Chore: Adds project submission policy.

app/controllers/project_submissions/likes_controller.rb

@@ -1,5 +1,6 @@
 class ProjectSubmissions::LikesController < ApplicationController
  before_action :authenticate_user!
+ before_action :authorize_like
 
  def update
  @project_submission = ProjectSubmission.find(params[:project_submission_id])
@@ -14,4 +15,15 @@ def update
  format.turbo_stream
  end
  end
+
+ private
+
+ def authorize_like
+ return if SubmissionLikePolicy.new(current_user).allowed?
+
+ respond_to do |format|
+ flash.now[:alert] = 'Failed to like.'
+ format.turbo_stream { render turbo_stream: turbo_stream.update('flash-messages', partial: 'shared/flash') }
+ end
+ end
 end

app/models/user.rb

@@ -19,6 +19,8 @@ class User < ApplicationRecord
  has_many :likes, dependent: :destroy
  belongs_to :path, optional: true
 
+ scope :created_after, ->(date) { where(arel_table[:created_at].gt(date)) }
+
  def progress_for(course)
  @progress ||= Hash.new { |hash, c| hash[c] = CourseProgress.new(c, self) }
  @progress[course]

app/policies/submission_like_policy.rb

@@ -0,0 +1,21 @@
+class SubmissionLikePolicy
+ def initialize(user)
+ @user = user
+ end
+
+ def allowed?
+ return true if @user.project_submissions.any?
+
+ no_recent_accounts_with_same_ip?
+ end
+
+ private
+
+ def no_recent_accounts_with_same_ip?
+ User
+ .created_after(1.week.ago)
+ .where(last_sign_in_ip: @user.current_sign_in_ip)
+ .where.not(id: @user.id)
+ .none?
+ end
+end

spec/services/project_submissions/submission_like_policy_spec.rb

@@ -0,0 +1,47 @@
+require 'rails_helper'
+
+RSpec.describe SubmissionLikePolicy do
+ describe '#allowed?' do
+ context 'when there are recent accounts with the same ip' do
+ it 'cannot like the project submission' do
+ user = create(:user, current_sign_in_ip: '127.0.0.1')
+ create(:user, last_sign_in_ip: user.current_sign_in_ip)
+
+ policy = described_class.new(user)
+
+ expect(policy.allowed?).to be(false)
+ end
+ end
+
+ context 'when there are no recent accounts with the same ip' do
+ it 'can like the project submission' do
+ user = create(:user)
+
+ policy = described_class.new(user)
+
+ expect(policy.allowed?).to be(true)
+ end
+ end
+
+ context 'when the user has project submissions' do
+ it 'can like the project submission normally' do
+ user = create(:user)
+ create(:project_submission, user_id: user.id)
+
+ policy = described_class.new(user)
+
+ expect(policy.allowed?).to be(true)
+ end
+
+ it 'can like the project submission despite recent accounts with the same ip' do
+ user = create(:user, current_sign_in_ip: '127.0.0.1')
+ create(:project_submission, user_id: user.id)
+ create(:user, last_sign_in_ip: user.current_sign_in_ip)
+
+ policy = described_class.new(user)
+
+ expect(policy.allowed?).to be(true)
+ end
+ end
+ end
+end

spec/system/lesson_project_submissions/like_spec.rb

@@ -9,6 +9,8 @@
  create(:project_submission, lesson:)
 
  sign_in(user)
+ create(:project_submission, user_id: user.id)
+
  visit lesson_project_submissions_path(lesson)
  end
 
@@ -33,6 +35,8 @@
  create(:project_submission, lesson:, likes_count: 10)
 
  sign_in(user)
+ create(:project_submission, user_id: user.id)
+
  visit lesson_project_submissions_path(lesson)
  end
 
@@ -51,4 +55,26 @@
  end
  end
  end
+
+ context 'when a user is inflating likes' do
+ before do
+ create(:project_submission, lesson:)
+
+ create(:user, last_sign_in_ip: '127.0.0.1')
+ sign_in(user) # Sets current ip to localhost
+
+ visit lesson_project_submissions_path(lesson)
+ end
+
+ it 'cannot like the submission' do
+ within(:test_project_submission, 1) do
+ expect(find(:test_id, 'like-count')).to have_content('0')
+
+ find(:test_id, 'like-submission').click
+ expect(find(:test_id, 'like-count')).to have_content('0')
+ end
+
+ expect(page).to have_content('Failed to like')
+ end
+ end
 end