Gate live-content changes on restricted surfaces

publish_draft!, trash!, destroy_from_trash!, attach_asset! and
Asset#destroy_witnessed! now refuse unless the acting user holds redaktion,
and only when the subject is on a restricted surface: the front page, the
updates tree that feeds ~100k subscribers, or disclosure. Drafting,
autosaving, tagging and creating stay free everywhere for everyone.

Enforcement is in the models rather than the controllers, since attach_asset!
and the rest are reachable from rake tasks and internal paths. It follows the
errors.add-plus-bare-raise pattern the rest of Node already uses, so every
existing RecordInvalid rescue reports it with a localised message; only
assets_controller#destroy needed a rescue added.

A nil user is treated as a system context and bypasses the gate. The default
nil on three of those verbs is what makes that reachable, and removing those
defaults once every call site passes a user is the next tightening.

4 files changed, 111 insertions, 0 deletions

diff --git a/test/controllers/nodes_controller_test.rb b/test/controllers/nodes_controller_test.rb
index 0b6e65ee..f15be067 100644
--- a/test/controllers/nodes_controller_test.rb
+++ b/test/controllers/nodes_controller_test.rb
@@ -770,6 +770,20 @@ class NodesControllerTest < ActionController::TestCase
     assert_select "form[action=?]", node_path(node), count: 1
   end
 
+  test "publishing a restricted node without the redaktion role flashes and does not publish" do
+    login_as :quentin
+    updates = Node.root.children.create!(:slug => "updates")
+    node    = updates.children.create!(:slug => "controller-gated")
+    node.reload.draft.update!(:title => "Entwurf")
+
+    put :publish, params: { :id => node.id }
+
+    assert_redirected_to node_path(node)
+    assert_match I18n.t("activerecord.errors.models.node.attributes.base.not_permitted"),
+                 flash[:error]
+    assert_nil node.reload.head
+  end
+
 test "show annotates history rows with their lifecycle" do
     login_as :quentin
     node = Node.root.children.create!(:slug => "history_annotation_test")
diff --git a/test/models/asset_destroy_test.rb b/test/models/asset_destroy_test.rb
index 5583f685..2f38d692 100644
--- a/test/models/asset_destroy_test.rb
+++ b/test/models/asset_destroy_test.rb
@@ -48,4 +48,17 @@ class AssetDestroyTest < ActiveSupport::TestCase
     assert_equal "Doomed asset", action.metadata["asset_name"]
     assert_nil action.action_participants.first.subject
   end
+
+  test "destroying an asset attached to a restricted node needs the redaktion role" do
+    editor = User.create!(:login => "asset_gate", :email => "ag@example.com",
+                          :password => "secret", :password_confirmation => "secret")
+    updates = Node.root.children.create!(:slug => "updates")
+    node    = updates.children.create!(:slug => "gated-attachment")
+    node.reload.attach_asset!(@asset, :user => nil)
+
+    error = assert_raises(ActiveRecord::RecordInvalid) { @asset.destroy_witnessed!(:user => editor) }
+    assert_includes error.message,
+                    I18n.t("activerecord.errors.models.asset.attributes.base.not_permitted")
+    assert Asset.exists?(@asset.id)
+  end
 end
diff --git a/test/models/node_test.rb b/test/models/node_test.rb
index c1316ea6..f57f83bf 100644
--- a/test/models/node_test.rb
+++ b/test/models/node_test.rb
@@ -936,4 +936,72 @@ class NodeTest < ActiveSupport::TestCase
                       I18n.t("activerecord.errors.models.node.attributes.base.trash_the_trash")
     end
   end
+
+  test "restricted? covers the root node, the restricted subtrees and their descendants" do
+    assert Node.root.restricted?, "the front page aggregates the feed"
+
+    updates = Node.root.children.create!(:slug => "updates")
+    assert updates.restricted?
+    year = updates.children.create!(:slug => "2026")
+    assert year.reload.restricted?
+    post = year.children.create!(:slug => "some-post")
+    assert post.reload.restricted?
+
+    disclosure = Node.root.children.create!(:slug => "disclosure")
+    assert disclosure.restricted?
+
+    plain = Node.root.children.create!(:slug => "club")
+    assert_not plain.restricted?
+    child = plain.children.create!(:slug => "erfas")
+    assert_not child.reload.restricted?
+  end
+
+  test "restricted? does not match a prefix that is merely a substring" do
+    decoy = Node.root.children.create!(:slug => "updatesomething")
+    assert_not decoy.restricted?
+  end
+
+  test "publishing a restricted node is refused without the redaktion role" do
+    editor = User.create!(:login => "guard_editor", :email => "gd@example.com",
+                          :password => "secret", :password_confirmation => "secret")
+    updates = Node.root.children.create!(:slug => "updates")
+    node    = updates.children.create!(:slug => "guarded-post")
+    node.reload.draft.update!(:title => "Entwurf")
+
+    error = assert_raises(ActiveRecord::RecordInvalid) { node.publish_draft!(editor) }
+    assert_includes error.message,
+                    I18n.t("activerecord.errors.models.node.attributes.base.not_permitted")
+    assert_nil node.reload.head
+  end
+
+  test "publishing a restricted node succeeds with the redaktion role" do
+    red = User.create!(:login => "guard_red", :email => "gr2@example.com",
+                       :password => "secret", :password_confirmation => "secret",
+                       :roles => ["redaktion"])
+    updates = Node.root.children.create!(:slug => "updates")
+    node    = updates.children.create!(:slug => "allowed-post")
+    node.reload.draft.update!(:title => "Entwurf")
+
+    node.publish_draft!(red)
+    assert_not_nil node.reload.head
+  end
+
+  test "publishing outside the restricted subtrees needs no role" do
+    editor = User.create!(:login => "guard_free", :email => "gf@example.com",
+                          :password => "secret", :password_confirmation => "secret")
+    node = Node.root.children.create!(:slug => "guard-free-post")
+    node.reload.draft.update!(:title => "Entwurf")
+
+    node.publish_draft!(editor)
+    assert_not_nil node.reload.head
+  end
+
+  test "a nil user is a system context and bypasses the gate" do
+    updates = Node.root.children.create!(:slug => "updates")
+    node    = updates.children.create!(:slug => "system-post")
+    node.reload.draft.update!(:title => "Entwurf")
+
+    node.publish_draft!
+    assert_not_nil node.reload.head
+  end
 end
diff --git a/test/models/user_test.rb b/test/models/user_test.rb
index feccce25..9942385c 100644
--- a/test/models/user_test.rb
+++ b/test/models/user_test.rb
@@ -126,6 +126,22 @@ class UserTest < ActiveSupport::TestCase
 
     assert user.update(:email => "quentin@example.org")
   end
+
+  test "may_change_live? gates restricted subjects on the redaktion role" do
+    editor    = User.create!(:login => "gate_editor", :email => "ge@example.com",
+                             :password => "secret", :password_confirmation => "secret")
+    redaktion = User.create!(:login => "gate_red", :email => "gr@example.com",
+                             :password => "secret", :password_confirmation => "secret",
+                             :roles => ["redaktion"])
+
+    restricted = Node.root
+    plain = Node.root.children.create!(:slug => "gate_plain")
+
+    assert     editor.may_change_live?(plain)
+    assert_not editor.may_change_live?(restricted)
+    assert     redaktion.may_change_live?(plain)
+    assert     redaktion.may_change_live?(restricted)
+  end
   
 protected
   def create_user(options = {})