AO3-7388 Redirect to user skin page with error if trying to preview a skin you can't use by zrei · Pull Request #5776 · otwcode/otwarchive

zrei · 2026-05-01T07:03:27Z

Pull Request Checklist

Have you read "How to write the perfect pull request"?
Have you read the contributing guidelines?
Have you added tests for any changed functionality?
Have you added the Jira issue number
as the first thing in your pull request title (e.g. AO3-1234 Fix thing)
Do you have fewer than 5 pull requests already open? If not, please wait
until they are reviewed and merged before creating new pull requests.

Issue

https://otwarchive.atlassian.net/browse/AO3-7388

Purpose

Redirects to the user skins page when trying to preview a skin that can't be used but can be viewed while logged in as a user. This includes parent-only site skins and work skins. For skins that a logged-in user cannot view (not owned and not public), they are redirected to their dashboard with an error.

Changed preview to a user-only action. Redirects to the login page with an error when trying to preview any skin while logged out. Redirects to the root page with an error when trying to preview any skin while logged in as an admin.

Testing Instructions

For site skins, refer to Jira.

For work skins:

Log in
Make a work skin
a. Hi, username! > My Dashboard > Skins > Create Work Skin
b. Fill in required information
c. Press “Submit” to save
In your browser address bar, add /preview to the end of the skin URL and press Return

For not owned, not public skins:

Log in
Make a site skin
a. Hi, username! > My Dashboard > Skins > Create Site Skin
b. Fill in required information
c. Press “Submit” to save
Copy the site skin URL
Log into another account and paste the site skin URL into the browser address bar. Add /preview to the end of the URL and press Return

Credit

zrei (she/they)

… skin you can't use

…h if skin cannot be previewed

zrei · 2026-05-01T07:05:44Z

I added a check_visibility call before preview to catch users trying to preview skins they can't view. If I should instead extend the check I've added to the preview action in the skins controller, do let me know!

Bilka2

Thank you for working on this! Two minor things about the code and then some requests for testing additions

Bilka2 · 2026-05-04T21:09:57Z

+    if @skin.is_a?(WorkSkin) || @skin.unusable?
+      flash[:error] = t("skins.preview.cannot_preview")
+
+      redirect_to skin_path(@skin) and return


I believe this should redirect to the user skin page per the Jira issue (so the user's skins index page), not the page of that specific skin

Updated! For logged-out users, it redirects to the public site skins page. Will update the PR description.

Bilka2 · 2026-05-04T21:33:16Z

+        it_behaves_like "a non-public skin that cannot be previewed"
+      end
+    end
+  end


To cover the (very welcome!) change regarding visibility for the preview action, could you add a variant for an official site skin that is fully accessible and one for a previewable skin by a user with it_behaves_like "an action only the skin author can access"? That way we know that the happy path still works

The redirect action for the shared example "an action only the skin author can access" is different from the redirect for preview, so I recreated it for the previewable skin by a user.

Missed that detail, thanks for the better test changes!

Bilka2 · 2026-05-06T12:45:47Z

+        it_behaves_like "a non-public skin that cannot be previewed"
+      end
+    end
+  end


Missed that detail, thanks for the better test changes!

Bilka2 · 2026-05-06T12:52:16Z

+      let(:notice) { ["You are previewing the skin #{skin.title}. This is a randomly chosen page.", "Go back or click any link to remove the skin.", "Tip: You can preview any archive page you want by tacking on '?site_skin=[skin_id]' like you can see in the url above.", "<a href='#{skin_path(skin)}' class='action' role='button'>Return To Skin To Use</a>"] }
+      let(:success) { it_redirects_to_with_notice(tag_works_path(tag, site_skin: skin.id), notice) }


if you wanted to simplify this, you could skip checking the notice with it_redirects_to_simple. It's checked in a cucumber test, so we'd be fine skipping it here

Bilka2 · 2026-05-06T12:54:23Z

+    if @skin.is_a?(WorkSkin) || @skin.unusable?
+      flash[:error] = t(".cannot_preview")
+
+      redirect_to skins_path(skin_type: "Site") and return if current_user.nil?


Sorry to change the requirements under you, but you bringing up that we can't redirect to a user's page if they're not logged in made me ask whether we even want to allow guests and admins to preview any skins at all. Turns out we don't! I've updated the Jira issue accordingly, so please update the code to make this action users_only

sarken

Thank you!

zrei added 3 commits May 1, 2026 00:12

AO3-7388 Redirect to user skin page with error if trying to preview a…

711e1f1

… skin you can't use

AO3-7388 Check visibility for preview action and redirect to skin pat…

f13179f

…h if skin cannot be previewed

AO3-7388 Add rspec GET #preview tests for skins controller

d4da8b5

github-actions Bot added the Awaiting Review label May 1, 2026

AO3-7388 Fix reviewdog reported issues

1e76f2f

Bilka2 requested changes May 4, 2026

View reviewed changes

Bilka2 added Reviewed: Action Needed and removed Awaiting Review labels May 4, 2026

zrei added 2 commits May 6, 2026 00:19

AO3-7388 Redirect to user skins path instead

2419d98

AO3-7388 Update skins rspec tests with happy path

d2fe62c

github-actions Bot added Coder Has Actioned Review and removed Reviewed: Action Needed labels May 5, 2026

zrei added 4 commits May 6, 2026 00:26

AO3-7388 Fix rubodog errors

e138665

AO3-7388 Remove extra end block

d0e5813

AO3-7388 Fix final rubodog error

bcda423

AO3-7388 Combine notice string to fix rubodog error

788a60c

Bilka2 requested changes May 6, 2026

View reviewed changes

Bilka2 added Reviewed: Action Needed and removed Coder Has Actioned Review labels May 6, 2026

AO3-7388 Mark preview as users only

680139f

github-actions Bot added Coder Has Actioned Review and removed Reviewed: Action Needed labels May 7, 2026

sarken approved these changes May 8, 2026

View reviewed changes

sarken added Reviewed: Ready to Merge and removed Coder Has Actioned Review labels May 8, 2026

		let(:notice) { ["You are previewing the skin #{skin.title}. This is a randomly chosen page.", "Go back or click any link to remove the skin.", "Tip: You can preview any archive page you want by tacking on '?site_skin=[skin_id]' like you can see in the url above.", "<a href='#{skin_path(skin)}' class='action' role='button'>Return To Skin To Use</a>"] }
		let(:success) { it_redirects_to_with_notice(tag_works_path(tag, site_skin: skin.id), notice) }

Conversation

zrei commented May 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Checklist

Issue

Purpose

Testing Instructions

Credit

Uh oh!

zrei commented May 1, 2026

Uh oh!

Bilka2 left a comment

Choose a reason for hiding this comment

Uh oh!

Bilka2 May 4, 2026

Choose a reason for hiding this comment

Uh oh!

zrei May 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Bilka2 May 4, 2026

Choose a reason for hiding this comment

Uh oh!

zrei May 5, 2026

Choose a reason for hiding this comment

Uh oh!

Bilka2 May 6, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Bilka2 May 6, 2026

Choose a reason for hiding this comment

Uh oh!

Bilka2 May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Bilka2 May 6, 2026

Choose a reason for hiding this comment

Uh oh!

sarken left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

zrei commented May 1, 2026 •

edited

Loading

Bilka2 May 6, 2026 •

edited

Loading