Case log index page only shows your organisations case logs

app/controllers/case_logs_controller.rb

@@ -4,8 +4,8 @@ class CaseLogsController < ApplicationController
   before_action :authenticate_user!, unless: :json_api_request?
 
   def index
-    @completed_case_logs = CaseLog.completed
-    @in_progress_case_logs = CaseLog.not_completed
+    @completed_case_logs = current_user.completed_case_logs
+    @in_progress_case_logs = current_user.not_completed_case_logs
   end
 
   def create

spec/requests/case_log_controller_spec.rb

@@ -113,6 +113,40 @@ RSpec.describe CaseLogsController, type: :request do
   end
 
   describe "GET" do
+    context "collection" do
+      let(:user) { FactoryBot.create(:user) }
+      let(:organisation) { user.organisation }
+      let(:other_organisation) { FactoryBot.create(:organisation) }
+      let!(:case_log) do
+        FactoryBot.create(
+          :case_log,
+          owning_organisation: organisation,
+          managing_organisation: organisation,
+        )
+      end
+      let!(:unauthorized_case_log) do
+        FactoryBot.create(
+          :case_log,
+          owning_organisation: other_organisation,
+          managing_organisation: other_organisation,
+        )
+      end
+      let(:headers) { { "Accept" => "text/html" } }
+
+      before do
+        sign_in user
+        get "/case_logs", headers: headers, params: {}
+      end
+
+      it "only shows case logs for your organisation" do
+        expected_case_row_log = "<a class=\"govuk-link\" href=\"/case_logs/#{case_log.id}\">#{case_log.id}</a>"
+        unauthorized_case_row_log = "<a class=\"govuk-link\" href=\"/case_logs/#{unauthorized_case_log.id}\">#{unauthorized_case_log.id}</a>"
+        expect(CGI.unescape_html(response.body)).to include(expected_case_row_log)
+        expect(CGI.unescape_html(response.body)).not_to include(unauthorized_case_row_log)
+      end
+    end
+
+    context "member" do
       let(:case_log) { FactoryBot.create(:case_log, :completed) }
       let(:id) { case_log.id }
 
@@ -137,6 +171,7 @@ RSpec.describe CaseLogsController, type: :request do
         end
       end
     end
+  end
 
   describe "PATCH" do
     let(:case_log) do

spec/support/controller_macros.rb

@@ -1,11 +1,4 @@
 module ControllerMacros
-  # def login_admin
-  #   before(:each) do
-  #     @request.env["devise.mapping"] = Devise.mappings[:admin]
-  #     sign_in FactoryBot.create(:admin) # Using factory bot as an example
-  #   end
-  # end
-
   def login_user
     before(:each) do
       @request.env["devise.mapping"] = Devise.mappings[:user]