introduces policies

The pattern used here is taken from pundit although this here does by
far not have the functionality pundit offers.

app/controllers/api/experimental/concerns/can.rb

@@ -1,126 +0,0 @@
-#-- copyright
-# OpenProject is a project management system.
-# Copyright (C) 2012-2014 the OpenProject Foundation (OPF)
-#
-# This program is free software; you can redistribute it and/or
-# modify it under the terms of the GNU General Public License version 3.
-#
-# OpenProject is a fork of ChiliProject, which is a fork of Redmine. The copyright follows:
-# Copyright (C) 2006-2013 Jean-Philippe Lang
-# Copyright (C) 2010-2013 the ChiliProject Team
-#
-# This program is free software; you can redistribute it and/or
-# modify it under the terms of the GNU General Public License
-# as published by the Free Software Foundation; either version 2
-# of the License, or (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-#
-# See doc/COPYRIGHT.rdoc for more details.
-#++
-
-# This capsulates permissions a user has for a work package.  It caches based
-# on the work package's project and is thus optimized for the context menu.
-#
-# This is no conern but it was placed here so that it will be removed together
-# with the rest of the experimental API.
-
-module Api
-  module Experimental
-    module Concerns
-      class Can
-        attr_accessor :user
-
-        def initialize(user)
-          self.user = user
-        end
-
-        def actions(wp)
-          cache[wp].each_with_object([]) { |(k, v), a| a << k if v }
-        end
-
-        def allowed?(work_package, action)
-          cache[work_package][action]
-        end
-
-        private
-
-        def cache
-          @cache ||= Hash.new do |hash, work_package|
-            # copy checks for the move_work_packages permission. This makes
-            # sense only because the work_packages/moves controller handles
-            # copying multiple work packages.
-            hash[work_package] = {
-              :edit => edit_allowed?(work_package),
-              :log_time => log_time_allowed?(work_package),
-              :move => move_allowed?(work_package),
-              :copy => move_allowed?(work_package),
-              :duplicate => copy_allowed?(work_package), # duplicating is another form of copying
-              :delete => delete_allowed?(work_package)
-            }
-          end
-        end
-
-        def edit_allowed?(work_package)
-          @edit_cache ||= Hash.new do |hash, project|
-            hash[project] = user.allowed_to?(:edit_work_packages, project) ||
-                            user.allowed_to?(:add_work_package_notes, project)
-          end
-
-          @edit_cache[work_package.project]
-        end
-
-        def log_time_allowed?(work_package)
-          @log_time_cache ||= Hash.new do |hash, project|
-            hash[project] = user.allowed_to?(:log_time, project)
-          end
-
-          @log_time_cache[work_package.project]
-        end
-
-        def move_allowed?(work_package)
-          @move_cache ||= Hash.new do |hash, project|
-            hash[project] = user.allowed_to?(:move_work_packages, project)
-          end
-
-          @move_cache[work_package.project]
-        end
-
-        def copy_allowed?(work_package)
-          type_active_in_project?(work_package) && add_allowed?(work_package)
-        end
-
-        def delete_allowed?(work_package)
-          @delete_cache ||= Hash.new do |hash, project|
-            hash[project] = user.allowed_to?(:delete_work_packages, project)
-          end
-
-          @delete_cache[work_package.project]
-        end
-
-        def add_allowed?(work_package)
-          @add_cache ||= Hash.new do |hash, project|
-            hash[project] = user.allowed_to?(:add_work_packages, project)
-          end
-
-          @add_cache[work_package.project]
-        end
-
-        def type_active_in_project?(work_package)
-          @type_active_cache ||= Hash.new do |hash, project|
-            hash[project] = project.types.pluck(:id)
-          end
-
-          @type_active_cache[work_package.project].include?(work_package.type_id)
-        end
-      end
-    end
-  end
-end

app/controllers/api/experimental/concerns/can/base.rb

@@ -0,0 +1,53 @@
+#-- copyright
+# OpenProject is a project management system.
+# Copyright (C) 2012-2014 the OpenProject Foundation (OPF)
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License version 3.
+#
+# OpenProject is a fork of ChiliProject, which is a fork of Redmine. The copyright follows:
+# Copyright (C) 2006-2013 Jean-Philippe Lang
+# Copyright (C) 2010-2013 the ChiliProject Team
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+#
+# See doc/COPYRIGHT.rdoc for more details.
+#++
+
+# This capsulates permissions a user has for a work package.  It caches based
+# on the work package's project and is thus optimized for the context menu.
+#
+# This is no conern but it was placed here so that it will be removed together
+# with the rest of the experimental API.
+
+module Api::Experimental::Concerns
+  module Can
+    class Base
+      attr_accessor :user
+
+      def initialize(user)
+        self.user = user
+      end
+
+      def actions(wp)
+        cache[wp].each_with_object([]) { |(k, v), a| a << k if v }
+      end
+
+      def allowed?(work_package, action)
+        cache[work_package][action]
+      end
+    end
+  end
+end

app/controllers/api/experimental/concerns/can/work_package.rb

@@ -0,0 +1,110 @@
+#-- copyright
+# OpenProject is a project management system.
+# Copyright (C) 2012-2014 the OpenProject Foundation (OPF)
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License version 3.
+#
+# OpenProject is a fork of ChiliProject, which is a fork of Redmine. The copyright follows:
+# Copyright (C) 2006-2013 Jean-Philippe Lang
+# Copyright (C) 2010-2013 the ChiliProject Team
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+#
+# See doc/COPYRIGHT.rdoc for more details.
+#++
+
+# This capsulates permissions a user has for a work package.  It caches based
+# on the work package's project and is thus optimized for the context menu.
+#
+# This is no conern but it was placed here so that it will be removed together
+# with the rest of the experimental API.
+
+module Api::Experimental::Concerns
+  module Can
+    class WorkPackage < Base
+      private
+
+      def cache
+        @cache ||= Hash.new do |hash, work_package|
+          # copy checks for the move_work_packages permission. This makes
+          # sense only because the work_packages/moves controller handles
+          # copying multiple work packages.
+          hash[work_package] = {
+            edit: edit_allowed?(work_package),
+            log_time: log_time_allowed?(work_package),
+            move: move_allowed?(work_package),
+            copy: move_allowed?(work_package),
+            duplicate: copy_allowed?(work_package), # duplicating is another form of copying
+            delete: delete_allowed?(work_package)
+          }
+        end
+      end
+
+      def edit_allowed?(work_package)
+        @edit_cache ||= Hash.new do |hash, project|
+          hash[project] = user.allowed_to?(:edit_work_packages, project) ||
+                          user.allowed_to?(:add_work_package_notes, project)
+        end
+
+        @edit_cache[work_package.project]
+      end
+
+      def log_time_allowed?(work_package)
+        @log_time_cache ||= Hash.new do |hash, project|
+          hash[project] = user.allowed_to?(:log_time, project)
+        end
+
+        @log_time_cache[work_package.project]
+      end
+
+      def move_allowed?(work_package)
+        @move_cache ||= Hash.new do |hash, project|
+          hash[project] = user.allowed_to?(:move_work_packages, project)
+        end
+
+        @move_cache[work_package.project]
+      end
+
+      def copy_allowed?(work_package)
+        type_active_in_project?(work_package) && add_allowed?(work_package)
+      end
+
+      def delete_allowed?(work_package)
+        @delete_cache ||= Hash.new do |hash, project|
+          hash[project] = user.allowed_to?(:delete_work_packages, project)
+        end
+
+        @delete_cache[work_package.project]
+      end
+
+      def add_allowed?(work_package)
+        @add_cache ||= Hash.new do |hash, project|
+          hash[project] = user.allowed_to?(:add_work_packages, project)
+        end
+
+        @add_cache[work_package.project]
+      end
+
+      def type_active_in_project?(work_package)
+        @type_active_cache ||= Hash.new do |hash, project|
+          hash[project] = project.types.pluck(:id)
+        end
+
+        @type_active_cache[work_package.project].include?(work_package.type_id)
+      end
+    end
+  end
+end

app/controllers/api/experimental/work_packages_controller.rb

@@ -85,7 +85,7 @@ module Api
       private
 
       def setup_context_menu_actions
-        @can = Api::Experimental::Concerns::Can.new(User.current)
+        @can = WorkPackagePolicy.new(User.current)
       end
 
       def columns_total_sums(column_names, work_packages)

app/policies/base_policy.rb

@@ -0,0 +1,49 @@
+#-- copyright
+# OpenProject is a project management system.
+# Copyright (C) 2012-2014 the OpenProject Foundation (OPF)
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License version 3.
+#
+# OpenProject is a fork of ChiliProject, which is a fork of Redmine. The copyright follows:
+# Copyright (C) 2006-2013 Jean-Philippe Lang
+# Copyright (C) 2010-2013 the ChiliProject Team
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+#
+# See doc/COPYRIGHT.rdoc for more details.
+#++
+
+# This capsulates permissions a user has for a work package.  It caches based
+# on the work package's project and is thus optimized for the context menu.
+#
+# This is no conern but it was placed here so that it will be removed together
+# with the rest of the experimental API.
+
+class BasePolicy
+  attr_accessor :user
+
+  def initialize(user)
+    self.user = user
+  end
+
+  def actions(wp)
+    cache[wp].each_with_object([]) { |(k, v), a| a << k if v }
+  end
+
+  def allowed?(object, action)
+    cache[object][action]
+  end
+end

app/policies/query_policy.rb

@@ -0,0 +1,108 @@
+#-- copyright
+# OpenProject is a project management system.
+# Copyright (C) 2012-2014 the OpenProject Foundation (OPF)
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License version 3.
+#
+# OpenProject is a fork of ChiliProject, which is a fork of Redmine. The copyright follows:
+# Copyright (C) 2006-2013 Jean-Philippe Lang
+# Copyright (C) 2010-2013 the ChiliProject Team
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+#
+# See doc/COPYRIGHT.rdoc for more details.
+#++
+
+# This capsulates permissions a user has for a work package.  It caches based
+# on the work package's project and is thus optimized for the context menu.
+#
+# This is no conern but it was placed here so that it will be removed together
+# with the rest of the experimental API.
+
+class QueryPolicy < BasePolicy
+  private
+
+  def cache
+    @cache ||= Hash.new do |hash, query|
+      hash[query] = {
+        update: update_allowed?(query),
+#          log_time: log_time_allowed?(work_package),
+#          move: move_allowed?(work_package),
+#          copy: move_allowed?(work_package),
+#          duplicate: copy_allowed?(work_package), # duplicating is another form of copying
+#          delete: delete_allowed?(work_package)
+      }
+    end
+  end
+
+  def update_allowed?(query)
+    @update_private_cache ||= Hash.new do |hash, project|
+      hash[project] = user.allowed_to?(:save_queries, project)
+    end
+
+    @update_public_cache ||= Hash.new do |hash, project|
+      hash[project] = user.allowed_to?(:manage_public_queries, project)
+    end
+
+    query.persisted? &&
+    (@update_private_cache[query.project] && query.user == user ||
+     @update_public_cache[query.project] && query.is_public)
+  end
+
+  def log_time_allowed?(work_package)
+    @log_time_cache ||= Hash.new do |hash, project|
+      hash[project] = user.allowed_to?(:log_time, project)
+    end
+
+    @log_time_cache[work_package.project]
+  end
+
+  def move_allowed?(work_package)
+    @move_cache ||= Hash.new do |hash, project|
+      hash[project] = user.allowed_to?(:move_work_packages, project)
+    end
+
+    @move_cache[work_package.project]
+  end
+
+  def copy_allowed?(work_package)
+    type_active_in_project?(work_package) && add_allowed?(work_package)
+  end
+
+  def delete_allowed?(work_package)
+    @delete_cache ||= Hash.new do |hash, project|
+      hash[project] = user.allowed_to?(:delete_work_packages, project)
+    end
+
+    @delete_cache[work_package.project]
+  end
+
+  def add_allowed?(work_package)
+    @add_cache ||= Hash.new do |hash, project|
+      hash[project] = user.allowed_to?(:add_work_packages, project)
+    end
+
+    @add_cache[work_package.project]
+  end
+
+  def type_active_in_project?(work_package)
+    @type_active_cache ||= Hash.new do |hash, project|
+      hash[project] = project.types.pluck(:id)
+    end
+
+    @type_active_cache[work_package.project].include?(work_package.type_id)
+  end
+end

app/policies/work_package_policy.rb

@@ -0,0 +1,106 @@
+#-- copyright
+# OpenProject is a project management system.
+# Copyright (C) 2012-2014 the OpenProject Foundation (OPF)
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License version 3.
+#
+# OpenProject is a fork of ChiliProject, which is a fork of Redmine. The copyright follows:
+# Copyright (C) 2006-2013 Jean-Philippe Lang
+# Copyright (C) 2010-2013 the ChiliProject Team
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+#
+# See doc/COPYRIGHT.rdoc for more details.
+#++
+
+# This capsulates permissions a user has for a work package.  It caches based
+# on the work package's project and is thus optimized for the context menu.
+#
+# This is no conern but it was placed here so that it will be removed together
+# with the rest of the experimental API.
+
+class WorkPackagePolicy < BasePolicy
+  private
+
+  def cache
+    @cache ||= Hash.new do |hash, work_package|
+      # copy checks for the move_work_packages permission. This makes
+      # sense only because the work_packages/moves controller handles
+      # copying multiple work packages.
+      hash[work_package] = {
+        edit: edit_allowed?(work_package),
+        log_time: log_time_allowed?(work_package),
+        move: move_allowed?(work_package),
+        copy: move_allowed?(work_package),
+        duplicate: copy_allowed?(work_package), # duplicating is another form of copying
+        delete: delete_allowed?(work_package)
+      }
+    end
+  end
+
+  def edit_allowed?(work_package)
+    @edit_cache ||= Hash.new do |hash, project|
+      hash[project] = user.allowed_to?(:edit_work_packages, project) ||
+                      user.allowed_to?(:add_work_package_notes, project)
+    end
+
+    @edit_cache[work_package.project]
+  end
+
+  def log_time_allowed?(work_package)
+    @log_time_cache ||= Hash.new do |hash, project|
+      hash[project] = user.allowed_to?(:log_time, project)
+    end
+
+    @log_time_cache[work_package.project]
+  end
+
+  def move_allowed?(work_package)
+    @move_cache ||= Hash.new do |hash, project|
+      hash[project] = user.allowed_to?(:move_work_packages, project)
+    end
+
+    @move_cache[work_package.project]
+  end
+
+  def copy_allowed?(work_package)
+    type_active_in_project?(work_package) && add_allowed?(work_package)
+  end
+
+  def delete_allowed?(work_package)
+    @delete_cache ||= Hash.new do |hash, project|
+      hash[project] = user.allowed_to?(:delete_work_packages, project)
+    end
+
+    @delete_cache[work_package.project]
+  end
+
+  def add_allowed?(work_package)
+    @add_cache ||= Hash.new do |hash, project|
+      hash[project] = user.allowed_to?(:add_work_packages, project)
+    end
+
+    @add_cache[work_package.project]
+  end
+
+  def type_active_in_project?(work_package)
+    @type_active_cache ||= Hash.new do |hash, project|
+      hash[project] = project.types.pluck(:id)
+    end
+
+    @type_active_cache[work_package.project].include?(work_package.type_id)
+  end
+end

spec/controllers/api/experimental/concerns/can/work_package_spec.rb

@@ -0,0 +1,59 @@
+#-- copyright
+# OpenProject is a project management system.
+# Copyright (C) 2012-2014 the OpenProject Foundation (OPF)
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License version 3.
+#
+# OpenProject is a fork of ChiliProject, which is a fork of Redmine. The copyright follows:
+# Copyright (C) 2006-2013 Jean-Philippe Lang
+# Copyright (C) 2010-2013 the ChiliProject Team
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+#
+# See doc/COPYRIGHT.rdoc for more details.
+#++
+
+require File.expand_path('../../../../../../spec_helper', __FILE__)
+
+describe Api::Experimental::Concerns::Can::WorkPackage, type: :controller do
+  let(:user)         { FactoryGirl.build_stubbed(:user) }
+  let(:project)      { FactoryGirl.build_stubbed(:project) }
+  let(:work_package) { FactoryGirl.build_stubbed(:work_package, project: project) }
+
+  describe :allowed? do
+    let(:subject) { described_class.new(user) }
+
+    before do
+      allow(user).to receive(:allowed_to?).and_return false
+    end
+
+    it 'is false for edit if the user has no permission in the project' do
+      expect(subject.allowed?(work_package, :edit)).to be_false
+    end
+
+    it 'is true for edit if the user has the edit_work_package permission in the project' do
+      allow(user).to receive(:allowed_to?).with(:edit_work_packages, project)
+                                          .and_return true
+      expect(subject.allowed?(work_package, :edit)).to be_true
+    end
+
+    it 'is true for edit if the user has the add_work_package_notes permission in the project' do
+      allow(user).to receive(:allowed_to?).with(:add_work_package_notes, project)
+                                          .and_return true
+      expect(subject.allowed?(work_package, :edit)).to be_true
+    end
+  end
+end

spec/policies/query_policy_spec.rb

@@ -0,0 +1,118 @@
+#-- copyright
+# OpenProject is a project management system.
+# Copyright (C) 2012-2014 the OpenProject Foundation (OPF)
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License version 3.
+#
+# OpenProject is a fork of ChiliProject, which is a fork of Redmine. The copyright follows:
+# Copyright (C) 2006-2013 Jean-Philippe Lang
+# Copyright (C) 2010-2013 the ChiliProject Team
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+#
+# See doc/COPYRIGHT.rdoc for more details.
+#++
+
+require File.expand_path('../../spec_helper', __FILE__)
+
+describe QueryPolicy, type: :controller do
+  let(:user)    { FactoryGirl.build_stubbed(:user) }
+  let(:project) { FactoryGirl.build_stubbed(:project) }
+  let(:query)   { FactoryGirl.build_stubbed(:query, project: project) }
+
+  describe :allowed? do
+    let(:subject) { described_class.new(user) }
+
+    before do
+      allow(user).to receive(:allowed_to?).and_return false
+    end
+
+    it 'is false for update if the user has no permission in the project' do
+      expect(subject.allowed?(query, :update)).to be_falsy
+    end
+
+    it 'is false for update if the user has the save_query permission in the project ' +
+       'AND the query is not persisted' do
+      allow(user).to receive(:allowed_to?).with(:save_queries, project)
+                                          .and_return true
+      allow(query).to receive(:persisted?).and_return false
+
+      expect(subject.allowed?(query, :update)).to be_falsy
+    end
+
+    it 'is true for update if the user has the save_query permission in the project ' +
+       'AND it is his query' do
+      allow(user).to receive(:allowed_to?).with(:save_queries, project)
+                                          .and_return true
+      query.user = user
+
+      expect(subject.allowed?(query, :update)).to be_truthy
+    end
+
+    it 'is false for update if the user has the save_query permission in the project ' +
+       'AND it is not his query' do
+      allow(user).to receive(:allowed_to?).with(:save_queries, project)
+                                          .and_return true
+
+      query.user = FactoryGirl.build_stubbed(:user)
+
+      expect(subject.allowed?(query, :update)).to be_falsy
+    end
+
+    it 'is false for update if the user lacks the save_query permission in the project ' +
+       'AND it is his query' do
+      allow(user).to receive(:allowed_to?).with(:save_queries, project)
+                                          .and_return false
+
+      query.user = user
+
+      expect(subject.allowed?(query, :update)).to be_falsy
+    end
+
+    it 'is true for update if the user has the manage_public_query permission in the project' +
+       'AND it is anothers query ' +
+       'AND the query is public' do
+      allow(user).to receive(:allowed_to?).with(:manage_public_queries, project)
+                                          .and_return true
+      query.user = FactoryGirl.build_stubbed(:user)
+      query.is_public = true
+
+      expect(subject.allowed?(query, :update)).to be_truthy
+    end
+
+    it 'is false for update if the user lacks the manage_public_query permission in the project ' +
+       'AND it is anothers query ' +
+       'AND the query is public' do
+      allow(user).to receive(:allowed_to?).with(:manage_public_queries, project)
+                                          .and_return false
+      query.user = FactoryGirl.build_stubbed(:user)
+      query.is_public = true
+
+      expect(subject.allowed?(query, :update)).to be_falsy
+    end
+
+    it 'is false for update if the user has the manage_public_query permission in the project ' +
+       'AND it is anothers query ' +
+       'AND the query is not public' do
+      allow(user).to receive(:allowed_to?).with(:manage_public_queries, project)
+                                          .and_return true
+      query.user = FactoryGirl.build_stubbed(:user)
+      query.is_public = false
+
+      expect(subject.allowed?(query, :update)).to be_falsy
+    end
+  end
+end

spec/policies/work_package_policy_spec.rb

@@ -26,9 +26,9 @@
 # See doc/COPYRIGHT.rdoc for more details.
 #++
 
-require File.expand_path('../../../../../spec_helper', __FILE__)
+require File.expand_path('../../spec_helper', __FILE__)
 
-describe Api::Experimental::Concerns::Can, type: :controller do
+describe WorkPackagePolicy, type: :controller do
   let(:user)         { FactoryGirl.build_stubbed(:user) }
   let(:project)      { FactoryGirl.build_stubbed(:project) }
   let(:work_package) { FactoryGirl.build_stubbed(:work_package, project: project) }