Lock timeoff entries

app/policies/timeoff_entry_policy.rb

@@ -2,33 +2,43 @@
 
 class TimeoffEntryPolicy < ApplicationPolicy
   def index?
-    user_owner_role? || user_admin_role? || user_employee_role?
+    user_has_any_workspace_role?
   end
 
   def create?
-    user_owner_role? || user_admin_role? || user_employee_role?
+    user_has_any_workspace_role?
   end
 
   def update?
-    authorize_current_user
+    week_over? ? user_has_admin_or_owner_role? : user_has_any_workspace_role?
   end
 
   def destroy?
-    authorize_current_user
+    update?
   end
 
   def permitted_attributes
-    [
-      :duration, :note, :leave_date, :user_id, :leave_type_id, :holiday_info_id
-    ]
+    [:duration, :note, :leave_date, :user_id, :leave_type_id, :holiday_info_id]
   end
 
-  def authorize_current_user
-    unless user.current_workspace_id == record.company.id
-      @error_message_key = :different_workspace
-      return false
+  private
+
+    def week_over?
+      record.leave_date.present? && Time.current > record.leave_date.end_of_week(:sunday)
     end
 
-    user_owner_role? || user_admin_role? || user_employee_role?
-  end
+    def user_has_any_workspace_role?
+      user.has_any_role?(
+        { name: :admin, resource: user.current_workspace },
+        { name: :owner, resource: user.current_workspace },
+        { name: :employee, resource: user.current_workspace }
+      )
+    end
+
+    def user_has_admin_or_owner_role?
+      user.has_any_role?(
+        { name: :admin, resource: user.current_workspace },
+        { name: :owner, resource: user.current_workspace }
+      )
+    end
 end

spec/policies/timeoff_entry_policy_spec.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+require "rails_helper"
+
+RSpec.describe TimeoffEntryPolicy, type: :policy do
+  let(:company) { create(:company) }
+  let(:user) { create(:user, current_workspace_id: company.id) }
+  let(:leave) { create(:leave, company:) }
+  let(:leave_type) { create(
+    :leave_type, name: "Annual Leave", color: LeaveType.colors.keys.sample,
+    icon: LeaveType.icons.keys.sample, allocation_period: LeaveType.allocation_periods[:months],
+    allocation_frequency: LeaveType.allocation_frequencies[:per_year], allocation_value: 10, carry_forward_days: 5,)
+}
+  let(:timeoff_entry) { create(:timeoff_entry, user:, leave_type:, leave_date: Date.current) }
+
+  subject { described_class }
+
+  context "when user is an admin" do
+    before do
+      create(:employment, company:, user:)
+      user.add_role :admin, company
+    end
+
+    permissions :index?, :create? do
+      it "is permitted to access timeoff_entries" do
+        expect(subject).to permit(user, timeoff_entry)
+      end
+    end
+
+    permissions :update?, :destroy? do
+      it "is permitted to update or destroy timeoff_entries" do
+        expect(subject).to permit(user, timeoff_entry)
+      end
+    end
+  end
+
+  context "when user is an owner" do
+    before do
+      create(:employment, company:, user:)
+      user.add_role :owner, company
+    end
+
+    permissions :index?, :create? do
+      it "is permitted to access timeoff_entries" do
+        expect(subject).to permit(user, timeoff_entry)
+      end
+    end
+
+    permissions :update?, :destroy? do
+      it "is permitted to update or destroy timeoff_entries" do
+        expect(subject).to permit(user, timeoff_entry)
+      end
+    end
+  end
+
+  context "when user is an employee" do
+    before do
+      create(:employment, company:, user:)
+      user.add_role :employee, company
+    end
+
+    context "when leave date is in the current week" do
+      it "is permitted to update or destroy timeoff_entries" do
+        expect(described_class).to permit(user, timeoff_entry)
+      end
+    end
+
+    context "when leave date is in the past week" do
+      let(:past_timeoff_entry) { create(:timeoff_entry, user:, leave_type:, leave_date: 1.week.ago) }
+
+      it "is not permitted to update or destroy timeoff_entries" do
+        expect(subject).not_to permit(user, past_timeoff_entry)
+      end
+    end
+
+    context "when leave date is in the future" do
+      let(:future_timeoff_entry) { create(:timeoff_entry, user:, leave_type:, leave_date: 1.week.from_now) }
+
+      it "is permitted to update or destroy timeoff_entries" do
+        expect(subject).to permit(user, future_timeoff_entry)
+      end
+    end
+  end
+
+  context "when user has no role" do
+    permissions :index?, :create?, :update?, :destroy? do
+      it "is not permitted to access timeoff_entries" do
+        expect(subject).not_to permit(user, timeoff_entry)
+      end
+    end
+  end
+
+  context "when leave date is past the week" do
+    let(:past_timeoff_entry) { create(:timeoff_entry, user:, leave_type:, leave_date: 1.week.ago) }
+
+    before do
+      create(:employment, company:, user:)
+      user.add_role :admin, company
+    end
+
+    permissions :update?, :destroy? do
+      it "is permitted for admin or owner to update or destroy" do
+        expect(subject).to permit(user, past_timeoff_entry)
+      end
+    end
+  end
+end