Add AlbumPolicy::Scope & use in ArtistsController#show

app/controllers/artists_controller.rb

@@ -13,11 +13,7 @@ def index
   def show
     skip_authorization
 
-    @albums = if pundit_user.admin? || pundit_user.artists.include?(@artist)
-                Album.where(artist: @artist)
-              else
-                Album.published.where(artist: @artist)
-              end
+    @albums = policy_scope(@artist.albums)
   end
 
   def new

app/policies/album_policy.rb

@@ -1,6 +1,16 @@
 # frozen_string_literal: true
 
 class AlbumPolicy < ApplicationPolicy
+  class Scope < Scope
+    def resolve
+      if user.admin? || scope.map(&:artist).uniq.all? { |a| user.artists.include?(a) }
+        scope.all
+      else
+        scope.published
+      end
+    end
+  end
+
   def show?
     return record.published? unless user.signed_in?
 

test/policies/album_policy_test.rb

@@ -18,6 +18,19 @@ class AlbumPolicyTest < ActiveSupport::TestCase
     assert_not policy.request_publication?
   end
 
+  test 'an admin scope' do
+    user = build(:user, admin: true)
+    unpublished_album = create(:album, publication_status: :unpublished)
+    pending_album = create(:album, publication_status: :pending)
+    published_album = create(:album, publication_status: :published)
+
+    scope = AlbumPolicy::Scope.new(user, Album.all)
+
+    assert_includes scope.resolve, unpublished_album
+    assert_includes scope.resolve, pending_album
+    assert_includes scope.resolve, published_album
+  end
+
   test 'a user' do
     user = build(:user)
     album = build(:album)
@@ -48,6 +61,20 @@ class AlbumPolicyTest < ActiveSupport::TestCase
     assert policy.request_publication?
   end
 
+  test 'scope for a user with albums belonging to their artist' do
+    user = build(:user)
+    artist = create(:artist, user:)
+    unpublished_album = create(:album, artist:, publication_status: :unpublished)
+    pending_album = create(:album, artist:, publication_status: :pending)
+    published_album = create(:album, artist:, publication_status: :published)
+
+    scope = AlbumPolicy::Scope.new(user, Album.all)
+
+    assert_includes scope.resolve, unpublished_album
+    assert_includes scope.resolve, pending_album
+    assert_includes scope.resolve, published_album
+  end
+
   test 'non-signed-in user' do
     non_signed_in_user = NullUser.new
     unpublished_album = create(:album, publication_status: :unpublished)
@@ -59,6 +86,19 @@ class AlbumPolicyTest < ActiveSupport::TestCase
     assert AlbumPolicy.new(non_signed_in_user, published_album).show?
   end
 
+  test 'non-signed-in user scope' do
+    user = NullUser.new
+    unpublished_album = create(:album, publication_status: :unpublished)
+    pending_album = create(:album, publication_status: :pending)
+    published_album = create(:album, publication_status: :published)
+
+    scope = AlbumPolicy::Scope.new(user, Album.all)
+
+    assert_not_includes scope.resolve, unpublished_album
+    assert_not_includes scope.resolve, pending_album
+    assert_includes scope.resolve, published_album
+  end
+
   test 'signed-in user' do
     user = build(:user)
     unpublished_album = create(:album, publication_status: :unpublished)
@@ -69,4 +109,17 @@ class AlbumPolicyTest < ActiveSupport::TestCase
     assert_not AlbumPolicy.new(user, pending_album).show?
     assert AlbumPolicy.new(user, published_album).show?
   end
+
+  test 'signed-in user scope' do
+    user = build(:user)
+    published_album = create(:album, publication_status: :published)
+    pending_album = create(:album, publication_status: :pending)
+    unpublished_album = create(:album, publication_status: :unpublished)
+
+    scope = AlbumPolicy::Scope.new(user, Album.all)
+
+    assert_not_includes scope.resolve, unpublished_album
+    assert_not_includes scope.resolve, pending_album
+    assert_includes scope.resolve, published_album
+  end
 end