Merge pull request #242 from basecamp/feat/bot-boost-update

Allow bots to delete their own boosts

app/controllers/messages/boosts/by_bots_controller.rb

@@ -1,9 +1,9 @@
 class Messages::Boosts::ByBotsController < Messages::BoostsController
   include RawRequestBody
 
-  allow_bot_access only: :create
+  allow_bot_access only: %i[ create destroy ]
 
-  before_action :ensure_content_present
+  before_action :ensure_content_present, only: :create
 
   def create
     @boost = @message.boosts.create!(boost_params)
@@ -21,6 +21,12 @@ class Messages::Boosts::ByBotsController < Messages::BoostsController
       head :not_found unless @message
     end
 
+    def set_boost
+      super
+    rescue ActiveRecord::RecordNotFound
+      head :not_found
+    end
+
     def ensure_content_present
       if raw_request_body.blank?
         head :unprocessable_content

app/controllers/messages/boosts_controller.rb

@@ -1,5 +1,6 @@
 class Messages::BoostsController < ApplicationController
   before_action :set_message
+  before_action :set_boost, only: :destroy
 
   def index
   end
@@ -15,7 +16,6 @@ class Messages::BoostsController < ApplicationController
   end
 
   def destroy
-    @boost = Current.user.boosts.find(params[:id])
     @boost.destroy!
 
     broadcast_remove
@@ -26,6 +26,10 @@ class Messages::BoostsController < ApplicationController
       @message = Current.user.reachable_messages.find(params[:message_id])
     end
 
+    def set_boost
+      @boost = @message.boosts.find_by!(id: params[:id], booster: Current.user)
+    end
+
     def boost_params
       params.require(:boost).permit(:content)
     end

config/routes.rb

@@ -65,7 +65,7 @@ Rails.application.routes.draw do
     nested do
       scope path: ":bot_key", as: :bot, defaults: { format: :json } do
         resources :messages, controller: "messages/by_bots", only: %i[ index create update destroy ] do
-          resources :boosts, controller: "messages/boosts/by_bots", only: :create
+          resources :boosts, controller: "messages/boosts/by_bots", only: %i[ create destroy ]
         end
       end
     end

test/controllers/messages/boosts/by_bots_controller_test.rb

@@ -79,4 +79,34 @@ class Messages::Boosts::ByBotsControllerTest < ActionDispatch::IntegrationTest
     end
     assert_response :redirect
   end
+
+  test "destroy removes the bot's own boost" do
+    assert_difference -> { Boost.count }, -1 do
+      delete room_bot_message_boost_url(@room, @bot.bot_key, @message, boosts(:fourth_by_bender))
+    end
+
+    assert_response :no_content
+  end
+
+  test "destroy broadcasts the removal" do
+    assert_turbo_stream_broadcasts [ @message.room, :messages ], count: 1 do
+      delete room_bot_message_boost_url(@room, @bot.bot_key, @message, boosts(:fourth_by_bender))
+    end
+  end
+
+  test "destroy can't touch a boost the bot did not make" do
+    assert_no_difference -> { Boost.count } do
+      delete room_bot_message_boost_url(@room, @bot.bot_key, messages(:thirteenth), boosts(:thirteenth))
+    end
+
+    assert_response :not_found
+  end
+
+  test "destroy requires a valid bot key" do
+    assert_no_difference -> { Boost.count } do
+      delete room_bot_message_boost_url(@room, "invalid-bot-key", @message, boosts(:fourth_by_bender))
+    end
+
+    assert_response :redirect
+  end
 end

test/fixtures/boosts.yml

@@ -6,3 +6,7 @@ thirteenth:
   message: thirteenth
   booster: jason
   content: 💯
+fourth_by_bender:
+  message: fourth
+  booster: bender
+  content: 👀