From 02a230e4e443ab88383c4752b8e4b7521650ccb3 Mon Sep 17 00:00:00 2001
From: Pablo Brasero <pablo@pablobm.com>
Date: Fri, 12 Dec 2025 16:12:46 +0000
Subject: [PATCH] Test visibility

---
 app/views/users/show.html.erb                 |  2 +-
 .../users/heatmaps_controller_test.rb         | 20 ++++++
 test/controllers/users_controller_test.rb     | 69 +++++++++++++++++++
 3 files changed, 90 insertions(+), 1 deletion(-)

diff --git a/app/views/users/show.html.erb b/app/views/users/show.html.erb
index 8cd7757e6..74aea3e5d 100644
--- a/app/views/users/show.html.erb
+++ b/app/views/users/show.html.erb
@@ -300,7 +300,7 @@
 <% end %>
 <% if owned %>
   <div class="mt-2">
-    <%= link_to t(".edit_heatmap"), profile_heatmap_path, :class => "btn btn-sm w-100 btn-outline-primary" %>
+    <%= link_to t(".edit_heatmap"), profile_heatmap_path, :class => "btn btn-sm w-100 btn-outline-primary edit_heatmap_button" %>
   </div>
 <% end %>
 
diff --git a/test/controllers/users/heatmaps_controller_test.rb b/test/controllers/users/heatmaps_controller_test.rb
index ad0f8c371..772f1ea86 100644
--- a/test/controllers/users/heatmaps_controller_test.rb
+++ b/test/controllers/users/heatmaps_controller_test.rb
@@ -157,6 +157,26 @@ module Users
       assert_response :not_found
     end
 
+    def test_show_not_public
+      user = create(:user)
+      user.update(:public_heatmap => false)
+
+      get user_heatmap_path(user)
+      assert_response :not_found
+
+      session_for(create(:user))
+      get user_heatmap_path(user)
+      assert_response :not_found
+
+      session_for(create(:moderator_user))
+      get user_heatmap_path(user)
+      assert_response :not_found
+
+      session_for(create(:administrator_user))
+      get user_heatmap_path(user)
+      assert_response :not_found
+    end
+
     def test_show_rendering_of_user_with_no_changesets
       user_without_changesets = create(:user)
 
diff --git a/test/controllers/users_controller_test.rb b/test/controllers/users_controller_test.rb
index e1c0a8af9..f4e744b87 100644
--- a/test/controllers/users_controller_test.rb
+++ b/test/controllers/users_controller_test.rb
@@ -375,4 +375,73 @@ class UsersControllerTest < ActionDispatch::IntegrationTest
     assert_response :success
     assert_select ".profile-diary-card", 0
   end
+
+  def test_heatmap_visibility
+    edit_heatmap_button_selector = ".edit_heatmap_button"
+    heatmap_selector = ".heatmap_frame"
+    protagonist = create(:user)
+
+    # Testing unauthenticated user first
+
+    protagonist.update(:public_heatmap => true)
+    get user_path(protagonist)
+    assert_select heatmap_selector
+    refute_select edit_heatmap_button_selector
+
+    protagonist.update(:public_heatmap => false)
+    get user_path(protagonist)
+    refute_select heatmap_selector
+    refute_select edit_heatmap_button_selector
+
+    session_for(protagonist)
+
+    protagonist.update(:public_heatmap => true)
+    get user_path(protagonist)
+    assert_select heatmap_selector
+    assert_select edit_heatmap_button_selector
+
+    protagonist.update(:public_heatmap => false)
+    get user_path(protagonist)
+    refute_select heatmap_selector
+    assert_select edit_heatmap_button_selector
+
+    antagonist = create(:user)
+    session_for(antagonist)
+
+    protagonist.update(:public_heatmap => true)
+    get user_path(protagonist)
+    assert_select heatmap_selector
+    refute_select edit_heatmap_button_selector
+
+    protagonist.update(:public_heatmap => false)
+    get user_path(protagonist)
+    refute_select heatmap_selector
+    refute_select edit_heatmap_button_selector
+
+    moderator = create(:moderator_user)
+    session_for(moderator)
+
+    protagonist.update(:public_heatmap => true)
+    get user_path(protagonist)
+    assert_select heatmap_selector
+    refute_select edit_heatmap_button_selector
+
+    protagonist.update(:public_heatmap => false)
+    get user_path(protagonist)
+    refute_select heatmap_selector
+    refute_select edit_heatmap_button_selector
+
+    admin = create(:administrator_user)
+    session_for(admin)
+
+    protagonist.update(:public_heatmap => true)
+    get user_path(protagonist)
+    assert_select heatmap_selector
+    refute_select edit_heatmap_button_selector
+
+    protagonist.update(:public_heatmap => false)
+    get user_path(protagonist)
+    refute_select heatmap_selector
+    refute_select edit_heatmap_button_selector
+  end
 end
-- 
2.39.5