Fixed curators + admins etc. appearing as "approved editors"

Author: fbacall

app/models/user.rb

@@ -288,15 +288,12 @@ def created_resources
   end
 
   def get_editable_providers
-    result = self.editables
-    ContentProvider.all.each do |prov|
-      if !result.include?(prov)
-        if prov.user == self or self.is_admin? or self.is_curator?
-          result << prov
-        end
-      end
+    relation = ContentProvider.order(:title)
+    if is_admin? || is_curator?
+      relation.all
+    else
+      relation.find(content_provider_ids | editable_ids)
     end
-    result.sort_by { |obj| obj.title }
   end
 
   def get_inviter

test/models/editor_test.rb

@@ -215,4 +215,46 @@ class EditorTest < ActiveSupport::TestCase
     assert_equal trainer, another_event.user
     assert_equal provider.user, event.user
   end
+
+  test 'get_editable_providers' do
+    curator = users(:curator)
+    admin = users(:admin)
+    owner = users(:another_regular_user)
+    editor = users(:collaborative_user)
+    provider = content_providers(:goblet)
+    provider2 = content_providers(:iann)
+    provider3 = owner.content_providers.create!(title: 'Something', url: 'https://website.internet')
+    provider.editors << editor
+
+    # Curator
+    assert_includes curator.get_editable_providers, provider
+    assert_includes curator.get_editable_providers, provider2
+    assert_includes curator.get_editable_providers, provider3
+
+    # Admin
+    assert_includes admin.get_editable_providers, provider
+    assert_includes admin.get_editable_providers, provider2
+    assert_includes admin.get_editable_providers, provider3
+
+    # ContentProvider owner
+    assert_not_includes owner.get_editable_providers, provider
+    assert_not_includes owner.get_editable_providers, provider2
+    assert_includes owner.get_editable_providers, provider3
+
+    # Editor
+    assert_includes editor.get_editable_providers, provider
+    assert_not_includes editor.get_editable_providers, provider2
+    assert_not_includes editor.get_editable_providers, provider3
+  end
+
+  test 'get_editable_providers should not create records as a side-effect' do
+    provider = content_providers(:goblet)
+    curator = users(:curator)
+
+    assert_empty provider.editors
+    assert_no_difference(-> { provider.editors.count }) do
+      assert_includes curator.get_editable_providers, provider
+    end
+    assert_empty provider.reload.editors
+  end
 end