Enforce admin export-all server-side and de-flake projects spec

- Only honor export_all when current_user is an admin, so the param can't be
  forged by a non-admin to export non-approved stories (the view-only guard
  was not enough). Add a non-admin guard spec and sign in as an admin in the
  admin spec, which previously never actually authenticated as one.
- Simplify export: drop the 4-way branch and the unused export_all argument,
  and move generate_csv under private.
- Fix a flaky madmin projects spec by comparing against the HTML-escaped title
  (Faker names with apostrophes were escaped in the page and failed the match).

Author: JuanVqz

app/controllers/stories_controller.rb

@@ -87,38 +87,19 @@ def import
   end
 
   def export
-    csv = if params[:export_with_comments] == "1" && params[:export_all] == "1"
-      generate_csv(@project.stories.includes(:comments), with_comments: true, export_all: true)
-    elsif params[:export_with_comments] == "1"
-      generate_csv(@project.stories.includes(:comments).approved, with_comments: true, export_all: false)
-    elsif params[:export_all] == "1"
-      generate_csv(@project.stories, with_comments: false, export_all: true)
-    else
-      generate_csv(@project.stories.approved, with_comments: false, export_all: false)
-    end
+    with_comments = params[:export_with_comments] == "1"
+    # Only admins may export non-approved stories. Enforce it here rather than
+    # relying on the checkbox being hidden in the view, so the param can't be
+    # forged by a non-admin.
+    export_all = params[:export_all] == "1" && current_user.admin?
 
-    filename = "#{@project.title.gsub(/[^\w]/, "_")}-#{Time.now.to_formatted_s(:short).tr(" ", "_")}.csv"
-    send_data csv, filename: filename
-  end
+    stories = export_all ? @project.stories : @project.stories.approved
+    stories = stories.includes(:comments) if with_comments
 
-  def generate_csv(stories, with_comments: false, export_all: false)
-    CSV.generate(headers: true) do |csv|
-      headers = CSV_HEADERS.dup
-      headers << "comment" if with_comments
-      csv << headers
+    csv = generate_csv(stories, with_comments: with_comments)
 
-      stories.by_position.each do |story|
-        comments = []
-
-        if with_comments
-          comments = story.comments.map do |comment|
-            "#{display_name(comment.user)}: #{comment.body}"
-          end
-        end
-
-        csv << [story.id, story.title, story.description, story.position] + comments
-      end
-    end
+    filename = "#{@project.title.gsub(/[^\w]/, "_")}-#{Time.now.to_formatted_s(:short).tr(" ", "_")}.csv"
+    send_data csv, filename: filename
   end
 
   def render_markdown
@@ -161,6 +142,26 @@ def pending
 
   private
 
+  def generate_csv(stories, with_comments: false)
+    CSV.generate(headers: true) do |csv|
+      headers = CSV_HEADERS.dup
+      headers << "comment" if with_comments
+      csv << headers
+
+      stories.by_position.each do |story|
+        comments = []
+
+        if with_comments
+          comments = story.comments.map do |comment|
+            "#{display_name(comment.user)}: #{comment.body}"
+          end
+        end
+
+        csv << [story.id, story.title, story.description, story.position] + comments
+      end
+    end
+  end
+
   def find_project
     @project = Project.find(params[:project_id])
   end

spec/controllers/stories_controller_spec.rb

@@ -189,8 +189,7 @@
 
       context "when an admin" do
         it "exports a CSV file with all stories" do
-          user = FactoryBot.create(:user)
-          user.admin = true
+          sign_in FactoryBot.create(:user, :admin)
 
           story2 = FactoryBot.create(:story, project: project, status: :rejected)
           story3 = FactoryBot.create(:story, project: project, status: :pending)
@@ -208,6 +207,24 @@
         end
       end
 
+      context "when not an admin" do
+        it "ignores export_all and exports only approved stories" do
+          # The signed-in user from the before block is not an admin, so a
+          # forged export_all param must not leak non-approved stories.
+          FactoryBot.create(:story, project: project, status: :rejected)
+          FactoryBot.create(:story, project: project, status: :pending)
+          get :export, params: {project_id: project.id, export_all: "1"}
+          expect(response).to have_http_status(:ok)
+
+          csv_data = CSV.parse(response.body)
+          expected_csv_content = [
+            ["id", "title", "description", "position"],
+            [story.id.to_s, story.title, story.description, story.position.to_s]
+          ]
+          expect(csv_data).to eq(expected_csv_content)
+        end
+      end
+
       context "with comments" do
         it "exports a CSV file with only approved stories" do
           user = FactoryBot.create(:user)