上映会改修 (#302) (#357)

Reviewed-on: #357
Co-authored-by: miteruzo <miteruzo@naver.com>
Co-committed-by: miteruzo <miteruzo@naver.com>

backend/spec/requests/theatre_comments_spec.rb

@@ -80,6 +80,26 @@ RSpec.describe 'TheatreComments', type: :request do
       expect(response).to have_http_status(:ok)
       expect(response.parsed_body.map { |row| row['no'] }).to eq([3, 2, 1])
     end
+
+    it '削除済みコメントは deleted として返し、本文を隠す' do
+      comment_2.discard!
+
+      get "/theatres/#{theatre.id}/comments", params: { no_gt: 1 }
+
+      expect(response).to have_http_status(:ok)
+
+      deleted_comment = response.parsed_body.find { _1['no'] == 2 }
+      expect(deleted_comment).to include(
+        'deleted' => true,
+        'content' => nil
+      )
+
+      visible_comment = response.parsed_body.find { _1['no'] == 3 }
+      expect(visible_comment).to include(
+        'deleted' => false,
+        'content' => 'third comment'
+      )
+    end
   end
 
   describe 'POST /theatres/:theatre_id/comments' do
@@ -147,4 +167,44 @@ RSpec.describe 'TheatreComments', type: :request do
       })
     end
   end
+
+  describe 'DELETE /theatres/:theatre_id/comments/:id' do
+    let(:theatre) { create(:theatre) }
+    let(:alice) { create(:user, name: 'Alice') }
+    let(:bob) { create(:user, name: 'Bob') }
+    let!(:comment) do
+      create(
+        :theatre_comment,
+        theatre: theatre,
+        no: 1,
+        user: alice,
+        content: 'delete target'
+      )
+    end
+
+    it 'returns 401 when not logged in' do
+      delete "/theatres/#{theatre.id}/comments/#{comment.no}"
+
+      expect(response).to have_http_status(:unauthorized)
+      expect(comment.reload.discarded?).to eq(false)
+    end
+
+    it 'allows the comment owner to delete it' do
+      sign_in_as(alice)
+
+      delete "/theatres/#{theatre.id}/comments/#{comment.no}"
+
+      expect(response).to have_http_status(:no_content)
+      expect(comment.reload.discarded?).to eq(true)
+    end
+
+    it 'returns 403 when another user tries to delete it' do
+      sign_in_as(bob)
+
+      delete "/theatres/#{theatre.id}/comments/#{comment.no}"
+
+      expect(response).to have_http_status(:forbidden)
+      expect(comment.reload.discarded?).to eq(false)
+    end
+  end
 end