Make Contract.permitted_for(user) return only contracts that belong t…

…o provider

app/models/contract.rb

@@ -62,15 +62,15 @@ def self.issued_by(issuer, *ids)
     where.has { plan_id.in( scope ) }
   end
 
-  # FIXME: this probably shouldn't return `all`, it's dangerous if it is accidentally
-  # used as a separate scope, and not merged with other scopes that filters by account previously
   scope :permitted_for, ->(user) {
-    permitted_services_status = user.permitted_services_status
-    next none if permitted_services_status == :none
-
-    next all if permitted_services_status == :all
-
-    merge(permitted_services_status == :selected ? where(service_id: user.member_permission_service_ids) : {})
+    case user.permitted_services_status
+    when :none
+      none
+    when :all
+      merge(provided_by(user.account))
+    else
+      merge(where(service_id: user.member_permission_service_ids))
+    end
   }
 
   # Return contracts bought by given account.

test/unit/contract_test.rb

@@ -100,16 +100,28 @@ class ContractTest < ActiveSupport::TestCase
   end
 
   test '.permitted_for' do
-    cinstances = FactoryBot.create_list(:simple_cinstance, 2)
-    user = FactoryBot.build(:member)
+    provider = FactoryBot.create(:simple_provider)
+    service1 = FactoryBot.create(:simple_service, account: provider)
+    service2 = FactoryBot.create(:simple_service, account: provider)
+    cinstances1 = FactoryBot.create_list(:simple_cinstance, 2, plan: FactoryBot.create(:simple_application_plan, issuer: service1))
+    cinstances2 = FactoryBot.create_list(:simple_cinstance, 2, plan: FactoryBot.create(:simple_application_plan, issuer: service2))
+    another_provider = FactoryBot.create(:simple_provider)
+    another_service = FactoryBot.create(:simple_service, account: another_provider)
+    FactoryBot.create_list(:simple_cinstance, 2, plan: FactoryBot.create(:simple_application_plan, issuer: another_service))
 
-    user.stubs(permitted_services_status: :all)
-    permitted_contract_ids = Contract.permitted_for(user).pluck(:id)
-    cinstances.each { |contract| assert_includes(permitted_contract_ids, contract.id) }
+    user = FactoryBot.build(:member, account: provider)
 
-    user.stubs(permitted_services_status: :selected)
-    user.stubs(member_permission_service_ids: [cinstances.first.service_id])
-    assert_equal [cinstances.first.id], Contract.permitted_for(user).pluck(:id)
+    user.update(allowed_service_ids: nil, allowed_sections: ['plans'])
+    permitted_contract_ids = Cinstance.permitted_for(user).pluck(:id)
+    all_cinstances_of_provider = cinstances1.pluck(:id) + cinstances2.pluck(:id)
+
+    assert_same_elements all_cinstances_of_provider, permitted_contract_ids
+
+    user.update(allowed_service_ids: [service1.id])
+    assert_equal cinstances1.pluck(:id), Contract.permitted_for(user).pluck(:id)
+
+    user.update(allowed_service_ids: [])
+    assert_empty Contract.permitted_for(user)
   end
 
   test '#bill_for' do