Add permissions for homepage permission testing

app/controllers/homepage_controller.rb

@@ -1,7 +1,8 @@
 class HomepageController < ApplicationController
   layout "design_system"
   before_action :fetch_latest_popular_link
-
+  before_action :require_homepage_editor_permissions
+  include GDS::SSO::ControllerMethods
   def show
     render "homepage/popular_links/show"
   end
@@ -37,6 +38,7 @@ def fetch_latest_popular_link
     @latest_popular_links = PopularLinksEdition.last
   end
 
+
   def remove_leading_and_trailing_url_spaces(links)
     link_items = []
     links.each do |link|
@@ -45,4 +47,8 @@ def remove_leading_and_trailing_url_spaces(links)
     end
     link_items
   end
+
+  def require_homepage_editor_permissions
+    authorise_user!("homepage_editor")
+  end
 end

app/views/shared/errors/forbidden.html.erb

@@ -0,0 +1,5 @@
+<% content_for :title, "Forbidden" %>
+
+<div class="govuk-body">
+  You do not have permission to access this page.
+</div>

test/functional/homepage_controller_test.rb

@@ -2,7 +2,7 @@
 
 class HomepageControllerTest < ActionController::TestCase
   setup do
-    login_as_stub_user
+    login_as_homepage_editor
   end
 
   context "#show" do

test/integration/homepage_popular_links_test.rb

@@ -1,154 +1,178 @@
 require "integration_test_helper"
 
 class HomepagePopularLinksTest < JavascriptIntegrationTest
-  setup do
-    setup_users
-    @popular_links = FactoryBot.create(:popular_links, state: "published")
-    visit_popular_links
-  end
-
-  context "#show" do
-    should "render page title" do
-      assert_title "Popular on GOV.UK"
+  context "no homepage editor access" do
+    setup do
+      login_as(FactoryBot.create(:user, name: "Stub User"))
+      @popular_links = FactoryBot.create(:popular_links, state: "published")
+      visit_popular_links
     end
 
-    should "render 'Homepage' as a page title context" do
-      assert page.has_content?("Homepage")
+    should "show permissions error" do
+      assert_text "Sorry, you don't seem to have the homepage_editor permission for this app."
     end
+  end
 
-    should "have 6 links with title and url" do
-      assert page.has_css?(".govuk-summary-card__title", count: 6)
-      assert page.has_text?("Title", count: 6)
-      assert page.has_text?("URL", count: 6)
+  context "homepage editor access" do
+    setup do
+      login_as_homepage_editor
+      @popular_links = FactoryBot.create(:popular_links, state: "published")
+      visit_popular_links
     end
 
-    should "have popular links version and status" do
-      assert page.has_text?("Edition")
-      assert page.has_text?(@popular_links.version_number)
-      assert page.has_text?("Status")
-      assert page.has_text?("PUBLISHED")
-      assert page.has_css?(".govuk-tag--green")
-    end
+    context "#show" do
+      should "render page title" do
+        assert_title "Popular on GOV.UK"
+      end
 
-    should "have 'Create new edition' button" do
-      assert page.has_text?("Create new edition")
-    end
+      should "render 'Homepage' as a page title context" do
+        assert page.has_content?("Homepage")
+      end
 
-    should "navigate to create path on click of 'Create new edition'" do
-      click_button("Create new edition")
-      assert_current_path create_popular_links_path
-    end
+      should "have 6 links with title and url" do
+        assert page.has_css?(".govuk-summary-card__title", count: 6)
+        assert page.has_text?("Title", count: 6)
+        assert page.has_text?("URL", count: 6)
+      end
 
-    should "render new draft popular links with edit option when 'Create new edition' button is clicked" do
-      click_button("Create new edition")
-      within(:css, ".govuk-tag--yellow") do
-        assert page.has_content?("DRAFT")
+      should "have popular links version and status" do
+        assert page.has_text?("Edition")
+        assert page.has_text?(@popular_links.version_number)
+        assert page.has_text?("Status")
+        assert page.has_text?("PUBLISHED")
+        assert page.has_css?(".govuk-tag--green")
       end
-    end
-  end
 
-  context "#create" do
-    should "create and show new edition with draft status and with an option to edit popular links" do
-      click_button("Create new edition")
+      should "have 'Create new edition' button" do
+        assert page.has_text?("Create new edition")
+      end
+
+      should "navigate to create path on click of 'Create new edition'" do
+        click_button("Create new edition")
+        assert_current_path create_popular_links_path
+      end
 
-      assert page.has_text?("Edition")
-      assert page.has_text?(@popular_links.version_number)
-      assert page.has_text?("Status")
-      assert page.has_text?("DRAFT")
-      assert page.has_css?(".govuk-tag--yellow")
-      assert page.has_text?("Edit popular links")
+      should "render new draft popular links with edit option when 'Create new edition' button is clicked" do
+        click_button("Create new edition")
+        within(:css, ".govuk-tag--yellow") do
+          assert page.has_content?("DRAFT")
+        end
+      end
     end
 
-    should "create a new record with next version and 'draft' status" do
-      row = find_all(".govuk-summary-list__row")
-      assert row[0].has_text?("Edition")
-      assert row[0].has_text?("1")
-      assert row[1].has_text?("Status")
-      assert row[1].has_text?("PUBLISHED")
+    context "#create" do
+      should "create and show new edition with draft status and with an option to edit popular links" do
+        click_button("Create new edition")
 
-      click_button("Create new edition")
+        assert page.has_text?("Edition")
+        assert page.has_text?(@popular_links.version_number)
+        assert page.has_text?("Status")
+        assert page.has_text?("DRAFT")
+        assert page.has_css?(".govuk-tag--yellow")
+        assert page.has_text?("Edit popular links")
+      end
 
-      row = find_all(".govuk-summary-list__row")
-      assert row[0].has_text?("Edition")
-      assert row[0].has_text?("2")
-      assert row[1].has_text?("Status")
-      assert row[1].has_text?("DRAFT")
-    end
-  end
+      should "create a new record with next version and 'draft' status" do
+        row = find_all(".govuk-summary-list__row")
+        assert row[0].has_text?("Edition")
+        assert row[0].has_text?("1")
+        assert row[1].has_text?("Status")
+        assert row[1].has_text?("PUBLISHED")
 
-  context "#edit" do
-    setup do
-      click_button("Create new edition")
-      click_link("Edit popular links")
-    end
+        click_button("Create new edition")
 
-    should "render page title" do
-      assert_title "Edit popular links"
+        row = find_all(".govuk-summary-list__row")
+        assert row[0].has_text?("Edition")
+        assert row[0].has_text?("2")
+        assert row[1].has_text?("Status")
+        assert row[1].has_text?("DRAFT")
+      end
     end
 
-    should "render 'Popular on GOV.UK' as a page title context" do
-      assert page.has_content?("Popular on GOV.UK")
-    end
+    context "#edit" do
+      setup do
+        click_button("Create new edition")
+        click_link("Edit popular links")
+      end
 
-    should "have 6 links with title and url" do
-      assert page.has_css?(".govuk-input", count: 12)
-      assert page.has_text?("Title", count: 6)
-      assert page.has_text?("URL", count: 6)
-    end
+      should "render page title" do
+        assert_title "Edit popular links"
+      end
 
-    should "update record when 'Save' is clicked" do
-      fill_in "popular_links[1][title]", with: "new title 1"
-      click_button("Save")
+      should "render 'Popular on GOV.UK' as a page title context" do
+        assert page.has_content?("Popular on GOV.UK")
+      end
 
-      assert page.has_text?("Popular links draft saved.")
-      assert page.has_text?("new title 1")
-    end
+      should "have 6 links with title and url" do
+        assert page.has_css?(".govuk-input", count: 12)
+        assert page.has_text?("Title", count: 6)
+        assert page.has_text?("URL", count: 6)
+      end
 
-    should "show validation errors for missing link and url" do
-      fill_in "popular_links[1][title]", with: ""
-      fill_in "popular_links[1][url]", with: ""
-      click_button("Save")
+      should "update record when 'Save' is clicked" do
+        fill_in "popular_links[1][title]", with: "new title 1"
+        click_button("Save")
 
-      assert page.has_text?("Title is required for Link 1")
-      assert page.has_text?("URL is required for Link 1")
-    end
+        assert page.has_text?("Popular links draft saved.")
+        assert page.has_text?("new title 1")
+      end
 
-    should "trim spaces from start and end of urls" do
-      fill_in "popular_links[1][url]", with: " www.abc.com "
-      click_button("Save")
+      should "show validation errors for missing link and url" do
+        fill_in "popular_links[1][title]", with: ""
+        fill_in "popular_links[1][url]", with: ""
+        click_button("Save")
 
-      assert page.has_text?("www.abc.com")
-      assert_not page.has_text?(" www.abc.com ")
-    end
+        assert page.has_text?("Title is required for Link 1")
+        assert page.has_text?("URL is required for Link 1")
+      end
 
-    should "render create page when 'Cancel' is clicked" do
-      click_link("Cancel")
+      should "trim spaces from start and end of urls" do
+        fill_in "popular_links[1][url]", with: " www.abc.com "
+        click_button("Save")
 
-      assert_current_path show_popular_links_path
-    end
+        assert page.has_text?("www.abc.com")
+        assert_not page.has_text?(" www.abc.com ")
+      end
 
-    should "not save any changes when 'Cancel' is clicked" do
-      fill_in "popular_links[1][url]", with: "www.abc.com"
-      click_link("Cancel")
+      should "render create page when 'Cancel' is clicked" do
+        click_link("Cancel")
 
-      assert_not page.has_text?("www.abc.com")
-    end
-  end
+        assert_current_path show_popular_links_path
+      end
 
-  context "#publish" do
-    setup do
-      click_button("Create new edition")
+      should "not save any changes when 'Cancel' is clicked" do
+        fill_in "popular_links[1][url]", with: "www.abc.com"
+        click_link("Cancel")
+
+        assert_not page.has_text?("www.abc.com")
+      end
     end
 
-    should "publish latest edition when 'Publish' is clicked" do
-      click_button("Publish")
+    context "#publish" do
+      setup do
+        click_button("Create new edition")
+      end
+
+      should "publish latest edition when 'Publish' is clicked" do
+        click_button("Publish")
 
-      assert page.has_text?("PUBLISHED")
-      assert page.has_text?("Popular links successfully published.")
+        assert page.has_text?("PUBLISHED")
+        assert page.has_text?("Popular links successfully published.")
+      end
     end
   end
 
   def visit_popular_links
     visit "/homepage/popular-links"
   end
+
+  def login_as_homepage_editor
+    user = FactoryBot.create(:user, :homepage_editor, name: "Stub User")
+    login_as(user)
+  end
+
+  def login_as(user)
+    GDS::SSO.test_user = user
+    super(user)
+  end
 end

test/support/factories.rb

@@ -21,6 +21,10 @@
     trait :welsh_editor do
       permissions { %w[welsh_editor signin] }
     end
+
+    trait :homepage_editor do
+      permissions { %w[homepage_editor signin] }
+    end
   end
 
   factory :disabled_user, parent: :user do

test/test_helper.rb

@@ -87,6 +87,11 @@ def login_as_welsh_editor
     login_as(@user)
   end
 
+  def login_as_homepage_editor
+    @user = FactoryBot.create(:user, :homepage_editor, name: "Stub User")
+    login_as(@user)
+  end
+
   alias_method :login_as_stub_user, :login_as_govuk_editor
 
   include GdsApi::TestHelpers::PublishingApi