Merge pull request #12986 from demarche-numerique/fix/scope-dossier-help-to-current-user

Tech: restreindre la recherche du dossier pour le menu d'aide à l'utilisateur courant

Author: mmagn

app/controllers/users/dossiers_controller.rb

@@ -484,8 +484,14 @@ def new
     end
 
     def dossier_for_help
+      return @dossier if @dossier
+
       dossier_id = params[:id] || params[:dossier_id]
-      @dossier || (dossier_id.present? && Dossier.visible_by_user.find_by(id: dossier_id.to_i))
+      return nil if dossier_id.blank?
+
+      id = dossier_id.to_i
+      current_user.dossiers.visible_by_user.find_by(id:) ||
+        current_user.dossiers_invites.visible_by_user.find_by(id:)
     end
 
     def transferer

spec/controllers/users/dossiers_controller_spec.rb

@@ -2089,21 +2089,37 @@
 
     subject { controller.dossier_for_help }
 
-    context 'when the id matches an existing dossier' do
+    context 'when the id matches a dossier owned by the current user' do
+      let(:dossier) { create(:dossier, user:) }
+      let(:dossier_id) { dossier.id }
+
+      it { is_expected.to eq dossier }
+    end
+
+    context 'when the id matches a dossier the current user was invited to' do
       let(:dossier) { create(:dossier) }
       let(:dossier_id) { dossier.id }
+      before { create(:invite, dossier:, user:) }
 
       it { is_expected.to eq dossier }
     end
 
+    context 'when the id matches a dossier from another user' do
+      let(:other_user) { create(:user) }
+      let(:other_dossier) { create(:dossier, user: other_user) }
+      let(:dossier_id) { other_dossier.id }
+
+      it { is_expected.to be nil }
+    end
+
     context 'when the id doesn’t match an existing dossier' do
       let(:dossier_id) { 9999999 }
       it { is_expected.to be nil }
     end
 
     context 'when the id is empty' do
       let(:dossier_id) { nil }
-      it { is_expected.to be_falsy }
+      it { is_expected.to be nil }
     end
   end