feat(captain): allow agents to review FAQ suggestions

enterprise/app/controllers/api/v1/accounts/captain/faq_suggestions_controller.rb

@@ -1,6 +1,6 @@
 class Api::V1::Accounts::Captain::FaqSuggestionsController < Api::V1::Accounts::BaseController
   before_action :current_account
-  before_action -> { check_authorization(Captain::Assistant) }
+  before_action -> { check_authorization(Captain::FaqSuggestion) }
   before_action :set_suggestions
   before_action :set_suggestion, except: [:index]
 

enterprise/app/policies/captain/faq_suggestion_policy.rb

@@ -0,0 +1,21 @@
+class Captain::FaqSuggestionPolicy < ApplicationPolicy
+  def index?
+    true
+  end
+
+  def show?
+    true
+  end
+
+  def update?
+    true
+  end
+
+  def approve?
+    true
+  end
+
+  def dismiss?
+    true
+  end
+end

spec/enterprise/controllers/api/v1/accounts/captain/faq_suggestions_controller_spec.rb

@@ -87,13 +87,25 @@ RSpec.describe 'Api::V1::Accounts::Captain::FaqSuggestions', type: :request do
       expect(suggestion.reload.question).to eq('Updated question')
     end
 
-    it 'does not let an agent edit a suggestion' do
+    it 'lets an agent edit an accessible suggestion' do
+      create(:inbox_member, user: agent, inbox: inbox)
+
       patch "/api/v1/accounts/#{account.id}/captain/faq_suggestions/#{suggestion.id}",
             params: { faq_suggestion: { question: 'Updated question' } },
             headers: agent.create_new_auth_token,
             as: :json
 
-      expect(response).to have_http_status(:unauthorized)
+      expect(response).to have_http_status(:success)
+      expect(suggestion.reload.question).to eq('Updated question')
+    end
+
+    it 'does not let an agent edit an inaccessible suggestion' do
+      patch "/api/v1/accounts/#{account.id}/captain/faq_suggestions/#{suggestion.id}",
+            params: { faq_suggestion: { question: 'Updated question' } },
+            headers: agent.create_new_auth_token,
+            as: :json
+
+      expect(response).to have_http_status(:not_found)
       expect(suggestion.reload.question).to eq('How do I enable the feature?')
     end
   end
@@ -113,14 +125,27 @@ RSpec.describe 'Api::V1::Accounts::Captain::FaqSuggestions', type: :request do
       expect(suggestion.observations).to be_empty
     end
 
-    it 'does not let an agent approve a suggestion' do
+    it 'lets an agent approve an accessible suggestion' do
+      create(:inbox_member, user: agent, inbox: inbox)
+
+      expect do
+        post "/api/v1/accounts/#{account.id}/captain/faq_suggestions/#{suggestion.id}/approve",
+             headers: agent.create_new_auth_token,
+             as: :json
+      end.to change(assistant.responses.approved, :count).by(1)
+
+      expect(response).to have_http_status(:success)
+      expect(suggestion.reload).to be_approved
+    end
+
+    it 'does not let an agent approve an inaccessible suggestion' do
       expect do
         post "/api/v1/accounts/#{account.id}/captain/faq_suggestions/#{suggestion.id}/approve",
              headers: agent.create_new_auth_token,
              as: :json
       end.not_to change(assistant.responses, :count)
 
-      expect(response).to have_http_status(:unauthorized)
+      expect(response).to have_http_status(:not_found)
       expect(suggestion.reload).to be_open
     end
   end
@@ -136,5 +161,25 @@ RSpec.describe 'Api::V1::Accounts::Captain::FaqSuggestions', type: :request do
       expect(response).to have_http_status(:success)
       expect(suggestion.reload).to be_dismissed
     end
+
+    it 'lets an agent dismiss an accessible suggestion' do
+      create(:inbox_member, user: agent, inbox: inbox)
+
+      post "/api/v1/accounts/#{account.id}/captain/faq_suggestions/#{suggestion.id}/dismiss",
+           headers: agent.create_new_auth_token,
+           as: :json
+
+      expect(response).to have_http_status(:success)
+      expect(suggestion.reload).to be_dismissed
+    end
+
+    it 'does not let an agent dismiss an inaccessible suggestion' do
+      post "/api/v1/accounts/#{account.id}/captain/faq_suggestions/#{suggestion.id}/dismiss",
+           headers: agent.create_new_auth_token,
+           as: :json
+
+      expect(response).to have_http_status(:not_found)
+      expect(suggestion.reload).to be_open
+    end
   end
 end