Selectively allow unpublishing of historical editions [WHIT-3402]

app/models/user.rb

@@ -23,6 +23,7 @@ module Permissions
     PUBLISH_SCHEDULED_EDITIONS = "Publish scheduled editions".freeze
     GDS_ADMIN = "GDS Admin".freeze
     SIDEKIQ_ADMIN = "Sidekiq Admin".freeze
+    UNPUBLISH_HISTORIC_CONTENT = "Unpublish historic content".freeze
   end
 
   def role
@@ -81,4 +82,8 @@ def organisation_content_id
   end
 
   attr_writer :organisation_content_id
+
+  def can_unpublish_historic_content?
+    has_permission?(Permissions::UNPUBLISH_HISTORIC_CONTENT)
+  end
 end

lib/whitehall/authority/rules/edition_rules.rb

@@ -88,8 +88,16 @@ def can_with_an_instance?(action)
 
     def can_with_a_historic_instance?(action)
       return false if access_limit_enforced?
+      return true if actor.gds_admin? || actor.gds_editor?
 
-      action == :see || actor.gds_editor? || actor.gds_admin?
+      case action
+      when :see
+        true
+      when :unpublish
+        actor.can_unpublish_historic_content?
+      else
+        false
+      end
     end
 
     def access_limit_enforced?

test/factories/users.rb

@@ -72,4 +72,12 @@
       ]
     end
   end
+
+  factory :historical_unpublisher, parent: :user do
+    permissions do
+      [
+        User::Permissions::UNPUBLISH_HISTORIC_CONTENT,
+      ]
+    end
+  end
 end

test/unit/lib/whitehall/authority/historical_unpublisher_test.rb

@@ -0,0 +1,24 @@
+require_relative "authority_test_helper"
+
+class HistoricalUnpublisherTest < ActiveSupport::TestCase
+  include AuthorityTestHelper
+
+  setup do
+    @user = create(:historical_unpublisher)
+  end
+
+  test "can see an historical document" do
+    assert enforcer_for(@user, historic_edition).can?(:see)
+  end
+
+  test "can unpublish an historical document" do
+    assert enforcer_for(@user, historic_edition).can?(:unpublish)
+  end
+
+  test "can't perform any other action on an historical document" do
+    denied_actions = Whitehall::Authority::Rules::EditionRules.actions - %i[see unpublish]
+    denied_actions.each do |action|
+      assert_not enforcer_for(@user, historic_edition).can?(action)
+    end
+  end
+end