Implement all_access buckets

test/controllers/bubbles_controller_test.rb

@@ -49,4 +49,17 @@ class BubblesControllerTest < ActionDispatch::IntegrationTest
     assert_equal "moon.jpg", bubble.image.filename.to_s
     assert_equal [ tags(:mobile) ], bubble.tags
   end
+
+  test "users can only see bubbles in buckets they have access to" do
+    get bucket_bubble_url(buckets(:writebook), bubbles(:logo))
+    assert_response :success
+
+    buckets(:writebook).accesses.revoke_from(users(:kevin)) # bucket is all-access
+    get bucket_bubble_url(buckets(:writebook), bubbles(:logo))
+    assert_response :success
+
+    buckets(:writebook).update! all_access: false
+    get bucket_bubble_url(buckets(:writebook), bubbles(:logo))
+    assert_response :forbidden
+  end
 end

test/controllers/buckets_controller_test.rb

@@ -37,6 +37,19 @@ class BucketsControllerTest < ActionDispatch::IntegrationTest
     assert_redirected_to bubbles_path(bucket_ids: [ buckets(:writebook) ])
     assert_equal "Writebook bugs", buckets(:writebook).reload.name
     assert_equal users(:david, :jz), buckets(:writebook).users
+    assert_not buckets(:writebook).all_access?
+  end
+
+  test "update all access" do
+    bucket = Current.set(session: sessions(:kevin)) do
+      accounts("37s").buckets.create! name: "New bucket", all_access: false
+    end
+
+    patch bucket_url(bucket), params: { bucket: { name: "Bugs", all_access: true } }
+
+    assert_redirected_to bubbles_path(bucket_ids: [ bucket ])
+    assert bucket.reload.all_access?
+    assert_equal accounts("37s").users, bucket.users
   end
 
   test "destroy" do