From b60b2a342f8a1f2ea7cfa3475d8efb76a2a600a9 Mon Sep 17 00:00:00 2001
From: Bianca Nenciu <nbianca@users.noreply.github.com>
Date: Tue, 6 Aug 2019 13:28:22 +0300
Subject: [PATCH] FIX: Show membership requests link just for group owners.
 (#7543)

---
 app/controllers/groups_controller.rb          | 12 ++--------
 app/serializers/basic_post_serializer.rb      | 22 +++++++++++++++++-
 lib/topic_view.rb                             |  2 +-
 spec/requests/groups_controller_spec.rb       |  1 +
 .../serializers/basic_post_serializer_spec.rb | 23 +++++++++++++++++++
 5 files changed, 48 insertions(+), 12 deletions(-)

diff --git a/app/controllers/groups_controller.rb b/app/controllers/groups_controller.rb
index c1484c27ead..d1cad42677f 100644
--- a/app/controllers/groups_controller.rb
+++ b/app/controllers/groups_controller.rb
@@ -443,20 +443,12 @@ class GroupsController < ApplicationController
         .pluck("users.username")
     )
 
-    raw = <<~EOF
-      #{reason}
-
-      ---
-      <a href="#{Discourse.base_uri}/g/#{group.name}/requests">
-        #{I18n.t('groups.request_membership_pm.handle')}
-      </a>
-    EOF
-
     post = PostCreator.new(current_user,
       title: I18n.t('groups.request_membership_pm.title', group_name: group.name),
-      raw: raw,
+      raw: params[:reason],
       archetype: Archetype.private_message,
       target_usernames: usernames.join(','),
+      custom_fields: { requested_group_id: group.id },
       skip_validations: true
     ).create!
 
diff --git a/app/serializers/basic_post_serializer.rb b/app/serializers/basic_post_serializer.rb
index 564236878a4..9d57a1c6f1c 100644
--- a/app/serializers/basic_post_serializer.rb
+++ b/app/serializers/basic_post_serializer.rb
@@ -38,7 +38,27 @@ class BasicPostSerializer < ApplicationSerializer
         I18n.t('flagging.user_must_edit')
       end
     else
-      object.filter_quotes(@parent_post)
+      cooked = object.filter_quotes(@parent_post)
+
+      if scope&.user
+        group = Group
+          .joins('JOIN group_users ON groups.id = group_users.group_id')
+          .find_by(
+            id: object.custom_fields['requested_group_id'].to_i,
+            group_users: { user_id: scope.user.id, owner: true }
+          )
+
+        if group
+          cooked << <<~EOF
+            <hr />
+            <a href="#{Discourse.base_uri}/g/#{group.name}/requests">
+              #{I18n.t('groups.request_membership_pm.handle')}
+            </a>
+          EOF
+        end
+      end
+
+      cooked
     end
   end
 
diff --git a/lib/topic_view.rb b/lib/topic_view.rb
index 060eaf79ba7..c8ac58063cc 100644
--- a/lib/topic_view.rb
+++ b/lib/topic_view.rb
@@ -40,7 +40,7 @@ class TopicView
   end
 
   def self.default_post_custom_fields
-    @default_post_custom_fields ||= ["action_code_who", "notice_type", "notice_args"]
+    @default_post_custom_fields ||= ["action_code_who", "notice_type", "notice_args", "requested_group_id"]
   end
 
   def self.post_custom_fields_whitelisters
diff --git a/spec/requests/groups_controller_spec.rb b/spec/requests/groups_controller_spec.rb
index e24bad0c98d..002cd646efd 100644
--- a/spec/requests/groups_controller_spec.rb
+++ b/spec/requests/groups_controller_spec.rb
@@ -1351,6 +1351,7 @@ describe GroupsController do
       body = JSON.parse(response.body)
 
       expect(body['relative_url']).to eq(topic.relative_url)
+      expect(post.custom_fields['requested_group_id'].to_i).to eq(group.id)
       expect(post.user).to eq(user)
 
       expect(topic.title).to eq(I18n.t('groups.request_membership_pm.title',
diff --git a/spec/serializers/basic_post_serializer_spec.rb b/spec/serializers/basic_post_serializer_spec.rb
index 660bd3b295f..faad10498a4 100644
--- a/spec/serializers/basic_post_serializer_spec.rb
+++ b/spec/serializers/basic_post_serializer_spec.rb
@@ -24,4 +24,27 @@ describe BasicPostSerializer do
 
   end
 
+  context "cooked" do
+    it "includes membership requests" do
+      user = Fabricate(:user)
+      member = Fabricate(:user)
+      owner = Fabricate(:user)
+
+      group = Fabricate(:group)
+      group.add(member)
+      group.add_owner(owner)
+
+      post = Fabricate(:post, custom_fields: { requested_group_id: group.id })
+
+      json = BasicPostSerializer.new(post, scope: Guardian.new(user), root: false).as_json
+      expect(json[:cooked]).not_to include(I18n.t('groups.request_membership_pm.handle'))
+
+      json = BasicPostSerializer.new(post, scope: Guardian.new(member), root: false).as_json
+      expect(json[:cooked]).not_to include(I18n.t('groups.request_membership_pm.handle'))
+
+      json = BasicPostSerializer.new(post, scope: Guardian.new(owner), root: false).as_json
+      expect(json[:cooked]).to include(I18n.t('groups.request_membership_pm.handle'))
+    end
+  end
+
 end