From 1ee939a9105432ac20073fbdeea4cb99beccc604 Mon Sep 17 00:00:00 2001
From: aakashb95 <aakashbakhle@gmail.com>
Date: Wed, 22 Jul 2026 23:19:49 +0530
Subject: [PATCH] feat(captain): allow agents to review FAQ suggestions

---
 .../captain/faq_suggestions_controller.rb     |  2 +-
 .../policies/captain/faq_suggestion_policy.rb | 21 ++++++++
 .../faq_suggestions_controller_spec.rb        | 53 +++++++++++++++++--
 3 files changed, 71 insertions(+), 5 deletions(-)
 create mode 100644 enterprise/app/policies/captain/faq_suggestion_policy.rb

diff --git a/enterprise/app/controllers/api/v1/accounts/captain/faq_suggestions_controller.rb b/enterprise/app/controllers/api/v1/accounts/captain/faq_suggestions_controller.rb
index 52df72104..39db35bb1 100644
--- a/enterprise/app/controllers/api/v1/accounts/captain/faq_suggestions_controller.rb
+++ b/enterprise/app/controllers/api/v1/accounts/captain/faq_suggestions_controller.rb
@@ -1,6 +1,6 @@
 class Api::V1::Accounts::Captain::FaqSuggestionsController < Api::V1::Accounts::BaseController
   before_action :current_account
-  before_action -> { check_authorization(Captain::Assistant) }
+  before_action -> { check_authorization(Captain::FaqSuggestion) }
   before_action :set_suggestions
   before_action :set_suggestion, except: [:index]
 
diff --git a/enterprise/app/policies/captain/faq_suggestion_policy.rb b/enterprise/app/policies/captain/faq_suggestion_policy.rb
new file mode 100644
index 000000000..cc4d5a5db
--- /dev/null
+++ b/enterprise/app/policies/captain/faq_suggestion_policy.rb
@@ -0,0 +1,21 @@
+class Captain::FaqSuggestionPolicy < ApplicationPolicy
+  def index?
+    true
+  end
+
+  def show?
+    true
+  end
+
+  def update?
+    true
+  end
+
+  def approve?
+    true
+  end
+
+  def dismiss?
+    true
+  end
+end
diff --git a/spec/enterprise/controllers/api/v1/accounts/captain/faq_suggestions_controller_spec.rb b/spec/enterprise/controllers/api/v1/accounts/captain/faq_suggestions_controller_spec.rb
index f1ad3f65a..910a53ecc 100644
--- a/spec/enterprise/controllers/api/v1/accounts/captain/faq_suggestions_controller_spec.rb
+++ b/spec/enterprise/controllers/api/v1/accounts/captain/faq_suggestions_controller_spec.rb
@@ -87,13 +87,25 @@ RSpec.describe 'Api::V1::Accounts::Captain::FaqSuggestions', type: :request do
       expect(suggestion.reload.question).to eq('Updated question')
     end
 
-    it 'does not let an agent edit a suggestion' do
+    it 'lets an agent edit an accessible suggestion' do
+      create(:inbox_member, user: agent, inbox: inbox)
+
       patch "/api/v1/accounts/#{account.id}/captain/faq_suggestions/#{suggestion.id}",
             params: { faq_suggestion: { question: 'Updated question' } },
             headers: agent.create_new_auth_token,
             as: :json
 
-      expect(response).to have_http_status(:unauthorized)
+      expect(response).to have_http_status(:success)
+      expect(suggestion.reload.question).to eq('Updated question')
+    end
+
+    it 'does not let an agent edit an inaccessible suggestion' do
+      patch "/api/v1/accounts/#{account.id}/captain/faq_suggestions/#{suggestion.id}",
+            params: { faq_suggestion: { question: 'Updated question' } },
+            headers: agent.create_new_auth_token,
+            as: :json
+
+      expect(response).to have_http_status(:not_found)
       expect(suggestion.reload.question).to eq('How do I enable the feature?')
     end
   end
@@ -113,14 +125,27 @@ RSpec.describe 'Api::V1::Accounts::Captain::FaqSuggestions', type: :request do
       expect(suggestion.observations).to be_empty
     end
 
-    it 'does not let an agent approve a suggestion' do
+    it 'lets an agent approve an accessible suggestion' do
+      create(:inbox_member, user: agent, inbox: inbox)
+
+      expect do
+        post "/api/v1/accounts/#{account.id}/captain/faq_suggestions/#{suggestion.id}/approve",
+             headers: agent.create_new_auth_token,
+             as: :json
+      end.to change(assistant.responses.approved, :count).by(1)
+
+      expect(response).to have_http_status(:success)
+      expect(suggestion.reload).to be_approved
+    end
+
+    it 'does not let an agent approve an inaccessible suggestion' do
       expect do
         post "/api/v1/accounts/#{account.id}/captain/faq_suggestions/#{suggestion.id}/approve",
              headers: agent.create_new_auth_token,
              as: :json
       end.not_to change(assistant.responses, :count)
 
-      expect(response).to have_http_status(:unauthorized)
+      expect(response).to have_http_status(:not_found)
       expect(suggestion.reload).to be_open
     end
   end
@@ -136,5 +161,25 @@ RSpec.describe 'Api::V1::Accounts::Captain::FaqSuggestions', type: :request do
       expect(response).to have_http_status(:success)
       expect(suggestion.reload).to be_dismissed
     end
+
+    it 'lets an agent dismiss an accessible suggestion' do
+      create(:inbox_member, user: agent, inbox: inbox)
+
+      post "/api/v1/accounts/#{account.id}/captain/faq_suggestions/#{suggestion.id}/dismiss",
+           headers: agent.create_new_auth_token,
+           as: :json
+
+      expect(response).to have_http_status(:success)
+      expect(suggestion.reload).to be_dismissed
+    end
+
+    it 'does not let an agent dismiss an inaccessible suggestion' do
+      post "/api/v1/accounts/#{account.id}/captain/faq_suggestions/#{suggestion.id}/dismiss",
+           headers: agent.create_new_auth_token,
+           as: :json
+
+      expect(response).to have_http_status(:not_found)
+      expect(suggestion.reload).to be_open
+    end
   end
 end