Private spaces implementation by valentinRyckaert · Pull Request #1339 · ElixirTeSS/TeSS

valentinRyckaert · 2026-07-22T14:14:51Z

Summary of changes

Database

3 new tables

groups:
- id: bigint
- title: string
groups_membership:
- user_id: bigint
- group_id: bigint
- owner: boolean
groups_spaces:
- group_id: bigint
- space_id: bigint

Changes in existing tables

spaces:
- new - is_private: boolean

Code

New group controller and policy

everyone can see all groups (like users)
only members and admins of a group can see the group details page
only owners and admins can edit/destroy a group (and so add people)
only admins can create a group
cant create/edit/destroy by API

New MemberShip Model

primary key: group_id, user_id
belongs to user
belongs to group

Shown? in application policy

show if:
- the record does not belong to a space
- the space of the record is public
- the record is a space (so the space list can be shown in the main space)
- the space of the record is the current space and user is in at least one of the required groups for the space (the user needs to be connected) or the user is an admin (admin have so full rights)

Spaces controller and policy updates

space policy:
- everyone can see public spaces
- only members of required groups can see private spaces
- only space admins/ main admins can edit space
- only main admins can create/destroy space
space controller:
- index: filter shown spaces with shown? policy function

Solr search_index updates

uses shown? to filter the ressources list to show (index view of materials, events and spaces)

Application controller updates

check if the user has the right to access current_space (private space) with the shown? function and show default space if not

Space model update

all ressources form a private space are destroyed if the space is destroyed
if the space is public, all the ressources except roles (destroyed) are nullified
when nullified, we reload Solr index to make changes visible

Rdoc

docstrings
documentation about followed conventions

Screenshots

Checklist

I have read and followed the CONTRIBUTING guide.
I confirm that I have the authority necessary to make this contribution on behalf of its copyright owner and agree to license it to the TeSS codebase under the BSD license.

…the private space

…vate-spaces into private-spaces

…oogle for viewing all materials

…ce (and all the others)

…he user is part of from the main app

…zed users in main app

…ss a space

…d to groups

Copilot

Pull request overview

This PR introduces “private spaces” backed by a new group/membership system, and threads the resulting access-control rules through Pundit policies, controllers (space resolution + search/index filtering), UI, and tests.

Changes:

Adds Group/GroupMembership models + CRUD UI, plus authorization rules that allow read access to members/admins and restrict write access to owners/admins (and block API writes).
Adds spaces.is_private and space↔group association, with shared ApplicationPolicy#shown? visibility logic and private-space enforcement in ApplicationController#set_current_space.
Filters indexed/search results (incl. Solr-backed listings) by shown?, and adds documentation + test coverage for the private-space access scenario.

Reviewed changes

Copilot reviewed 53 out of 55 changed files in this pull request and generated 14 comments.

Show a summary per file

File	Description
test/system/groups_test.rb	System tests for basic Groups UI flows (index/create/update/destroy).
test/models/space_test.rb	Model validation test for “private space must have required groups”.
test/models/group_test.rb	Placeholder Group model test file.
test/integration/private_space_access_test.rb	Integration-style coverage for private-space access across spaces/materials surfaces.
test/fixtures/groups.yml	Adds Group fixtures used by tests.
test/controllers/groups_controller_test.rb	Controller-level tests for Group authorization + API write restrictions.
Gemfile	Adds explicit `rdoc (>= 8.0)` dependency.
Gemfile.lock	Updates lockfile for rdoc/rbs/prism-related dependencies.
docs/spaces.md	Documents private spaces behavior and deletion/nullification semantics.
docs/docstrings.md	Adds RDoc/docstring conventions documentation.
db/schema.rb	Adds groups, group_memberships, groups_spaces, and `spaces.is_private` to schema.
db/migrate/20260612065213_create_groups.rb	Creates `groups` table.
db/migrate/20260612065245_create_join_table_groups_users.rb	Creates interim groups↔users join table (later replaced).
db/migrate/20260612065251_create_join_table_groups_spaces.rb	Creates groups↔spaces join table.
db/migrate/20260618090239_add_is_private_to_spaces.rb	Adds `is_private` boolean to spaces.
db/migrate/20260618141208_replace_groups_users_with_group_memberships.rb	Replaces groups_users with `group_memberships` join model (with owner flag).
config/routes.rb	Adds RESTful routes for `groups`.
config/locales/en.yml	Updates “spaces” copy to mention private spaces/groups.
config/application.rb	Whitespace-only change.
app/views/users/show.html.erb	Adds a “Groups” section to the user sidebar with collapse/overflow UI.
app/views/users/_list.json.jbuilder	Alters `/users.json` list output (now excluding admins).
app/views/spaces/edit.html.erb	Whitespace-only change.
app/views/spaces/_form.html.erb	Adds private-space toggle and groups autocompleter; includes JS.
app/views/layouts/_user_menu.html.erb	Adds “View groups” to admin/curator/owner admin menu.
app/views/groups/index.html.erb	New Groups index UI.
app/views/groups/show.html.erb	New Groups show page with members + related spaces sections.
app/views/groups/new.html.erb	New group page.
app/views/groups/edit.html.erb	Edit group page.
app/views/groups/_form.html.erb	Group form with user autocompleter + owner flag selection.
app/views/groups/_group.html.erb	Group partial.
app/views/groups/_group.json.jbuilder	Group JSON representation.
app/views/groups/index.json.jbuilder	Groups index JSON.
app/views/groups/show.json.jbuilder	Group show JSON.
app/serializers/group_serializer.rb	Adds Group serializer for API/JSON:API usage.
app/policies/application_policy.rb	Adds shared `shown?` visibility logic for private-space scoping + docstrings.
app/policies/space_policy.rb	Aligns SpacePolicy show/edit/destroy with shown?/admin/space-admin rules.
app/policies/group_policy.rb	New GroupPolicy for member/admin visibility and HTML-only writes.
app/policies/material_policy.rb	Ensures Material show? also requires shown? (private-space visibility).
app/policies/event_policy.rb	Ensures Event show? also requires shown? (private-space visibility).
app/models/user.rb	Adds group/group_membership associations + owner helper methods.
app/models/space.rb	Adds groups association, private-space validation, and destroy-time handling + docstrings.
app/models/group.rb	New Group model with memberships and spaces associations.
app/models/group_membership.rb	New join model with owner flag and composite PK intent.
app/models/global_space.rb	Adjusts equality semantics for GlobalSpace.
app/helpers/groups_helper.rb	Adds Groups helper module.
app/controllers/groups_controller.rb	Adds Groups CRUD with membership owner syncing + policy enforcement.
app/controllers/spaces_controller.rb	Filters spaces#index by shown? and permits group_ids/is_private.
app/controllers/materials_controller.rb	Adds `@results_count` for index results.
app/controllers/concerns/searchable_index.rb	Filters Solr results by shown? and changes JSON:API meta keys.
app/controllers/application_controller.rb	Enforces private-space access at space resolution time (host-based).
app/assets/javascripts/templates/autocompleter/group_member.hbs	Autocompleter template for group membership rows (incl. owner checkbox).
app/assets/javascripts/templates/autocompleter/group_id.hbs	Autocompleter template for group selection in space form.
app/assets/javascripts/show_private_groups.js	Toggles required-groups UI based on “private space” checkbox.
app/assets/javascripts/autocompleters.js	Adds `groups` transform function for autocompleter responses.
app/assets/config/manifest.js	Includes `show_private_groups.js` in asset pipeline.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

valentinRyckaert · 2026-07-23T08:41:36Z

+    @spaces = Space.all.select { |space| policy(space).shown? }
    respond_to do |format|
      format.html
+      format.json { render json: @groups.as_json(only: [:id, :title]) }
    end


Why removing @spaces = Space.all.select { |space| policy(space).shown? }? @spaces needs to be initialized.

+      # Override total on the Solr result object so the view gets the right count
+      @search_results.instance_variable_set(:@total, filtered.length)
+      def @search_results.total; @total; end
+
+      @index_resources = WillPaginate::Collection.create(page, per_page, filtered.length) do |pager|
+        pager.replace(filtered)
+      end


+  # Returns:: the default Pundit policy scope for the record's class,
+  #           filtered by #shown?.
  def scope
-    Pundit.policy_scope!(user, record.class)
+    Pundit.policy_scope!(user, record.class).shown?
+  end


+  def is_owner_in_any_group?
+    Group.all.any? { |group| group.group_memberships.find_by(user: self)&.owner == true }
+  end


+    def validate(record)
+      Rails.logger.info "Validating space: is_private=#{record.is_private}, groups_count=#{record.groups.length}"
+      if record.is_private && record.groups.length == 0
+        record.errors.add(:base, "If the space is private, you must add required groups.")
+      end
+    end


+        <%= button_to @group, method: :delete,
+            class: 'btn btn-danger',
+            form: { data: { confirm: "Are you sure you want to delete this group?" } } do %>
+          <i class="glyphicon glyphicon-trash"></i> Delete
+        <% end %>


@@ -0,0 +1,23 @@
+// excuted for space form


+    create_join_table :groups, :spaces do |t|
+      # t.index [:group_id, :space_id]
+      # t.index [:space_id, :group_id]
+    end


+class AddIsPrivateToSpaces < ActiveRecord::Migration[7.2]
+  def change
+    add_column :spaces, :is_private, :boolean
+  end
+end


        meta: {
-            facets: facets,
-            available_facets: available_facets,
-            query: @search_params,
-            results_count: total
+          facets: facets,
+          :'available-facets' => available_facets,
+          query: @search_params,
+          :'results-count' => total
        }


kennethrioja · 2026-07-23T09:50:37Z

I just ran the whole test suite on this branch, it works locally.......

Maybe tests fail because of the gem audit failing as well?

fbacall · 2026-07-24T15:31:49Z

I just ran the whole test suite on this branch, it works locally.......

Maybe tests fail because of the gem audit failing as well?

The audit failures can be ignored, the capybara tests possibly are an issue, but I notice that the screenshots that were produced are not accessible in any way. I'm looking into this: https://bibwild.wordpress.com/2024/12/05/accessing-capybara-screenshot-artifacts-on-github-ci/

Valentin Ryckaert and others added 30 commits June 12, 2026 09:01

feat: adding database tables + scaffold for groups

1c8b62a

feat: add policy to group controller

0f72a0b

fix: fix incorrect names

6d7071c

fix: remove old policy file

11d3d95

feat: can add user to groups on group edit page

d9f6734

feat: can add groups to a space in space form

7b4899c

feat: add checkig perms for private spaces (TO TEST)

ea5e26d

feat: add groups checking before setting current_space

0fb001d

feat: remove unrelevant condition + add explaination

a66bcdc

feat: GroupPolicy extends RessourcePolicy

1cb4f05

feat: only members of a space can access to a material and only from …

d770ffb

…the private space

feat: same thing for events

1f33205

Merge branch 'ElixirTeSS:master' into private-spaces

710c8f7

fix: correct code to access material only in the space

21385b8

Merge branch 'private-spaces' of github.com:valentinRyckaert/TeSS-pri…

d2b29dd

…vate-spaces into private-spaces

feat: dont show private material/events on main space even with the t…

ebbac18

…oogle for viewing all materials

feat: add is_private column to space

cd77d5c

feat: if the space is not private, show its ressources in default spa…

7ed0371

…ce (and all the others)

feat: centralize shown? function and link space show policy to it

383a26d

fix: add specific shown check for spaces list to see private spaces t…

3ba703f

…he user is part of from the main app

feat: add is_private and group selection input to space form

6618e5c

fix: add check in shown? to make private spaces accessible to authori…

28d29e9

…zed users in main app

feat: add multiple owners to the database for groups

95f439b

update: improve policy for group creation

c80f4ad

update: updqte policy for groups

30e1f3a

fix: cleanly add js script for private groups in space form

e944ddf

fix: minor improvement for private groups in space form

8f501ec

fix: refuse access to space list if user not logged

a60c709

feat: user needs to be in at least one of the required groups to acce…

321b414

…ss a space

fix: update migration to avoid errors

8003739

Valentin Ryckaert and others added 22 commits June 23, 2026 15:20

feat: add tests

2586fa0

update: user can access to public spaces without being logged

897c4ce

fix: only admin can create and destroy space

35f6c84

update: update tests

17b96ee

merge

744aa63

merge forgotten changes

4a7ed8b

fix: correct test

215e749

fix: fix a remaining problems

3aa7196

update: update group policy

588cfd1

feat: add redirection to main space (to test)

81e0afb

fix: make redirection working fine

69543a2

feat: admins can have access to all private spaces and cannot be adde…

d544078

…d to groups

feat: add explanation for private spaces

b99a571

feat: when removing a space, if the space is public, keep ressources

9479b78

feat: add visual list of available spaces for a group

dd01e60

feat: add logo for the views groups button

09f68f7

feat: check that groups ae added if the space is private

f5ffa03

docs: add dev docs for private spaces

50b1598

feat: add rdoc and documentation

11a14da

Merge branch 'master' into private-spaces-with-groups

85ecd0f

remove duplicate filed in spaces table in schema

f3d670a

fix: run migrations

58d8ee6

valentinRyckaert mentioned this pull request Jul 22, 2026

Adding groups documentation ElixirTeSS/docs#32

Open

fix: fix tests

b89f5b0

fbacall requested a review from Copilot July 22, 2026 16:07

Copilot started reviewing on behalf of fbacall July 22, 2026 16:07 View session

Copilot AI reviewed Jul 22, 2026

View reviewed changes

feat: add copilot suggestions

068a785

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Private spaces implementation#1339

Private spaces implementation#1339
valentinRyckaert wants to merge 92 commits into
ElixirTeSS:masterfrom
valentinRyckaert:private-spaces-with-groups

valentinRyckaert commented Jul 22, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

valentinRyckaert Jul 23, 2026 •

edited

Loading

Uh oh!

kennethrioja commented Jul 23, 2026 •

edited

Loading

Uh oh!

fbacall commented Jul 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

valentinRyckaert commented Jul 22, 2026

Summary of changes

Database

3 new tables

Changes in existing tables

Code

New group controller and policy

New MemberShip Model

Shown? in application policy

Spaces controller and policy updates

Solr search_index updates

Application controller updates

Space model update

Rdoc

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

valentinRyckaert Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kennethrioja commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fbacall commented Jul 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

valentinRyckaert Jul 23, 2026 •

edited

Loading

kennethrioja commented Jul 23, 2026 •

edited

Loading