fix(captain): scope FAQ suggestions to agent access

enterprise/app/controllers/api/v1/accounts/captain/faq_suggestions_controller.rb

@@ -1,6 +1,6 @@
 class Api::V1::Accounts::Captain::FaqSuggestionsController < Api::V1::Accounts::BaseController
   before_action :current_account
-  before_action :check_admin_authorization?
+  before_action -> { check_authorization(Captain::Assistant) }
   before_action :set_suggestions
   before_action :set_suggestion, except: [:index]
 
@@ -59,6 +59,12 @@ class Api::V1::Accounts::Captain::FaqSuggestionsController < Api::V1::Accounts::
 
   def set_suggestions
     @suggestions = Current.account.captain_faq_suggestions.includes(:assistant).ordered
+    return if Current.account_user.administrator?
+
+    accessible_suggestion_ids = Captain::FaqObservation
+                                .where(conversation_id: accessible_conversations.select(:id))
+                                .select(:faq_suggestion_id)
+    @suggestions = @suggestions.where(id: accessible_suggestion_ids)
   end
 
   def set_suggestion

enterprise/app/policies/captain/assistant_policy.rb

@@ -31,6 +31,14 @@ class Captain::AssistantPolicy < ApplicationPolicy
     @account_user.administrator?
   end
 
+  def approve?
+    update?
+  end
+
+  def dismiss?
+    update?
+  end
+
   def destroy?
     @account_user.administrator?
   end

spec/enterprise/policies/captain/assistant_policy_spec.rb

@@ -22,7 +22,7 @@ RSpec.describe Captain::AssistantPolicy, type: :policy do
     end
   end
 
-  permissions :tools?, :create?, :update?, :destroy?, :sync?, :drilldown? do
+  permissions :tools?, :create?, :update?, :approve?, :dismiss?, :destroy?, :sync?, :drilldown? do
     context 'when administrator' do
       it { expect(assistant_policy).to permit(administrator_context, assistant) }
     end