Can't revoke access to all-access bucket

app/assets/stylesheets/toggles.css

@@ -0,0 +1,13 @@
+.toggler--toggled {
+  .toggler__visible-when-off {
+    display: none;
+  }
+
+  .toggler__visible-when-on {
+    display: unset;
+  }
+}
+
+.toggler__visible-when-on {
+  display: none;
+}

app/controllers/buckets_controller.rb

@@ -22,7 +22,7 @@ class BucketsController < ApplicationController
 
   def update
     @bucket.update! bucket_params
-    @bucket.accesses.revise(granted: grantees, revoked: revokees) unless @bucket.all_access?
+    @bucket.accesses.revise granted: grantees, revoked: revokees
 
     redirect_to bubbles_path(bucket_ids: [ @bucket ])
   end

app/controllers/concerns/bucket_scoped.rb

@@ -7,12 +7,6 @@ module BucketScoped
 
   private
     def set_bucket
-      bucket = Current.account.buckets.find params[:bucket_id]
-
-      if bucket.visible_to? Current.user
-        @bucket = bucket
-      else
-        head :forbidden
-      end
+      @bucket = Current.user.buckets.find(params[:bucket_id])
     end
 end

app/models/bucket/accessible.rb

@@ -15,7 +15,7 @@ module Bucket::Accessible
       end
 
       def revoke_from(users)
-        destroy_by user: users
+        destroy_by user: users unless proxy_association.owner.all_access?
       end
     end
 
@@ -27,10 +27,6 @@ module Bucket::Accessible
     after_save_commit :grant_access_to_everyone
   end
 
-  def visible_to?(user)
-    (account == user.account && all_access?) || user.bucket_ids.include?(id)
-  end
-
   private
     def grant_access_to_everyone
       accesses.grant_to(account.users) if all_access_previously_changed?(to: true)

app/views/buckets/_user_toggle.html.erb

@@ -15,7 +15,9 @@
     <%= hidden_field_tag "user_ids[]", user.id, id: nil %>
     <%= image_tag "check.svg", size: 20, class: "colorize--black flex-item-no-shrink", aria: { hidden: "true" } %>
   <% else %>
-    <label class="switch flex-item-no-shrink">
+    <%= image_tag "check.svg", size: 20, class: "toggler__visible-when-on colorize--black flex-item-no-shrink", aria: { hidden: "true" } %>
+
+    <label class="switch toggler__visible-when-off flex-item-no-shrink">
       <%= check_box_tag "user_ids[]", user.id, selected, class: "switch__input", id: nil %>
       <span class="switch__btn round"></span>
       <span class="for-screen-reader">Give <%= user.name %> access</span>

app/views/buckets/edit.html.erb

@@ -29,7 +29,7 @@
     </div>
 
     <section class="margin-block pad-inline fill-shade border-radius">
-      <menu class="flex flex-column gap margin-none pad txt-medium" data-controller="filter" data-filter-active-class="filter--active" data-filter-selected-class="selected">
+      <menu class="flex flex-column gap margin-none pad txt-medium" data-controller="filter toggle-class" data-filter-active-class="filter--active" data-filter-selected-class="selected" data-toggle-class-toggle-class="toggler--toggled">
         <li class="flex align-center gap margin-none">
           <figure class="avatar flex-item-no-shrink" style="--avatar-border-radius: 0; --avatar-size: 4ch;">
             <%= image_tag "everyone.svg", aria: { hidden: "true" }, class: "colorize--black" %>
@@ -43,7 +43,7 @@
           <hr class="separator--horizontal flex-item-grow" style="--border-color: var(--color-subtle-dark); --border-style: dashed" aria-hidden="true" />
 
           <label for="bucket_all_access" class="switch">
-            <%= form.check_box :all_access, class: "switch__input", checked: @bucket.all_access? %>
+            <%= form.check_box :all_access, class: "switch__input", checked: @bucket.all_access?, data: { action: "change->toggle-class#toggle" } %>
             <span class="switch__btn round"></span>
             <span class="for-screen-reader">Give everyone access to this project</span>
           </label>

test/controllers/bubbles_controller_test.rb

@@ -54,12 +54,9 @@ class BubblesControllerTest < ActionDispatch::IntegrationTest
     get bucket_bubble_url(buckets(:writebook), bubbles(:logo))
     assert_response :success
 
-    buckets(:writebook).accesses.revoke_from(users(:kevin)) # bucket is all-access
-    get bucket_bubble_url(buckets(:writebook), bubbles(:logo))
-    assert_response :success
-
     buckets(:writebook).update! all_access: false
+    buckets(:writebook).accesses.revoke_from(users(:kevin))
     get bucket_bubble_url(buckets(:writebook), bubbles(:logo))
-    assert_response :forbidden
+    assert_response :not_found
   end
 end

test/models/bucket_test.rb

@@ -2,6 +2,8 @@ require "test_helper"
 
 class BucketTest < ActiveSupport::TestCase
   test "revising access" do
+    buckets(:writebook).update! all_access: false
+
     buckets(:writebook).accesses.revise granted: users(:david, :jz), revoked: users(:kevin)
     assert_equal users(:david, :jz), buckets(:writebook).users
 
@@ -28,13 +30,4 @@ class BucketTest < ActiveSupport::TestCase
     bucket.update! all_access: true
     assert_equal accounts("37s").users, bucket.users.reload
   end
-
-  test "visibility" do
-    assert_not buckets(:writebook).visible_to?(User.new)
-    assert buckets(:writebook).visible_to?(User.new(account: accounts("37s")))
-
-    buckets(:writebook).update! all_access: false
-    assert_not buckets(:writebook).visible_to?(User.new(account: accounts("37s")))
-    assert buckets(:writebook).visible_to?(users(:kevin))
-  end
 end