:user_context) }
+
+  subject { described_class }
+
+  permissions :show? do
+    it { is_expected.to permit(:show) }
+  end
+
+  permissions :create? do
+    it { is_expected.not_to permit(:create) }
+  end
+
+  permissions :update? do
+    it { is_expected.not_to permit(:update) }
+  end
+
+  permissions :destroy? do
+    it { is_expected.not_to permit(:destroy) }
+  end
+end

spec/policies/talent_release_policy_spec.rb

@@ -0,0 +1,37 @@
+require "rails_helper"
+
+describe TalentReleasePolicy do
+  let(:user_context) { build(:user_context) }
+
+  subject { described_class }
+
+  permissions :create? do
+    it { is_expected.to permit(:create) }
+  end
+
+  permissions :show? do
+    it { is_expected.to permit(:show) }
+  end
+
+  permissions :update? do
+    context "for a native release" do
+      it { is_expected.not_to permit(user_context, build(:talent_release, :native)) }
+    end
+
+    context "for a non-native release" do
+      it { is_expected.to permit(user_context, build(:talent_release, :non_native)) }
+    end
+  end
+
+  permissions :destroy? do
+    it { is_expected.to permit(:destroy) }
+  end
+
+  permissions :edit_photos? do
+    it { is_expected.to permit(:edit_photos) }
+  end
+
+  permissions :update_photos? do
+    it { is_expected.to permit(:update_photos) }
+  end
+end

spec/policies/unreleased_appearance_policy_spec.rb

@@ -0,0 +1,19 @@
+require 'rails_helper'
+
+describe UnreleasedAppearancePolicy do
+  let(:user_context) { build(:user_context) }
+
+  subject { described_class }
+
+  permissions :create? do
+    it { is_expected.to permit(:create) }
+  end
+
+  permissions :update? do
+    it { is_expected.to permit(:update) }
+  end
+
+  permissions :destroy? do
+    it { is_expected.to permit(:destroy) }
+  end
+end

spec/policies/user_policy_spec.rb

@@ -0,0 +1,64 @@
+require "rails_helper"
+
+RSpec.describe UserPolicy do
+  let(:user) { build(:user, admin: false) }
+  let(:user_context) { build(:user_context, user: user, account: user.primary_account) }
+
+  subject { described_class }
+
+  permissions :create? do
+    context "when user is admin" do
+      let(:user) { create(:user, :admin) }
+
+      it { is_expected.to permit(user_context, :create) }
+    end
+
+    context "when user is NOT admin" do
+      let(:user) { create(:user, :associate) }
+
+      it { is_expected.not_to permit(user_context, :create) }
+    end
+  end
+
+  permissions :update? do
+    context "when user is admin" do
+      let(:user) { create(:user, :admin) }
+
+      it { is_expected.to permit(user_context, :update) }
+    end
+
+    context "when user is NOT admin" do
+      let(:user) { create(:user) }
+
+      it { is_expected.not_to permit(user_context, :update) }
+    end
+  end
+
+  permissions :destroy? do
+    context "when user is admin" do
+      let(:user) { create(:user, :admin) }
+
+      it { is_expected.to permit(user_context, :destroy) }
+    end
+
+    context "when user is NOT admin" do
+      let(:user) { create(:user) }
+
+      it { is_expected.not_to permit(user_context, :destroy) }
+    end
+  end
+
+  permissions ".scope" do
+    subject { Pundit.policy_scope!(user_context, User) }
+
+    context "as a normal user" do
+      it { is_expected.to be_empty }
+    end
+
+    context "as an admin" do
+      let(:user) { create(:user, :admin) }
+
+      it { is_expected.not_to be_empty }
+    end
+  end
+end

spec/policies/video_analysis_policy_spec.rb

@@ -0,0 +1,28 @@
+require "rails_helper"
+
+describe VideoAnalysisPolicy do
+  let(:user) { build(:user) }
+  let(:user_context) { build(:user_context, user: user, account: user.primary_account) }
+
+  subject { described_class }
+
+  permissions :create? do
+    it { is_expected.not_to permit(user_context, VideoAnalysis ) }
+
+    context "as an admin" do
+      let(:user) { build(:user, :admin) }
+      
+      it { is_expected.to permit(user_context, VideoAnalysis) }
+    end
+  end
+
+  permissions :show? do
+    it { is_expected.not_to permit(user_context, VideoAnalysis) }
+
+    context "as an admin" do
+      let(:user) { build(:user, :admin) }
+      
+      it { is_expected.to permit(user_context, VideoAnalysis) }
+    end
+  end
+end

spec/policies/video_policy_spec.rb

@@ -0,0 +1,60 @@
+require "rails_helper"
+
+describe VideoPolicy do
+  let(:user) { build(:user) }
+  let(:user_context) { build(:user_context, user: user, account: user.primary_account) }
+
+  subject { described_class }
+
+  permissions :create? do
+    it { is_expected.to permit(:create) }
+  end
+
+  permissions :show? do
+    it { is_expected.to permit(:show) }
+  end
+
+  permissions :update? do
+    it { is_expected.to permit(:update) }
+  end
+
+  permissions ".scope" do
+    let!(:member_video) { create(:video, project: build(:project, name: "Member Project", account: user.primary_account)) }
+    let!(:non_member_video) { create(:video, project: build(:project, name: "Non-Member Project", account: user.primary_account)) }
+    let!(:outside_video) { create(:video, project: build(:project, name: "Outside Project", account: build(:account))) }
+
+    subject { Pundit.policy_scope!(user_context, Video) }
+
+    context "for an associate" do
+      let(:user) { create(:user, :associate) }
+
+      before do
+        create(:project_membership, project: member_video.project, user: user)
+      end
+
+      it { is_expected.to include(member_video) }
+      it { is_expected.not_to include(non_member_video) }
+      it { is_expected.not_to include(outside_video) }
+    end
+
+    context "for a manager" do
+      let(:user) { create(:user, :manager) }
+
+      before do
+        create(:project_membership, project: member_video.project, user: user)
+      end
+
+      it { is_expected.to include(member_video) }
+      it { is_expected.not_to include(non_member_video) }
+      it { is_expected.not_to include(outside_video) }
+    end
+
+    context "for an account manager" do
+      let(:user) { create(:user, :account_manager) }
+      
+      it { is_expected.to include(member_video) }
+      it { is_expected.to include(non_member_video) }
+      it { is_expected.not_to include(outside_video) }
+    end
+  end
+end

spec/policies/video_release_confirmation_policy_spec.rb

@@ -0,0 +1,15 @@
+require 'rails_helper'
+
+describe VideoReleaseConfirmationPolicy do
+  let(:user_context) { build(:user_context) }
+
+  subject { described_class }
+
+  permissions :create? do
+    it { is_expected.to permit(:create) }
+  end
+
+  permissions :destroy? do
+    it { is_expected.to permit(:destroy) }
+  end
+end

spec/policies/videos/report_publication_policy.rb

@@ -0,0 +1,27 @@
+require 'rails_helper'
+
+describe Videos::ReportPublicationPolicy do
+  let(:user_context) { build(:user_context) }
+
+  subject { described_class }
+
+  permissions :create? do
+    it { is_expected.not_to permit(user_context, :create) }
+
+    context 'as an admin' do
+      let(:user) { build(:user, :admin) }
+      
+      it { is_expected.to permit(user_context, Videos::ReportPublication) }
+    end
+  end
+
+  permissions :destroy? do
+    it { is_expected.not_to permit(user_context, :create) }
+
+    context 'as an admin' do
+      let(:user) { build(:user, :admin) }
+      
+      it { is_expected.to permit(user_context, Videos::ReportPublication) }
+    end
+  end
+end