From 0abe4ad4b2dcd26a874e2d25baec75d61a0d2f64 Mon Sep 17 00:00:00 2001
From: Brian Austin <brianjaustin@gmail.com>
Date: Thu, 3 Oct 2024 21:22:17 -0400
Subject: [PATCH 1/8] AO3-6761 Check admin roles in TagWranglingsController

---
 app/controllers/tag_wranglings_controller.rb  |   7 +-
 app/policies/wrangling_policy.rb              |   5 +
 .../tag_wranglings_controller_spec.rb         | 122 +++++++++++++++---
 3 files changed, 115 insertions(+), 19 deletions(-)

diff --git a/app/controllers/tag_wranglings_controller.rb b/app/controllers/tag_wranglings_controller.rb
index 8bbd2dd6830..a5ce64a1ef8 100644
--- a/app/controllers/tag_wranglings_controller.rb
+++ b/app/controllers/tag_wranglings_controller.rb
@@ -8,7 +8,10 @@ class TagWranglingsController < ApplicationController
 
   def index
     @counts = tag_counts_per_category
-    unless params[:show].blank?
+    if params[:show].blank?
+      authorize :wrangling, :full_access? if logged_in_as_admin?
+    else
+      authorize :wrangling, :read_access? if logged_in_as_admin?
       raise "Redshirt: Attempted to constantize invalid class initialize tag_wranglings_controller_index #{params[:show].classify}" unless Tag::USER_DEFINED.include?(params[:show].classify)
 
       params[:sort_column] = 'created_at' if !valid_sort_column(params[:sort_column], 'tag')
@@ -34,6 +37,8 @@ def index
   end
 
   def wrangle
+    authorize :wrangling, :full_access? if logged_in_as_admin?
+
     params[:page] = '1' if params[:page].blank?
     params[:sort_column] = 'name' if !valid_sort_column(params[:sort_column], 'tag')
     params[:sort_direction] = 'ASC' if !valid_sort_direction(params[:sort_direction])
diff --git a/app/policies/wrangling_policy.rb b/app/policies/wrangling_policy.rb
index 40acf51c97a..8503b51176c 100644
--- a/app/policies/wrangling_policy.rb
+++ b/app/policies/wrangling_policy.rb
@@ -2,11 +2,16 @@
 
 class WranglingPolicy < ApplicationPolicy
   FULL_ACCESS_ROLES = %w[superadmin tag_wrangling].freeze
+  READ_ACCESS_ROLES = (FULL_ACCESS_ROLES + %w[policy_and_abuse]).freeze
 
   def full_access?
     user_has_roles?(FULL_ACCESS_ROLES)
   end
 
+  def read_access?
+    user_has_roles?(READ_ACCESS_ROLES)
+  end
+
   alias create? full_access?
   alias destroy? full_access?
   alias show? full_access?
diff --git a/spec/controllers/tag_wranglings_controller_spec.rb b/spec/controllers/tag_wranglings_controller_spec.rb
index 26d24190301..6e47b94c1a1 100644
--- a/spec/controllers/tag_wranglings_controller_spec.rb
+++ b/spec/controllers/tag_wranglings_controller_spec.rb
@@ -4,60 +4,146 @@
   include LoginMacros
   include RedirectExpectationHelper
 
-  before do
-    fake_login
-    controller.current_user.roles << Role.new(name: "tag_wrangler")
+  full_access_roles = %w[superadmin tag_wrangling].freeze
+  read_access_roles = %w[superadmin policy_and_abuse tag_wrangling].freeze
+
+  shared_examples "an action only authorized admins can access" do |authorized_roles:|
+    before do
+      fake_login_admin(admin)
+      subject
+    end
+
+    context "when logged in as an admin with no role" do
+      let(:admin) { create(:admin) }
+
+      it "redirects with an error" do
+        it_redirects_to_with_error(root_url, "Sorry, only an authorized admin can access the page you were trying to reach.")
+      end
+    end
+
+    (Admin::VALID_ROLES - authorized_roles).each do |admin_role|
+      context "when logged in as an admin with role #{admin_role}" do
+        let(:admin) { create(:admin, roles: [admin_role]) }
+
+        it "redirects with an error" do
+          it_redirects_to_with_error(root_url, "Sorry, only an authorized admin can access the page you were trying to reach.")
+        end
+      end
+    end
+
+    authorized_roles.each do |admin_role|
+      context "when logged in as an admin with role #{admin_role}" do
+        let(:admin) { create(:admin, roles: [admin_role]) }
+
+        it "succeeds" do
+          success
+        end
+      end
+    end
   end
 
-  shared_examples "set last wrangling activity" do
-    it "sets the last wrangling activity time to now", :frozen do
-      user = controller.current_user
-      expect(user.last_wrangling_activity.updated_at).to eq(Time.now.utc)
+  describe "GET #index" do
+    let(:success) { expect(response).to have_http_status(:success) }
+
+    context "when the show parameter is absent" do
+      subject { get :index }
+
+      it_behaves_like "an action only authorized admins can access", authorized_roles: full_access_roles
+
+      context "when logged in as a tag wrangler" do
+        before do
+          fake_login_known_user(create(:tag_wrangler))
+        end
+
+        it "shows the wrangling tools page" do
+          subject
+          success
+        end
+      end
+    end
+
+    context "when the show parameter is present" do
+      subject { get :index, params: { show: "fandoms" } }
+
+      it_behaves_like "an action only authorized admins can access", authorized_roles: read_access_roles
+
+      context "when logged in as a tag wrangler" do
+        before do
+          fake_login_known_user(create(:tag_wrangler))
+        end
+
+        it "shows the wrangling tools page" do
+          subject
+          success
+        end
+      end
     end
   end
 
-  describe "#wrangle" do
-    let(:page_options) { { page: 1, sort_column: "name", sort_direction: "ASC" } }
+  describe "POST #wrangle" do
+    shared_examples "set last wrangling activity" do
+      before do
+        fake_login_known_user(create(:tag_wrangler))
+        subject
+      end
+
+      it "sets the last wrangling activity time to now", :frozen do
+        user = controller.current_user
+        expect(user.last_wrangling_activity.updated_at).to eq(Time.now.utc)
+      end
+    end
 
     it "displays error when there are no fandoms to wrangle to" do
+      fake_login_known_user(create(:tag_wrangler))
       character = create(:character)
+      page_options = { page: 1, sort_column: "name", sort_direction: "ASC" }
       post :wrangle, params: { fandom_string: "", selected_tags: [character.id] }
       it_redirects_to_with_error(tag_wranglings_path(page_options), "There were no Fandom tags!")
     end
 
     context "when making tags canonical" do
+      subject { post :wrangle, params: { canonicals: [tag1.id, tag2.id] } }
       let(:tag1) { create(:character) }
       let(:tag2) { create(:character) }
+      let(:success) do
+        expect(tag1.reload.canonical?).to be(true)
+        expect(tag2.reload.canonical?).to be(true)
+      end
 
       before do
         post :wrangle, params: { canonicals: [tag1.id, tag2.id] }
       end
 
-      include_examples "set last wrangling activity"
+      it_behaves_like "set last wrangling activity"
+      it_behaves_like "an action only authorized admins can access", authorized_roles: full_access_roles
     end
 
     context "when assigning tags to a medium" do
+      subject { post :wrangle, params: { media: medium.name, selected_tags: [fandom1.id, fandom2.id] } }
       let(:fandom1) { create(:fandom, canonical: true) }
       let(:fandom2) { create(:fandom, canonical: true) }
       let(:medium) { create(:media) }
-
-      before do
-        post :wrangle, params: { media: medium.name, selected_tags: [fandom1.id, fandom2.id] }
+      let(:success) do
+        expect(fandom1.medias).to include(medium)
+        expect(fandom2.medias).to include(medium)
       end
 
-      include_examples "set last wrangling activity"
+      it_behaves_like "set last wrangling activity"
+      it_behaves_like "an action only authorized admins can access", authorized_roles: full_access_roles
     end
 
     context "when adding tags to a fandom" do
+      subject { post :wrangle, params: { fandom_string: fandom.name, selected_tags: [tag1.id, tag2.id] } }
       let(:tag1) { create(:character) }
       let(:tag2) { create(:character) }
       let(:fandom) { create(:fandom, canonical: true) }
-
-      before do
-        post :wrangle, params: { fandom_string: fandom.name, selected_tags: [tag1.id, tag2.id] }
+      let(:success) do
+        expect(tag1.fandoms).to include(fandom)
+        expect(tag2.fandoms).to include(fandom)
       end
 
-      include_examples "set last wrangling activity"
+      it_behaves_like "set last wrangling activity"
+      it_behaves_like "an action only authorized admins can access", authorized_roles: full_access_roles
     end
   end
 end

From 24af2f1d791843fc134241371af6946769778fb8 Mon Sep 17 00:00:00 2001
From: Brian Austin <brianjaustin@gmail.com>
Date: Thu, 3 Oct 2024 21:39:54 -0400
Subject: [PATCH 2/8] Test foutje oplossen

---
 features/tags_and_wrangling/tag_wrangling_relationships.feature | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/features/tags_and_wrangling/tag_wrangling_relationships.feature b/features/tags_and_wrangling/tag_wrangling_relationships.feature
index 5c49e38dabd..49e8fcefb46 100644
--- a/features/tags_and_wrangling/tag_wrangling_relationships.feature
+++ b/features/tags_and_wrangling/tag_wrangling_relationships.feature
@@ -14,7 +14,7 @@ Scenario: relationship wrangling - syns, mergers, characters, autocompletes
     And a canonical character "Zoe Washburne"
     And a canonical character "Jack Harkness"
     And a canonical character "Ianto Jones"
-    And I am logged in as an admin
+    And I am logged in as a "tag_wrangling" admin
     And I follow "Tag Wrangling"
 
   # create a new canonical relationship from tag wrangling interface

From b93aaab67173a1b015284a6ffebefe237a6020ca Mon Sep 17 00:00:00 2001
From: Brian Austin <brianjaustin@gmail.com>
Date: Tue, 15 Oct 2024 14:26:29 +0000
Subject: [PATCH 3/8] Fix sidebar nav highlighting

---
 app/views/tag_wranglings/_wrangler_dashboard.html.erb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/views/tag_wranglings/_wrangler_dashboard.html.erb b/app/views/tag_wranglings/_wrangler_dashboard.html.erb
index 52610712eed..2271ab5d410 100644
--- a/app/views/tag_wranglings/_wrangler_dashboard.html.erb
+++ b/app/views/tag_wranglings/_wrangler_dashboard.html.erb
@@ -3,7 +3,7 @@
     <% if current_user.is_a?(User) %>
       <li><%= span_if_current(ts('Wrangling Home'), tag_wrangler_path(current_user)) %></li>
     <% end %>
-    <li><%= span_if_current(ts('Wrangling Tools'), tag_wranglings_path) %></li>
+    <li><%= span_if_current(ts('Wrangling Tools'), tag_wranglings_path, current_page?(tag_wranglings_path) && params[:show].blank?) %></li>
     <li><%= span_if_current(ts('Wranglers'), tag_wranglers_path) %></li>
     <li><%= span_if_current(ts('Search Tags'), search_tags_path) %></li>
     <li><%= span_if_current(ts('New Tag'), new_tag_path) %></li>

From ccf45cd6027df3db85c6d8ea577206b6bc16ccdc Mon Sep 17 00:00:00 2001
From: Brian Austin <brianjaustin@gmail.com>
Date: Tue, 15 Oct 2024 15:01:18 +0000
Subject: [PATCH 4/8] Hide menu items per epic (last PR)

---
 app/views/admin/_header.html.erb              |  5 +-
 .../_wrangler_dashboard.html.erb              | 74 ++++++++++---------
 .../tag_wrangling_admin.feature               | 39 ++++++++++
 3 files changed, 81 insertions(+), 37 deletions(-)

diff --git a/app/views/admin/_header.html.erb b/app/views/admin/_header.html.erb
index 419db932728..4a7d7d8d26a 100644
--- a/app/views/admin/_header.html.erb
+++ b/app/views/admin/_header.html.erb
@@ -58,8 +58,9 @@
         </ul>
       </li>
     <% end %>
-    <li><%= link_to t(".nav.wrangling"), tag_wranglings_path %></li>
-  
+    <% if policy(:wrangling).read_access? %>
+      <li><%= link_to t(".nav.wrangling"), tag_wranglings_path %></li>
+    <% end %>
     <% if policy(Locale).index? %>
       <li><%= link_to t(".nav.locales"), locales_path %></li>
     <% end %>
diff --git a/app/views/tag_wranglings/_wrangler_dashboard.html.erb b/app/views/tag_wranglings/_wrangler_dashboard.html.erb
index 2271ab5d410..57290d412c7 100644
--- a/app/views/tag_wranglings/_wrangler_dashboard.html.erb
+++ b/app/views/tag_wranglings/_wrangler_dashboard.html.erb
@@ -1,39 +1,43 @@
-<div id="dashboard" role="navigation region" class="tag wrangling region">
-  <ul class="navigation actions">
-    <% if current_user.is_a?(User) %>
-      <li><%= span_if_current(ts('Wrangling Home'), tag_wrangler_path(current_user)) %></li>
+<% if (logged_in_as_admin? && policy(:wrangling).full_access?) || current_user.try(:is_tag_wrangler?) || @counts %>
+  <div id="dashboard" role="navigation region" class="tag wrangling region">
+    <% if (logged_in_as_admin? && policy(:wrangling).full_access?) || current_user.try(:is_tag_wrangler?) %>
+      <ul class="navigation actions">
+        <% if current_user.is_a?(User) %>
+          <li><%= span_if_current(ts('Wrangling Home'), tag_wrangler_path(current_user)) %></li>
+        <% end %>
+        <li><%= span_if_current(ts('Wrangling Tools'), tag_wranglings_path, current_page?(tag_wranglings_path) && params[:show].blank?) %></li>
+        <li><%= span_if_current(ts('Wranglers'), tag_wranglers_path) %></li>
+        <li><%= span_if_current(ts('Search Tags'), search_tags_path) %></li>
+        <li><%= span_if_current(ts('New Tag'), new_tag_path) %></li>
+      </ul>
     <% end %>
-    <li><%= span_if_current(ts('Wrangling Tools'), tag_wranglings_path, current_page?(tag_wranglings_path) && params[:show].blank?) %></li>
-    <li><%= span_if_current(ts('Wranglers'), tag_wranglers_path) %></li>
-    <li><%= span_if_current(ts('Search Tags'), search_tags_path) %></li>
-    <li><%= span_if_current(ts('New Tag'), new_tag_path) %></li>
-  </ul>
 
-  <% if @counts %>
-    <ul class="navigation actions">
-      <% if @tag && @uses %>
-        <% @uses.each do |key| %>
-          <% if key == 'Works' || key == 'Bookmarks' %>
-            <li><%= span_if_current "#{key} (#{@counts[key]})", { controller: key.downcase.to_sym, action: :index, tag_id: @tag } %></li>
-          <% elsif key == 'External Works' %>
-            <li><%= span_if_current "#{key} (#{@counts[key]})", { controller: :bookmarks, action: :index, tag_id: @tag } %></li>
-          <% else %>
-            <li><span><%= "#{key} (#{@counts[key]})" %></span></li>
+    <% if @counts %>
+      <ul class="navigation actions">
+        <% if @tag && @uses %>
+          <% @uses.each do |key| %>
+            <% if key == 'Works' || key == 'Bookmarks' %>
+              <li><%= span_if_current "#{key} (#{@counts[key]})", { controller: key.downcase.to_sym, action: :index, tag_id: @tag } %></li>
+            <% elsif key == 'External Works' %>
+              <li><%= span_if_current "#{key} (#{@counts[key]})", { controller: :bookmarks, action: :index, tag_id: @tag } %></li>
+            <% else %>
+              <li><span><%= "#{key} (#{@counts[key]})" %></span></li>
+            <% end %>
           <% end %>
+        <% elsif @tag && @tag.child_types %>
+          <% @tag.child_types.each do |tag_type| %>
+            <li>
+              <%= span_if_current tag_type.pluralize + " (#{@counts[tag_type.underscore.pluralize.to_sym]})", url_for(show: tag_type.underscore.pluralize, id: @tag) %>
+            </li>
+          <% end %>
+        <% else %>
+          <li><%= span_if_current ts("Fandoms by media (%{count})", count: @counts[:fandoms]), tag_wranglings_path(show: "fandoms") %></li>
+          <li><%= span_if_current ts("Characters by fandom (%{count})", count: @counts[:characters]), tag_wranglings_path(show: "characters") %></li>
+          <li><%= span_if_current ts("Relationships by fandom (%{count})", count: @counts[:relationships]), tag_wranglings_path(show: "relationships") %></li>
+          <li><%= span_if_current ts("Freeforms by fandom (%{count})", count: @counts[:freeforms]), tag_wranglings_path(show: "freeforms") %></li>
+          <li><%= span_if_current(ts("Unsorted Tags (%{count})", count: @counts[:UnsortedTag]), unsorted_tags_path) %></li>
         <% end %>
-      <% elsif @tag && @tag.child_types %>
-        <% @tag.child_types.each do |tag_type| %>
-          <li>
-            <%= span_if_current tag_type.pluralize + " (#{@counts[tag_type.underscore.pluralize.to_sym]})", url_for(show: tag_type.underscore.pluralize, id: @tag) %>
-          </li>
-        <% end %>
-      <% else %>
-        <li><%= span_if_current ts("Fandoms by media (%{count})", count: @counts[:fandoms]), tag_wranglings_path(show: "fandoms") %></li>
-        <li><%= span_if_current ts("Characters by fandom (%{count})", count: @counts[:characters]), tag_wranglings_path(show: "characters") %></li>
-        <li><%= span_if_current ts("Relationships by fandom (%{count})", count: @counts[:relationships]), tag_wranglings_path(show: "relationships") %></li>
-        <li><%= span_if_current ts("Freeforms by fandom (%{count})", count: @counts[:freeforms]), tag_wranglings_path(show: "freeforms") %></li>
-        <li><%= span_if_current(ts("Unsorted Tags (%{count})", count: @counts[:UnsortedTag]), unsorted_tags_path) %></li>
-      <% end %>
-    </ul>
-  <% end %>
-</div>
+      </ul>
+    <% end %>
+  </div>
+<% end %>
diff --git a/features/tags_and_wrangling/tag_wrangling_admin.feature b/features/tags_and_wrangling/tag_wrangling_admin.feature
index 5d70da67b07..5582dd295c0 100644
--- a/features/tags_and_wrangling/tag_wrangling_admin.feature
+++ b/features/tags_and_wrangling/tag_wrangling_admin.feature
@@ -70,3 +70,42 @@ Feature: Tag wrangling
     Then I should see "Tags Wrangled (CSV)"
     When I follow "Tags Wrangled (CSV)"
     Then I should download a csv file with the header row "Name Last Updated Type Merger Fandoms Unwrangleable"
+
+  Scenario Outline: Authorized admins get the wrangling dashboard sidebar
+
+    Given I am logged in as a "<role>" admin
+    When I go to the wrangling tools page
+    Then I should see "Wrangling Tools" within "div#dashboard"
+      And I should see "Wranglers" within "div#dashboard"
+      And I should see "Search Tags" within "div#dashboard"
+      And I should see "New Tag" within "div#dashboard"
+      But I should not see "Wrangling Home" within "div#dashboard"
+
+    Examples:
+    | role          |
+    | superadmin    |
+    | tag_wrangling |
+
+  Scenario Outline: Unauthorized admins do not get the wrangling dashboard sidebar
+
+    Given I am logged in as a "<role>" admin
+    When I go to the wrangling tools page
+    Then I should not see "Wrangling Tools"
+      And I should not see "Wranglers"
+      And I should not see "Search Tags"
+      And I should not see "New Tag"
+      And I should not see "Wrangling Home"
+
+    Examples:
+    | role                       |
+    | board                      |
+    | board_assistants_team      |
+    | communications             |
+    | development_and_membership |
+    | docs                       |
+    | elections                  |
+    | legal                      |
+    | translation                |
+    | support                    |
+    | policy_and_abuse           |
+    | open_doors                 |

From ed9ff33cdc3829b07ba3aa4fff0d4b67a5d47750 Mon Sep 17 00:00:00 2001
From: Brian Austin <brianjaustin@gmail.com>
Date: Sun, 10 Nov 2024 16:08:57 +0100
Subject: [PATCH 5/8] Refactoring and i18n

---
 app/controllers/tag_wranglings_controller.rb  |  6 +--
 app/views/admin/_header.html.erb              |  4 +-
 .../_wrangler_dashboard.html.erb              | 49 ++++++++++++-------
 config/locales/views/en.yml                   | 28 +++++++++++
 .../tag_wranglings_controller_spec.rb         | 10 ++--
 5 files changed, 68 insertions(+), 29 deletions(-)

diff --git a/app/controllers/tag_wranglings_controller.rb b/app/controllers/tag_wranglings_controller.rb
index a5ce64a1ef8..416be9a99b8 100644
--- a/app/controllers/tag_wranglings_controller.rb
+++ b/app/controllers/tag_wranglings_controller.rb
@@ -8,10 +8,8 @@ class TagWranglingsController < ApplicationController
 
   def index
     @counts = tag_counts_per_category
-    if params[:show].blank?
-      authorize :wrangling, :full_access? if logged_in_as_admin?
-    else
-      authorize :wrangling, :read_access? if logged_in_as_admin?
+    authorize :wrangling, :read_access? if logged_in_as_admin?
+    if params[:show].present?
       raise "Redshirt: Attempted to constantize invalid class initialize tag_wranglings_controller_index #{params[:show].classify}" unless Tag::USER_DEFINED.include?(params[:show].classify)
 
       params[:sort_column] = 'created_at' if !valid_sort_column(params[:sort_column], 'tag')
diff --git a/app/views/admin/_header.html.erb b/app/views/admin/_header.html.erb
index 4a7d7d8d26a..babad836d21 100644
--- a/app/views/admin/_header.html.erb
+++ b/app/views/admin/_header.html.erb
@@ -35,7 +35,7 @@
     <% if policy(AdminBlacklistedEmail).index? %>
       <li><%= link_to t(".nav.banned_emails"), admin_blacklisted_emails_path %></li>
     <% end %>
-  
+
     <% if policy(ModeratedWork).index? %>
       <li><%= link_to t(".nav.spam"), admin_spam_index_path %></li>
     <% end %>
@@ -58,7 +58,7 @@
         </ul>
       </li>
     <% end %>
-    <% if policy(:wrangling).read_access? %>
+    <% if policy(:wrangling).full_access? %>
       <li><%= link_to t(".nav.wrangling"), tag_wranglings_path %></li>
     <% end %>
     <% if policy(Locale).index? %>
diff --git a/app/views/tag_wranglings/_wrangler_dashboard.html.erb b/app/views/tag_wranglings/_wrangler_dashboard.html.erb
index 57290d412c7..9efc5c906a1 100644
--- a/app/views/tag_wranglings/_wrangler_dashboard.html.erb
+++ b/app/views/tag_wranglings/_wrangler_dashboard.html.erb
@@ -1,14 +1,14 @@
 <% if (logged_in_as_admin? && policy(:wrangling).full_access?) || current_user.try(:is_tag_wrangler?) || @counts %>
   <div id="dashboard" role="navigation region" class="tag wrangling region">
-    <% if (logged_in_as_admin? && policy(:wrangling).full_access?) || current_user.try(:is_tag_wrangler?) %>
+    <% if (logged_in_as_admin? && policy(:wrangling).read_access?) || current_user.try(:is_tag_wrangler?) %>
       <ul class="navigation actions">
         <% if current_user.is_a?(User) %>
-          <li><%= span_if_current(ts('Wrangling Home'), tag_wrangler_path(current_user)) %></li>
+          <li><%= span_if_current(t(".wrangling_home"), tag_wrangler_path(current_user)) %></li>
         <% end %>
-        <li><%= span_if_current(ts('Wrangling Tools'), tag_wranglings_path, current_page?(tag_wranglings_path) && params[:show].blank?) %></li>
-        <li><%= span_if_current(ts('Wranglers'), tag_wranglers_path) %></li>
-        <li><%= span_if_current(ts('Search Tags'), search_tags_path) %></li>
-        <li><%= span_if_current(ts('New Tag'), new_tag_path) %></li>
+        <li><%= span_if_current(t(".wrangling_tools"), tag_wranglings_path, current_page?(tag_wranglings_path) && params[:show].blank?) %></li>
+        <li><%= span_if_current(t(".wranglers"), tag_wranglers_path) %></li>
+        <li><%= span_if_current(t(".search_tags"), search_tags_path) %></li>
+        <li><%= span_if_current(t(".new_tag"), new_tag_path) %></li>
       </ul>
     <% end %>
 
@@ -16,26 +16,41 @@
       <ul class="navigation actions">
         <% if @tag && @uses %>
           <% @uses.each do |key| %>
-            <% if key == 'Works' || key == 'Bookmarks' %>
-              <li><%= span_if_current "#{key} (#{@counts[key]})", { controller: key.downcase.to_sym, action: :index, tag_id: @tag } %></li>
-            <% elsif key == 'External Works' %>
-              <li><%= span_if_current "#{key} (#{@counts[key]})", { controller: :bookmarks, action: :index, tag_id: @tag } %></li>
+            <% if key == "Works" || key == "Bookmarks" %>
+              <li>
+              <%= span_if_current t(".use_type_and_count", use_type: t(".use_type.#{key.downcase}"), count: @counts[key]),
+                    { controller: key.downcase.to_sym, action: :index, tag_id: @tag } %>
+            </li>
+            <% elsif key == "External Works" %>
+              <li>
+              <%= span_if_current t(".use_type_and_count", use_type: t(".use_type.external_works"), count: @counts[key]),
+                    { controller: :bookmarks, action: :index, tag_id: @tag } %>
+            </li>
             <% else %>
-              <li><span><%= "#{key} (#{@counts[key]})" %></span></li>
+              <li>
+              <span>
+                <%= t(".use_type_and_count",
+                      use_type: t(".use_type.#{key.downcase.gsub(' ', '_')}"),
+                      count: @counts[key]) %>
+              </span>
+            </li>
             <% end %>
           <% end %>
         <% elsif @tag && @tag.child_types %>
           <% @tag.child_types.each do |tag_type| %>
             <li>
-              <%= span_if_current tag_type.pluralize + " (#{@counts[tag_type.underscore.pluralize.to_sym]})", url_for(show: tag_type.underscore.pluralize, id: @tag) %>
+              <%= span_if_current t(".tag_type_and_count",
+                    tag_type: t(".tag_type.#{tag_type.downcase.gsub(' ', '_')}"),
+                    count: @counts[tag_type.underscore.pluralize.to_sym]),
+                    url_for(show: tag_type.underscore.pluralize, id: @tag) %>
             </li>
           <% end %>
         <% else %>
-          <li><%= span_if_current ts("Fandoms by media (%{count})", count: @counts[:fandoms]), tag_wranglings_path(show: "fandoms") %></li>
-          <li><%= span_if_current ts("Characters by fandom (%{count})", count: @counts[:characters]), tag_wranglings_path(show: "characters") %></li>
-          <li><%= span_if_current ts("Relationships by fandom (%{count})", count: @counts[:relationships]), tag_wranglings_path(show: "relationships") %></li>
-          <li><%= span_if_current ts("Freeforms by fandom (%{count})", count: @counts[:freeforms]), tag_wranglings_path(show: "freeforms") %></li>
-          <li><%= span_if_current(ts("Unsorted Tags (%{count})", count: @counts[:UnsortedTag]), unsorted_tags_path) %></li>
+          <li><%= span_if_current t(".fandoms_by_media", count: @counts[:fandoms]), tag_wranglings_path(show: "fandoms") %></li>
+          <li><%= span_if_current t(".characters_by_fandom", count: @counts[:characters]), tag_wranglings_path(show: "characters") %></li>
+          <li><%= span_if_current t(".relationships_by_fandom", count: @counts[:relationships]), tag_wranglings_path(show: "relationships") %></li>
+          <li><%= span_if_current t(".freeforms_by_fandom", count: @counts[:freeforms]), tag_wranglings_path(show: "freeforms") %></li>
+          <li><%= span_if_current t(".unsorted_tags", count: @counts[:UnsortedTag]), unsorted_tags_path %></li>
         <% end %>
       </ul>
     <% end %>
diff --git a/config/locales/views/en.yml b/config/locales/views/en.yml
index e9be9398be9..66c843cc49e 100644
--- a/config/locales/views/en.yml
+++ b/config/locales/views/en.yml
@@ -875,6 +875,34 @@ en:
     show:
       last_wrangled_html: "%{wrangler_login} last wrangled at %{time}."
       tags_wrangled_csv: Tags Wrangled (CSV)
+  tag_wranglings:
+    wrangler_dashboard:
+      characters_by_fandom: Characters by fandom (%{count})
+      fandoms_by_media: Fandoms by media (%{count})
+      freeforms_by_fandom: Freeforms by fandom (%{count})
+      new_tag: New Tag
+      relationships_by_fandom: Relationships by fandom (%{count})
+      search_tags: Search Tags
+      tag_type:
+        character: Characters
+        fandom: Fandoms
+        freeform: Freeforms
+        merger: Mergers
+        relationship: Relationships
+        subtag: SubTags
+      tag_type_and_count: "%{tag_type} (%{count})"
+      unsorted_tags: Unsorted Tags (%{count})
+      use_type:
+        bookmarks: Bookmarks
+        drafts: Drafts
+        external_works: External Works
+        private_bookmarks: Private Bookmarks
+        taggings_count: Taggings Count
+        works: Works
+      use_type_and_count: "%{use_type} (%{count})"
+      wranglers: Wranglers
+      wrangling_home: Wrangling Home
+      wrangling_tools: Wrangling Tools
   tags:
     index:
       about:
diff --git a/spec/controllers/tag_wranglings_controller_spec.rb b/spec/controllers/tag_wranglings_controller_spec.rb
index 6e47b94c1a1..581a1772925 100644
--- a/spec/controllers/tag_wranglings_controller_spec.rb
+++ b/spec/controllers/tag_wranglings_controller_spec.rb
@@ -10,13 +10,13 @@
   shared_examples "an action only authorized admins can access" do |authorized_roles:|
     before do
       fake_login_admin(admin)
-      subject
     end
 
     context "when logged in as an admin with no role" do
       let(:admin) { create(:admin) }
 
       it "redirects with an error" do
+        subject
         it_redirects_to_with_error(root_url, "Sorry, only an authorized admin can access the page you were trying to reach.")
       end
     end
@@ -26,6 +26,7 @@
         let(:admin) { create(:admin, roles: [admin_role]) }
 
         it "redirects with an error" do
+          subject
           it_redirects_to_with_error(root_url, "Sorry, only an authorized admin can access the page you were trying to reach.")
         end
       end
@@ -36,6 +37,7 @@
         let(:admin) { create(:admin, roles: [admin_role]) }
 
         it "succeeds" do
+          subject
           success
         end
       end
@@ -48,7 +50,7 @@
     context "when the show parameter is absent" do
       subject { get :index }
 
-      it_behaves_like "an action only authorized admins can access", authorized_roles: full_access_roles
+      it_behaves_like "an action only authorized admins can access", authorized_roles: read_access_roles
 
       context "when logged in as a tag wrangler" do
         before do
@@ -110,10 +112,6 @@
         expect(tag2.reload.canonical?).to be(true)
       end
 
-      before do
-        post :wrangle, params: { canonicals: [tag1.id, tag2.id] }
-      end
-
       it_behaves_like "set last wrangling activity"
       it_behaves_like "an action only authorized admins can access", authorized_roles: full_access_roles
     end

From 1c74b2101ce680a5c72231e7f5c0b31b809e2989 Mon Sep 17 00:00:00 2001
From: Brian Austin <brianjaustin@gmail.com>
Date: Sun, 10 Nov 2024 16:16:37 +0100
Subject: [PATCH 6/8] Test for admin nav item visibility

---
 .../tag_wrangling_admin.feature               | 29 +++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/features/tags_and_wrangling/tag_wrangling_admin.feature b/features/tags_and_wrangling/tag_wrangling_admin.feature
index 5582dd295c0..0a265075378 100644
--- a/features/tags_and_wrangling/tag_wrangling_admin.feature
+++ b/features/tags_and_wrangling/tag_wrangling_admin.feature
@@ -71,6 +71,35 @@ Feature: Tag wrangling
     When I follow "Tags Wrangled (CSV)"
     Then I should download a csv file with the header row "Name Last Updated Type Merger Fandoms Unwrangleable"
 
+  Scenario Outline: Authorized admins have the tag wrangling item in the admin navbar
+
+    Given I am logged in as a "<role>" admin
+    Then I should see "Tag Wrangling" within "ul.admin.primary.navigation"
+
+    Examples:
+    | role          |
+    | superadmin    |
+    | tag_wrangling |
+
+  Scenario Outline: Unauthorized admins do not have the tag wrangling item in the admin navbar
+
+    Given I am logged in as a "<role>" admin
+    Then I should not see "Tag Wrangling" within "ul.admin.primary.navigation"
+
+    Examples:
+    | role                       |
+    | board                      |
+    | board_assistants_team      |
+    | communications             |
+    | development_and_membership |
+    | docs                       |
+    | elections                  |
+    | legal                      |
+    | translation                |
+    | support                    |
+    | policy_and_abuse           |
+    | open_doors                 |
+
   Scenario Outline: Authorized admins get the wrangling dashboard sidebar
 
     Given I am logged in as a "<role>" admin

From df8f61cd62cd26bacb7dee331aa82cb7b3ed37bf Mon Sep 17 00:00:00 2001
From: Brian Austin <brianjaustin@gmail.com>
Date: Sun, 10 Nov 2024 16:38:59 +0100
Subject: [PATCH 7/8] Improve wrangling navbar tests

---
 .../_wrangler_dashboard.html.erb              |  8 +++++--
 .../tag_wrangling_admin.feature               | 21 ++++++++++++++++---
 2 files changed, 24 insertions(+), 5 deletions(-)

diff --git a/app/views/tag_wranglings/_wrangler_dashboard.html.erb b/app/views/tag_wranglings/_wrangler_dashboard.html.erb
index 9efc5c906a1..03a4ec922aa 100644
--- a/app/views/tag_wranglings/_wrangler_dashboard.html.erb
+++ b/app/views/tag_wranglings/_wrangler_dashboard.html.erb
@@ -6,9 +6,13 @@
           <li><%= span_if_current(t(".wrangling_home"), tag_wrangler_path(current_user)) %></li>
         <% end %>
         <li><%= span_if_current(t(".wrangling_tools"), tag_wranglings_path, current_page?(tag_wranglings_path) && params[:show].blank?) %></li>
-        <li><%= span_if_current(t(".wranglers"), tag_wranglers_path) %></li>
+        <% if policy(:wrangling).full_access? || current_user.try(:is_tag_wrangler?) %>
+          <li><%= span_if_current(t(".wranglers"), tag_wranglers_path) %></li>
+        <% end %>
         <li><%= span_if_current(t(".search_tags"), search_tags_path) %></li>
-        <li><%= span_if_current(t(".new_tag"), new_tag_path) %></li>
+        <% if policy(:wrangling).full_access? || current_user.try(:is_tag_wrangler?) %>
+          <li><%= span_if_current(t(".new_tag"), new_tag_path) %></li>
+        <% end %>
       </ul>
     <% end %>
 
diff --git a/features/tags_and_wrangling/tag_wrangling_admin.feature b/features/tags_and_wrangling/tag_wrangling_admin.feature
index 0a265075378..ab2bc0272b0 100644
--- a/features/tags_and_wrangling/tag_wrangling_admin.feature
+++ b/features/tags_and_wrangling/tag_wrangling_admin.feature
@@ -100,7 +100,7 @@ Feature: Tag wrangling
     | policy_and_abuse           |
     | open_doors                 |
 
-  Scenario Outline: Authorized admins get the wrangling dashboard sidebar
+  Scenario Outline: Fully-authorized admins get the wrangling dashboard sidebar
 
     Given I am logged in as a "<role>" admin
     When I go to the wrangling tools page
@@ -115,10 +115,26 @@ Feature: Tag wrangling
     | superadmin    |
     | tag_wrangling |
 
-  Scenario Outline: Unauthorized admins do not get the wrangling dashboard sidebar
+  Scenario Outline: Read-authorized admins get a partial wrangling dashboard sidebar
 
     Given I am logged in as a "<role>" admin
     When I go to the wrangling tools page
+    Then I should see "Wrangling Tools" within "div#dashboard"
+      And I should see "Search Tags" within "div#dashboard"
+      But I should not see "Wranglers" within "div#dashboard"
+      And I should not see "New Tag" within "div#dashboard"
+      And I should not see "Wrangling Home" within "div#dashboard"
+
+    Examples:
+    | role             |
+    | policy_and_abuse |
+
+  Scenario Outline: Unauthorized admins do not get the wrangling dashboard sidebar
+
+    Given I am logged in as a "<role>" admin
+      And basic tags
+    # Other admins cannot view the wrangling tools page, so try from the tags index page.
+    When I go to the tags page
     Then I should not see "Wrangling Tools"
       And I should not see "Wranglers"
       And I should not see "Search Tags"
@@ -136,5 +152,4 @@ Feature: Tag wrangling
     | legal                      |
     | translation                |
     | support                    |
-    | policy_and_abuse           |
     | open_doors                 |

From 3b4a709f11eb3e852485f172e8206a5e684dbae4 Mon Sep 17 00:00:00 2001
From: Brian Austin <brianjaustin@gmail.com>
Date: Mon, 11 Nov 2024 18:12:10 +0100
Subject: [PATCH 8/8] Fix sidebar hiding, tests, and rubocop

---
 app/controllers/tag_wranglings_controller.rb  | 38 +++++++++----------
 .../_wrangler_dashboard.html.erb              |  2 +-
 config/locales/controllers/en.yml             |  3 ++
 .../tag_wrangling_admin.feature               |  7 ++--
 4 files changed, 27 insertions(+), 23 deletions(-)

diff --git a/app/controllers/tag_wranglings_controller.rb b/app/controllers/tag_wranglings_controller.rb
index 416be9a99b8..b3e1d7f48fc 100644
--- a/app/controllers/tag_wranglings_controller.rb
+++ b/app/controllers/tag_wranglings_controller.rb
@@ -9,29 +9,29 @@ class TagWranglingsController < ApplicationController
   def index
     @counts = tag_counts_per_category
     authorize :wrangling, :read_access? if logged_in_as_admin?
-    if params[:show].present?
-      raise "Redshirt: Attempted to constantize invalid class initialize tag_wranglings_controller_index #{params[:show].classify}" unless Tag::USER_DEFINED.include?(params[:show].classify)
+    return if params[:show].blank?
 
-      params[:sort_column] = 'created_at' if !valid_sort_column(params[:sort_column], 'tag')
-      params[:sort_direction] = 'ASC' if !valid_sort_direction(params[:sort_direction])
+    raise "Redshirt: Attempted to constantize invalid class initialize tag_wranglings_controller_index #{params[:show].classify}" unless Tag::USER_DEFINED.include?(params[:show].classify)
 
-      if params[:show] == "fandoms"
-        @media_names = Media.by_name.pluck(:name)
-        @page_subtitle = ts("fandoms")
-      end
+    params[:sort_column] = "created_at" unless valid_sort_column(params[:sort_column], "tag")
+    params[:sort_direction] = "ASC" unless valid_sort_direction(params[:sort_direction])
 
-      type = params[:show].singularize.capitalize
-      @tags = TagQuery.new({
-                             type: type,
-                             in_use: true,
-                             unwrangleable: false,
-                             unwrangled: true,
-                             sort_column: params[:sort_column],
-                             sort_direction: params[:sort_direction],
-                             page: params[:page],
-                             per_page: ArchiveConfig.ITEMS_PER_PAGE
-                           }).search_results
+    if params[:show] == "fandoms"
+      @media_names = Media.by_name.pluck(:name)
+      @page_subtitle = t(".page_subtitle")
     end
+
+    type = params[:show].singularize.capitalize
+    @tags = TagQuery.new({
+                           type: type,
+                           in_use: true,
+                           unwrangleable: false,
+                           unwrangled: true,
+                           sort_column: params[:sort_column],
+                           sort_direction: params[:sort_direction],
+                           page: params[:page],
+                           per_page: ArchiveConfig.ITEMS_PER_PAGE
+                         }).search_results
   end
 
   def wrangle
diff --git a/app/views/tag_wranglings/_wrangler_dashboard.html.erb b/app/views/tag_wranglings/_wrangler_dashboard.html.erb
index 03a4ec922aa..a1e0bcd38d7 100644
--- a/app/views/tag_wranglings/_wrangler_dashboard.html.erb
+++ b/app/views/tag_wranglings/_wrangler_dashboard.html.erb
@@ -1,4 +1,4 @@
-<% if (logged_in_as_admin? && policy(:wrangling).full_access?) || current_user.try(:is_tag_wrangler?) || @counts %>
+<% if (logged_in_as_admin? && policy(:wrangling).read_access?) || current_user.try(:is_tag_wrangler?) || @counts %>
   <div id="dashboard" role="navigation region" class="tag wrangling region">
     <% if (logged_in_as_admin? && policy(:wrangling).read_access?) || current_user.try(:is_tag_wrangler?) %>
       <ul class="navigation actions">
diff --git a/config/locales/controllers/en.yml b/config/locales/controllers/en.yml
index bc8d7c3a86c..3f5f4d0cb36 100644
--- a/config/locales/controllers/en.yml
+++ b/config/locales/controllers/en.yml
@@ -90,6 +90,9 @@ en:
         muted: You have muted the user %{name}.
       destroy:
         unmuted: You have unmuted the user %{name}.
+  tag_wranglings:
+    index:
+      page_subtitle: fandoms
   users:
     passwords:
       create:
diff --git a/features/tags_and_wrangling/tag_wrangling_admin.feature b/features/tags_and_wrangling/tag_wrangling_admin.feature
index ab2bc0272b0..3694f37b5ed 100644
--- a/features/tags_and_wrangling/tag_wrangling_admin.feature
+++ b/features/tags_and_wrangling/tag_wrangling_admin.feature
@@ -103,7 +103,8 @@ Feature: Tag wrangling
   Scenario Outline: Fully-authorized admins get the wrangling dashboard sidebar
 
     Given I am logged in as a "<role>" admin
-    When I go to the wrangling tools page
+      And basic tags
+    When I go to the tags page
     Then I should see "Wrangling Tools" within "div#dashboard"
       And I should see "Wranglers" within "div#dashboard"
       And I should see "Search Tags" within "div#dashboard"
@@ -118,7 +119,8 @@ Feature: Tag wrangling
   Scenario Outline: Read-authorized admins get a partial wrangling dashboard sidebar
 
     Given I am logged in as a "<role>" admin
-    When I go to the wrangling tools page
+      And basic tags
+    When I go to the tags page
     Then I should see "Wrangling Tools" within "div#dashboard"
       And I should see "Search Tags" within "div#dashboard"
       But I should not see "Wranglers" within "div#dashboard"
@@ -133,7 +135,6 @@ Feature: Tag wrangling
 
     Given I am logged in as a "<role>" admin
       And basic tags
-    # Other admins cannot view the wrangling tools page, so try from the tags index page.
     When I go to the tags page
     Then I should not see "Wrangling Tools"
       And I should not see "Wranglers"