comment policy and test updates

test/controllers/admin/comment_controller_test.rb

@@ -14,6 +14,17 @@ module Admin
       refute_equal comment.message, QuizComment.find_by(id: comment.id).message
     end
 
+    test "should require message to update" do
+      auth_manager
+      comment = quiz_comments(:com5)
+      post admin_update_comment_url(test_hash: comment.test_hash, id: comment.id),
+           params: { quiz_comment: { message: '' } }
+
+      assert_redirected_to admin_result_url(test_hash: comment.test_hash)
+      assert flash[:error]
+      assert_equal comment.message, QuizComment.find_by(id: comment.id).message
+    end
+
     test "should post create" do
       auth_reviewer
       candidate = candidates(:stacy)
@@ -26,5 +37,40 @@ module Admin
       assert_redirected_to admin_result_url(test_hash: candidate.test_hash)
       assert flash[:success]
     end
+
+    test "should require comment to create" do
+      auth_reviewer
+      candidate = candidates(:stacy)
+
+      assert_difference("QuizComment.count", 0) do
+        post admin_create_comment_url(test_hash: candidate.test_hash),
+             params: { quiz_comment: { message: '' } }
+      end
+
+      assert_redirected_to admin_result_url(test_hash: candidate.test_hash)
+      assert flash[:error]
+    end
+
+    test "should not edit others comments" do
+      auth_reviewer
+      comment = quiz_comments(:com5)
+      post admin_update_comment_url(test_hash: comment.test_hash, id: comment.id),
+           params: { quiz_comment: { message: 'updated comment' } }
+
+      assert_redirected_to admin_login_url
+      assert_equal comment.message, QuizComment.find_by(id: comment.id).message
+    end
+
+    test "can not comment on Gustov" do
+      auth_reviewer
+      candidate = candidates(:gustov)
+
+      assert_difference("QuizComment.count", 0) do
+        post admin_create_comment_url(test_hash: candidate.test_hash),
+             params: { quiz_comment: { message: 'this is a test comment' } }
+      end
+
+      assert_redirected_to admin_login_url
+    end
   end
 end

test/policies/quiz_comment_policy_test.rb

@@ -9,11 +9,14 @@ class QuizCommentPolicyTest < PolicyAssertions::Test
   end
 
   def test_create
-    assert_permit users(:admin), QuizComment
-    assert_permit users(:manager), QuizComment
-    assert_permit users(:reviewer), QuizComment
+    candidate = candidates(:stacy)
+    comment = QuizComment.new(test_hash: candidate.test_hash)
 
-    refute_permit users(:recruiter), QuizComment
+    assert_permit users(:manager), comment
+    assert_permit users(:reviewer), comment
+
+    refute_permit users(:admin), comment
+    refute_permit users(:recruiter), comment
   end
 
   def test_update