Add messages for hidden and requester_only states.

Different messages for normal user, requester and admin user.

2 files changed, 128 insertions, 19 deletions

diff --git a/app/views/request/_incoming_correspondence.html.erb b/app/views/request/_incoming_correspondence.html.erb
index 7c9a8f551..f4cf3b2ab 100644
--- a/app/views/request/_incoming_correspondence.html.erb
+++ b/app/views/request/_incoming_correspondence.html.erb
@@ -1,21 +1,41 @@
-<div class="incoming correspondence" id="incoming-<%=incoming_message.id.to_s%>">
-  <h2>
-    <% if incoming_message.safe_mail_from && incoming_message.safe_mail_from.strip != @info_request.public_body.name.strip %>
-      <%= _("From:") %> <%= incoming_message.safe_mail_from %><br>
+<div class="incoming correspondence <%= incoming_message.prominence %>" id="incoming-<%=incoming_message.id.to_s%>">
+  <%- if not incoming_message.user_can_view?(@user) %>
+      <p id="hidden_message">
+        <%= _('This message has been hidden. There are various reasons why we might have done this, sorry we can\'t be more specific here. Please <a href="{{url}}">contact us</a> if you have any questions.', :url => help_contact_path.html_safe) %>
+
+        <% if incoming_message.prominence == 'requester_only' %>
+          <%= _('If you are the requester, then you may <a href="{{url}}">sign in</a> to view the message.', :url => signin_url(:r => request.fullpath).html_safe) %>
+        <% end %>
+      </p>
+  <%- else %>
+    <% if incoming_message.prominence == 'hidden' %>
+        <p id="hidden_message">
+        <%= _('This message has prominence \'hidden\'. You can only see it because you are logged in as a super user.') %>
+        </p>
     <% end %>
-    <% if incoming_message.safe_mail_from.nil? || (incoming_message.mail_from_domain == @info_request.public_body.request_email_domain) %>
-      <%= @info_request.public_body.name %><br>
+    <% if incoming_message.prominence == 'requester_only' %>
+        <p id="hidden_message">
+        <%= _('This message is hidden, so that only you, the requester, can see it. Please <a href="{{url}}">contact us</a> if you are not sure why.', :url => help_requesting_path.html_safe) %>
+        </p>
     <% end %>
-    <br><%= simple_date(incoming_message.sent_at) %>
-  </h2>
+    <h2>
+      <% if incoming_message.safe_mail_from && incoming_message.safe_mail_from.strip != @info_request.public_body.name.strip %>
+        <%= _("From:") %> <%= incoming_message.safe_mail_from %><br>
+      <% end %>
+      <% if incoming_message.safe_mail_from.nil? || (incoming_message.mail_from_domain == @info_request.public_body.request_email_domain) %>
+        <%= @info_request.public_body.name %><br>
+      <% end %>
+      <br><%= simple_date(incoming_message.sent_at) %>
+    </h2>
 
-  <%= render :partial => 'bubble', :locals => { :incoming_message => incoming_message, :body => incoming_message.get_body_for_html_display(@collapse_quotes), :attachments => incoming_message.get_attachments_for_display }  %>
+    <%= render :partial => 'bubble', :locals => { :incoming_message => incoming_message, :body => incoming_message.get_body_for_html_display(@collapse_quotes), :attachments => incoming_message.get_attachments_for_display }  %>
 
-  <p class="event_actions">
-    <% if !@user.nil? && @user.admin_page_links? %>
-      <%= link_to "Admin", admin_request_show_raw_email_path(incoming_message.raw_email_id) %> |
-    <% end %>
-    <%= link_to _("Link to this"), incoming_message_path(incoming_message), :class => "link_to_this" %>
-  </p>
+    <p class="event_actions">
+      <% if !@user.nil? && @user.admin_page_links? %>
+        <%= link_to "Admin", admin_request_show_raw_email_path(incoming_message.raw_email_id) %> |
+      <% end %>
+      <%= link_to _("Link to this"), incoming_message_path(incoming_message), :class => "link_to_this" %>
+    </p>
+  <%- end %>
 </div>
 
diff --git a/spec/integration/view_request_spec.rb b/spec/integration/view_request_spec.rb
index 79453e4c2..6f02cff7c 100644
--- a/spec/integration/view_request_spec.rb
+++ b/spec/integration/view_request_spec.rb
@@ -20,7 +20,41 @@ describe "When viewing requests" do
        unregistered.browses_request('why_do_you_have_such_a_fancy_dog?action=add')
     end
 
-    context 'when a response is hidden' do
+    context 'when a response has prominence "normal"' do
+
+        before do
+            useless_message = incoming_messages(:useless_incoming_message)
+            useless_message.prominence = 'normal'
+            useless_message.save!
+        end
+
+        it 'should show the message itself to any user' do
+
+            # unregistered
+            unregistered = without_login
+            unregistered.browses_request('why_do_you_have_such_a_fancy_dog')
+            unregistered.response.body.should include("No way!")
+            unregistered.response.body.should_not include("This message has been hidden.")
+            unregistered.response.body.should_not include("sign in</a> to view the message.")
+
+            # requester
+            bob = login(:bob_smith_user)
+            bob.browses_request('why_do_you_have_such_a_fancy_dog')
+            bob.response.body.should include("No way!")
+            bob.response.body.should_not include("This message has been hidden.")
+
+            # admin
+            confirm(:admin_user)
+            admin_user = login(:admin_user)
+            admin_user.browses_request('why_do_you_have_such_a_fancy_dog')
+            admin_user.response.body.should include('No way!')
+            admin_user.response.body.should_not include("This message has prominence \'hidden\'.")
+
+        end
+
+    end
+
+    context 'when a response has prominence "hidden"' do
 
         before do
             useless_message = incoming_messages(:useless_incoming_message)
@@ -28,12 +62,67 @@ describe "When viewing requests" do
             useless_message.save!
         end
 
-        it 'should show a hidden notice to an unregistered user' do
+        it 'should show a hidden notice, not the message, to an unregistered user or the requester and
+            the message itself to an admin ' do
+
+            # unregistered
+            unregistered = without_login
+            unregistered.browses_request('why_do_you_have_such_a_fancy_dog')
+            unregistered.response.body.should include("This message has been hidden.")
+            unregistered.response.body.should_not include("sign in</a> to view the message.")
+            unregistered.response.body.should_not include("No way!")
+
+            # requester
+            bob = login(:bob_smith_user)
+            bob.browses_request('why_do_you_have_such_a_fancy_dog')
+            bob.response.body.should include("This message has been hidden.")
+            bob.response.body.should_not include("No way!")
+
+            # admin
+            confirm(:admin_user)
+            admin_user = login(:admin_user)
+            admin_user.browses_request('why_do_you_have_such_a_fancy_dog')
+            admin_user.response.body.should include('No way!')
+            admin_user.response.body.should include("This message has prominence \'hidden\'. You can only see it because you are logged in as a super user.")
+
+        end
+
+    end
+
+    context 'when as response has prominence "requester_only"' do
+
+        before do
+            useless_message = incoming_messages(:useless_incoming_message)
+            useless_message.prominence = 'requester_only'
+            useless_message.save!
+        end
+
+        it 'should show a hidden notice with login link to an unregistered user, and the message itself
+            with a hidden note to the requester or an admin' do
+
+            # unregistered
             unregistered = without_login
-            response = unregistered.browses_request('why_do_you_have_such_a_fancy_dog')
-            response.body.should include("This message has been hidden.")
+            unregistered.browses_request('why_do_you_have_such_a_fancy_dog')
+            unregistered.response.body.should include("This message has been hidden.")
+            unregistered.response.body.should include("sign in</a> to view the message.")
+            unregistered.response.body.should_not include("No way!")
+
+            # requester
+            bob = login(:bob_smith_user)
+            bob.browses_request('why_do_you_have_such_a_fancy_dog')
+            bob.response.body.should include("No way!")
+            bob.response.body.should include("This message is hidden, so that only you, the requester, can see it.")
+
+            # admin
+            confirm(:admin_user)
+            admin_user = login(:admin_user)
+            admin_user.browses_request('why_do_you_have_such_a_fancy_dog')
+            admin_user.response.body.should include('No way!')
+            admin_user.response.body.should_not include("This message has been hidden.")
+            admin_user.response.body.should include("This message is hidden, so that only you, the requester, can see it.")
         end
 
     end
+
 end