Add policy call for lieux

betagouv · Jan 24, 2025 · 50a161d · 50a161d
1 parent 9371f3b
commit 50a161d
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 2 deletions.
diff --git a/app/policies/agent/rdv_plan_policy.rb b/app/policies/agent/rdv_plan_policy.rb
@@ -1,7 +1,7 @@
 class Agent::RdvPlanPolicy < ApplicationPolicy
   # TODO: ajouter des contraintes sur le lieu et le rdv_agent
   def create?
-    pundit_user == record.planning_agent
+    authorized_lieu && pundit_user == record.planning_agent
   end
   alias edit? create?
 
@@ -10,4 +10,12 @@ def resolve
       scope.where(planning_agent: pundit_user)
     end
   end
+
+  private
+
+  def authorized_lieu
+    return true unless record.lieu_id
+
+    Agent::LieuPolicy::Scope.new(pundit_user, Lieu.enabled).resolve.find_by(id: record.lieu_id).present?
+  end
 end
diff --git a/app/views/agents/rdv_plans/_modalites_field.html.slim b/app/views/agents/rdv_plans/_modalites_field.html.slim
@@ -5,7 +5,7 @@ fieldset[class="fr-fieldset" id="rdv_plan[modalite]" aria-labelledby="radio-rich
     | Comment souhaitez-vous faire le rendez-vous ?
 
   - if available_location_types.include?("public_office")
-    - lieux = Lieu.enabled.where(organisation_id: current_agent.organisations.select(:id))
+    - lieux = policy_scope(Lieu.enabled, policy_scope_class: Agent::LieuPolicy::Scope)
     - lieux.each do |lieu|
       .fr-fieldset__element
         .fr-radio-group.fr-radio-rich