neinteractiveliterature · nbudin · Jun 7, 2026 · Jun 7, 2026 · Jun 7, 2026 · Jun 7, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -187,6 +187,13 @@ jobs:
         with:
           name: minitest-system-reports
           path: test/html_reports/*
+      - name: Archive Capybara screenshots
+        uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: minitest-system-screenshots
+          path: tmp/capybara/*
+          if-no-files-found: ignore
       - name: Archive coverage report
         uses: actions/upload-artifact@v7
         if: always()

diff --git a/Gemfile b/Gemfile
@@ -7,6 +7,10 @@ gem "rails", "8.1.3"
 # benchmark was removed from Ruby's default gems in Ruby 4.0; required by mini_magick
 gem "benchmark"
 
+# prettyprint 0.2.0 was published to RubyGems without frozen_string_literal: true, but the
+# GitHub tag has it. Using the git source avoids constant warnings on Ruby 4.0.
+gem "prettyprint", github: "ruby/prettyprint", tag: "v0.2.0"
+
 # locking to connection_pool 2.x until ActiveSupport's memcachestore supports the v3 API
 # see https://github.com/mperham/connection_pool/issues/212
 gem "connection_pool", "< 3"

diff --git a/Gemfile.lock b/Gemfile.lock
@@ -25,6 +25,13 @@ GIT
       rails (>= 5.2.0)
       shoryuken (>= 2.0)
 
+GIT
+  remote: https://github.com/ruby/prettyprint.git
+  revision: 9248e106c2ea8dbd5f98b18a15876cc96502fe86
+  tag: v0.2.0
+  specs:
+    prettyprint (0.2.0)
+
 GEM
   remote: https://rubygems.org/
   specs:
@@ -452,7 +459,6 @@ GEM
       syntax_tree-haml (>= 2.0.0)
       syntax_tree-rbs (>= 0.2.0)
     prettier_print (1.2.1)
-    prettyprint (0.2.0)
     prism (1.9.0)
     pry (0.14.2)
       coderay (~> 1.1)
@@ -771,6 +777,7 @@ DEPENDENCIES
   positioning
   prettier (= 4.0.4)
   prettier_print
+  prettyprint!
   prism
   pry-rails
   pry-remote

diff --git a/app/graphql/sources/event_rating.rb b/app/graphql/sources/event_rating.rb
@@ -3,12 +3,13 @@ class Sources::EventRating < GraphQL::Dataloader::Source
   attr_reader :user_con_profile
 
   def initialize(user_con_profile)
+    super()
     @user_con_profile = user_con_profile
   end
 
   def fetch(keys)
     event_ratings_by_event_id =
-      user_con_profile.event_ratings.where(event_id: keys.map(&:id)).pluck(:event_id, :rating).to_h
+      EventRating.where(user_con_profile:, event_id: keys.map(&:id)).pluck(:event_id, :rating).to_h
 
     keys.map { |event| event_ratings_by_event_id[event.id] }
   end

diff --git a/app/policies/event_rating_policy.rb b/app/policies/event_rating_policy.rb
@@ -1,21 +1,21 @@
 # frozen_string_literal: true
 class EventRatingPolicy < ApplicationPolicy
   def read?
-    manage?
+    return false unless user
+    return false unless oauth_scope?(:read_signups)
+    record.user_con_profile.user_id == actual_user.id
   end
 
   def manage?
     return false unless user
-    return false if doorkeeper_token # cookie auth only
-
+    return false unless oauth_scope?(:manage_signups)
     record.user_con_profile.user_id == actual_user.id
   end
 
   class Scope < Scope
     def resolve
       return scope.none unless user
-      return scope.none if doorkeeper_token # cookie auth only
-
+      return scope.none unless oauth_scope?(:read_signups)
       scope.joins(:user_con_profile).where(user_con_profiles: { user_id: actual_user.id })
     end
   end

diff --git a/locales/en.json b/locales/en.json
@@ -1214,7 +1214,7 @@
       "manage_organizations": "Update privileged data about organizations on the site",
       "manage_profile": "Update your personal profile data",
       "manage_intercode": "Full site administration access",
-      "manage_signups": "Sign you up and withdraw you from events",
+      "manage_signups": "Sign you up and withdraw you from events, and update your favorites and queues",
       "openid": "Authenticate you using your account",
       "profile": "Access your personal profile data",
       "public": "Access your public data, and public data about conventions you are signed up for",
@@ -1223,7 +1223,7 @@
       "read_events": "Access data about the events and event proposals you manage",
       "read_organizations": "Access privileged data about organizations on the site",
       "read_profile": "Access your personal profile data",
-      "read_signups": "Access data about your signups"
+      "read_signups": "Access data about your signups, favorites, and queues"
     }
   },
   "payWhatYouWant": {

diff --git a/test/application_system_test_case.rb b/test/application_system_test_case.rb
@@ -11,10 +11,26 @@ class ApplicationSystemTestCase < ActionDispatch::SystemTestCase
             options: {
               headless: %w[0 false].exclude?(ENV.fetch("HEADLESS", nil)),
               js_errors: true,
-              process_timeout: 30
+              process_timeout: 30,
+              timeout: 30
             }
 
   self.use_transactional_tests = false
 
-  teardown { DatabaseCleaner.clean }
+  teardown do
+    if failures.any?
+      warn "\nURL at failure: #{page.current_url}"
+      warn "Page title: #{page.title}"
+      body_snippet = page.html.to_s.gsub(/\s+/, " ").slice(0, 500)
+      warn "Page body (first 500 chars): #{body_snippet}"
+      messages = page.driver.console_messages
+      if messages.any?
+        warn "\nBrowser console output:"
+        messages.each { |m| warn "  [#{m[:type]}] #{m[:text]}" }
+      else
+        warn "No browser console messages captured."
+      end
+    end
+    DatabaseCleaner.clean
+  end
 end
diff --git a/test/graphql/mutations/rate_event_test.rb b/test/graphql/mutations/rate_event_test.rb
@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+# rubocop:disable GraphQL/ObjectDescription
+require "test_helper"
+
+class Mutations::RateEventTest < ActiveSupport::TestCase
+  let(:convention) { create(:convention) }
+  let(:user_con_profile) { create(:user_con_profile, convention:) }
+  let(:event) { create(:event, convention:) }
+
+  RATE_EVENT_MUTATION = <<~GRAPHQL
+    mutation TestRateEvent($eventId: ID!, $rating: Int!) {
+      rateEvent(input: { eventId: $eventId, rating: $rating }) {
+        event {
+          id
+          my_rating
+        }
+      }
+    }
+  GRAPHQL
+
+  describe "rating an event for the first time" do
+    it "returns the new rating in the mutation response" do
+      result =
+        execute_graphql_query(
+          RATE_EVENT_MUTATION,
+          user_con_profile:,
+          variables: {
+            "eventId" => event.id.to_s,
+            "rating" => 1
+          }
+        )
+
+      assert_equal 1, result.dig("data", "rateEvent", "event", "my_rating")
+    end
+
+    it "persists the rating to the database" do
+      execute_graphql_query(
+        RATE_EVENT_MUTATION,
+        user_con_profile:,
+        variables: {
+          "eventId" => event.id.to_s,
+          "rating" => 1
+        }
+      )
+
+      assert EventRating.exists?(user_con_profile:, event:, rating: 1)
+    end
+  end
+
+  describe "updating an existing rating" do
+    before { create(:event_rating, user_con_profile:, event:, rating: 1) }
+
+    it "returns the updated rating in the mutation response" do
+      result =
+        execute_graphql_query(
+          RATE_EVENT_MUTATION,
+          user_con_profile:,
+          variables: {
+            "eventId" => event.id.to_s,
+            "rating" => -1
+          }
+        )
+
+      assert_equal(-1, result.dig("data", "rateEvent", "event", "my_rating"))
+    end
+  end
+end
+# rubocop:enable GraphQL/ObjectDescription