Make sure only admins or collection creators can toggle the all access setting

test/controllers/boards_controller_test.rb

@@ -95,4 +95,17 @@ class BoardsControllerTest < ActionDispatch::IntegrationTest
     assert_redirected_to root_path
     assert_raises(ActiveRecord::RecordNotFound) { board.reload }
   end
+
+  test "non-admin cannot change all_access on board they don't own" do
+    Session.destroy_all
+    sign_in_as :jz
+
+    board = boards(:writebook)
+    original_all_access = board.all_access
+
+    patch board_path(board), params: { board: { all_access: !original_all_access } }
+
+    assert_response :forbidden
+    assert_equal original_all_access, board.reload.all_access
+  end
 end