reports made with non public categories are set as non public

2 files changed, 78 insertions, 0 deletions

diff --git a/perllib/FixMyStreet/App/Controller/Report/New.pm b/perllib/FixMyStreet/App/Controller/Report/New.pm
index ede0cd219..a2c5e6a0c 100644
--- a/perllib/FixMyStreet/App/Controller/Report/New.pm
+++ b/perllib/FixMyStreet/App/Controller/Report/New.pm
@@ -595,6 +595,8 @@ sub setup_categories_and_councils : Private {
     my @category_options = ();       # categories to show
     my $category_label   = undef;    # what to call them
     my %category_extras  = ();       # extra fields to fill in for open311
+    my %non_public_categories =
+      ();    # categories for which the reports are not public
 
     # FIXME - implement in cobrand
     if ( $c->cobrand->moniker eq 'emptyhomes' ) {
@@ -646,6 +648,8 @@ sub setup_categories_and_councils : Private {
 
                 $category_extras{ $contact->category } = $contact->extra
                     if $contact->extra;
+
+                $non_public_categories{ $contact->category } = 1 if $contact->non_public;
             }
             $seen{$contact->category} = 1;
         }
@@ -663,6 +667,7 @@ sub setup_categories_and_councils : Private {
     $c->stash->{category_label}   = $category_label;
     $c->stash->{category_options} = \@category_options;
     $c->stash->{category_extras}  = \%category_extras;
+    $c->stash->{non_public_categories}  = \%non_public_categories;
     $c->stash->{category_extras_json}  = encode_json \%category_extras;
     $c->stash->{extra_name_info} = $first_council->{id} == COUNCIL_ID_BROMLEY ? 1 : 0;
 
@@ -872,6 +877,10 @@ sub process_report : Private {
             };
         }
 
+        if ( $c->stash->{non_public_categories}->{ $report->category } ) {
+            $report->non_public( 1 );
+        }
+
         $c->cobrand->process_extras( $c, $contacts[0]->area_id, \@extra );
 
         if ( @extra ) {
diff --git a/t/app/controller/report_new.t b/t/app/controller/report_new.t
index 65bd71af2..0c9495357 100644
--- a/t/app/controller/report_new.t
+++ b/t/app/controller/report_new.t
@@ -788,6 +788,75 @@ foreach my $test (
 
 }
 
+subtest "test report creation for a category that is non public" => sub {
+    $mech->log_out_ok;
+    $mech->clear_emails_ok;
+
+    # check that the user does not exist
+    my $test_email = 'test-2@example.com';
+
+    my $user = FixMyStreet::App->model('DB::User')->find_or_create( { email => $test_email } );
+    ok $user, "test user does exist";
+
+    $contact1->update( { non_public => 1 } );
+
+    # submit initial pc form
+    $mech->get_ok('/around');
+    $mech->submit_form_ok( { with_fields => { pc => 'EH1 1BB', } },
+        "submit location" );
+
+    # click through to the report page
+    $mech->follow_link_ok( { text_regex => qr/skip this step/i, },
+        "follow 'skip this step' link" );
+
+    $mech->submit_form_ok(
+        {
+            button      => 'submit_register',
+            with_fields => {
+                title         => 'Test Report',
+                detail        => 'Test report details.',
+                photo         => '',
+                email         => 'test-2@example.com',
+                name          => 'Joe Bloggs',
+                category      => 'Street lighting',
+            }
+        },
+        "submit good details"
+    );
+
+    # find the report
+    my $report = $user->problems->first;
+    ok $report, "Found the report";
+
+    # Check the report is not public
+    ok $report->non_public, 'report is not public';
+
+    my $email = $mech->get_email;
+    ok $email, "got an email";
+    like $email->body, qr/confirm the problem/i, "confirm the problem";
+
+    my ($url) = $email->body =~ m{(http://\S+)};
+    ok $url, "extracted confirm url '$url'";
+
+    # confirm token
+    $mech->get_ok($url);
+    $report->discard_changes;
+    is $report->state, 'confirmed', "Report is now confirmed";
+
+    $mech->get_ok( '/report/' . $report->id );
+
+    # user is logged in
+    $mech->logged_in_ok;
+
+    $mech->log_out_ok;
+    ok $mech->get("/report/" . $report->id), "fetched report";
+    is $mech->res->code, 403, "access denied to report";
+
+    # cleanup
+    $mech->delete_user($user);
+    $contact1->update( { non_public => 0 } );
+};
+
 $contact2->category( "Pothol\xc3\xa9s" );
 $contact2->update;
 $mech->get_ok( '/report/new/ajax?latitude=' . $saved_lat . '&longitude=' . $saved_lon );