<% if contributor.user.present? %>
- Collaborator
+ <%= contributor.role_label %>
<% else %>
Invitation pending
<% end %>
diff --git a/app/views/content/show/_all_categories.html.erb b/app/views/content/show/_all_categories.html.erb
index 8112bd89b..be34a94de 100644
--- a/app/views/content/show/_all_categories.html.erb
+++ b/app/views/content/show/_all_categories.html.erb
@@ -28,6 +28,7 @@
<% if field[:type] == 'name' %>
fingerprint
<% end %>
+ <%= render partial: 'content/tailwind_components/field_privacy_badge', locals: { field: field } %>
diff --git a/app/views/content/show/_show_main.html.erb b/app/views/content/show/_show_main.html.erb
index c9e91403d..e3431b4d8 100644
--- a/app/views/content/show/_show_main.html.erb
+++ b/app/views/content/show/_show_main.html.erb
@@ -28,6 +28,7 @@
<%= field[:label] %>
+ <%= render partial: 'content/tailwind_components/field_privacy_badge', locals: { field: field } %>
diff --git a/app/views/content/show/_single_category.html.erb b/app/views/content/show/_single_category.html.erb
index 117fa297e..3716c64a9 100644
--- a/app/views/content/show/_single_category.html.erb
+++ b/app/views/content/show/_single_category.html.erb
@@ -17,6 +17,7 @@
<% if field[:type] == 'name' %>
fingerprint
<% end %>
+ <%= render partial: 'content/tailwind_components/field_privacy_badge', locals: { field: field } %>
diff --git a/app/views/content/tailwind_components/_field_privacy_badge.html.erb b/app/views/content/tailwind_components/_field_privacy_badge.html.erb
new file mode 100644
index 000000000..391a4765f
--- /dev/null
+++ b/app/views/content/tailwind_components/_field_privacy_badge.html.erb
@@ -0,0 +1,14 @@
+<%# Usage: render partial: 'content/tailwind_components/field_privacy_badge', locals: { field: field }
+ Shows a small badge on fields that aren't visible to everyone. The serializer has
+ already stripped fields the viewer can't see, so this is purely informational. %>
+<% if field[:privacy] == 'contributors' %>
+
+ group
+ Contributors only
+
+<% elsif field[:privacy] == 'private' %>
+
+ lock
+ Only you
+
+<% end %>
diff --git a/config/routes.rb b/config/routes.rb
index 9548a5d5e..db6404b0e 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -284,6 +284,7 @@
end
delete 'delete_my_account', to: 'users#delete_my_account'
delete 'contributor/:id/remove', to: 'contributors#destroy', as: :remove_contributor
+ patch 'contributor/:id/role', to: 'contributors#update', as: :update_contributor_role
post 'universes/:universe_id/contributors', to: 'contributors#create', as: :universe_contributors
get '/unsubscribe/emails/:code', to: 'emails#one_click_unsubscribe'
diff --git a/db/migrate/20260820000001_add_role_to_contributors.rb b/db/migrate/20260820000001_add_role_to_contributors.rb
new file mode 100644
index 000000000..326736706
--- /dev/null
+++ b/db/migrate/20260820000001_add_role_to_contributors.rb
@@ -0,0 +1,12 @@
+class AddRoleToContributors < ActiveRecord::Migration[6.1]
+ def up
+ add_column :contributors, :role, :string, default: 'full', null: false
+
+ # All existing contributors already function as full contributors, so label them as such
+ execute "UPDATE contributors SET role = 'full' WHERE role IS NULL"
+ end
+
+ def down
+ remove_column :contributors, :role
+ end
+end
diff --git a/db/migrate/20260820000002_backfill_attribute_field_privacy.rb b/db/migrate/20260820000002_backfill_attribute_field_privacy.rb
new file mode 100644
index 000000000..287c13dfe
--- /dev/null
+++ b/db/migrate/20260820000002_backfill_attribute_field_privacy.rb
@@ -0,0 +1,24 @@
+class BackfillAttributeFieldPrivacy < ActiveRecord::Migration[6.1]
+ def up
+ # The privacy column has existed (defaulting to 'public') but was never enforced,
+ # so normalize any stray values before we start reading it.
+ execute <<-SQL
+ UPDATE attribute_fields
+ SET privacy = 'public'
+ WHERE privacy IS NULL OR privacy NOT IN ('public', 'contributors', 'private')
+ SQL
+
+ # Private Notes fields have always been hidden from everyone but the page owner
+ # (previously hardcoded against old_column_source in the serializers), so express
+ # that behavior through the privacy column.
+ execute <<-SQL
+ UPDATE attribute_fields
+ SET privacy = 'private'
+ WHERE old_column_source = 'private_notes'
+ SQL
+ end
+
+ def down
+ # No-op: the previous state was an unenforced column, so there is nothing to restore
+ end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 92a834cd2..6243622fc 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -10,7 +10,7 @@
#
# It's strongly recommended that you check this file into your version control system.
-ActiveRecord::Schema.define(version: 2026_04_01_171734) do
+ActiveRecord::Schema.define(version: 2026_08_20_000002) do
create_table "active_storage_attachments", force: :cascade do |t|
t.string "name", null: false
@@ -747,6 +747,7 @@
t.integer "user_id"
t.datetime "created_at", null: false
t.datetime "updated_at", null: false
+ t.string "role", default: "full", null: false
t.index ["universe_id"], name: "index_contributors_on_universe_id"
t.index ["user_id"], name: "index_contributors_on_user_id"
end
diff --git a/test/controllers/contributor_roles_controller_test.rb b/test/controllers/contributor_roles_controller_test.rb
new file mode 100644
index 000000000..a73b76caa
--- /dev/null
+++ b/test/controllers/contributor_roles_controller_test.rb
@@ -0,0 +1,154 @@
+require 'test_helper'
+
+class ContributorRolesControllerTest < ActionDispatch::IntegrationTest
+ include Devise::Test::IntegrationHelpers
+
+ setup do
+ @owner = users(:one)
+ @collaborator = users(:two)
+ @universe = Universe.create!(name: 'Role Enforcement Universe', user: @owner, privacy: 'private')
+ end
+
+ def add_contributor(role)
+ Contributor.create!(universe: @universe, email: @collaborator.email, user: @collaborator, role: role)
+ end
+
+ test "full contributors can create pages in the universe" do
+ add_contributor('full')
+ sign_in @collaborator
+
+ assert_difference 'Character.count', 1 do
+ post characters_path, params: {
+ character: { universe_id: @universe.id },
+ field: { value: '' }
+ }
+ end
+ assert_equal @universe.id, Character.last.universe_id
+ end
+
+ test "editors cannot create pages in the universe" do
+ add_contributor('editor')
+ sign_in @collaborator
+
+ assert_no_difference 'Character.count' do
+ post characters_path, params: { character: { universe_id: @universe.id } }
+ end
+ assert_response :redirect
+ end
+
+ test "read-only contributors cannot create pages in the universe" do
+ add_contributor('read_only')
+ sign_in @collaborator
+
+ assert_no_difference 'Character.count' do
+ post characters_path, params: { character: { universe_id: @universe.id } }
+ end
+ assert_response :redirect
+ end
+
+ test "non-contributors cannot create pages in someone else's universe" do
+ sign_in @collaborator
+
+ assert_no_difference 'Character.count' do
+ post characters_path, params: { character: { universe_id: @universe.id } }
+ end
+ assert_response :redirect
+ end
+
+ test "read-only contributors cannot update fields on universe content" do
+ character = Character.create!(name: 'Guarded Character', user: @owner, universe: @universe)
+ field = name_field_for(character)
+
+ add_contributor('read_only')
+ sign_in @collaborator
+
+ patch name_field_update_path(field.id), params: {
+ entity: { entity_type: 'Character', entity_id: character.id },
+ field: { value: 'Hacked Name' }
+ }, headers: { 'Accept' => 'application/json' }
+
+ assert_response :forbidden
+ assert_equal 'Guarded Character', character.reload.name
+ end
+
+ test "editors can update fields on universe content" do
+ character = Character.create!(name: 'Editable Character', user: @owner, universe: @universe)
+ field = name_field_for(character)
+
+ add_contributor('editor')
+ sign_in @collaborator
+
+ patch name_field_update_path(field.id), params: {
+ entity: { entity_type: 'Character', entity_id: character.id },
+ field: { value: 'Renamed by Editor' }
+ }, headers: { 'Accept' => 'application/json' }
+
+ assert_response :success
+ assert_equal 'Renamed by Editor', character.reload.name
+ end
+
+ test "owner can change a contributor role" do
+ contributor = add_contributor('full')
+ sign_in @owner
+
+ patch update_contributor_role_path(contributor.id), params: { contributor: { role: 'read_only' } }
+
+ assert_redirected_to edit_universe_path(@universe, anchor: 'contributors')
+ assert_equal 'read_only', contributor.reload.role
+ end
+
+ test "non-owners cannot change contributor roles" do
+ contributor = add_contributor('editor')
+ sign_in @collaborator
+
+ patch update_contributor_role_path(contributor.id), params: { contributor: { role: 'full' } }
+
+ assert_equal 'editor', contributor.reload.role
+ end
+
+ test "invalid roles are rejected on role change" do
+ contributor = add_contributor('full')
+ sign_in @owner
+
+ patch update_contributor_role_path(contributor.id), params: { contributor: { role: 'owner' } }
+
+ assert_equal 'full', contributor.reload.role
+ end
+
+ test "invites can specify a role" do
+ sign_in @owner
+
+ post universe_contributors_path(@universe), params: {
+ contributor: { email: 'neweditor@example.com', role: 'editor' }
+ }
+
+ contributor = @universe.contributors.find_by(email: 'neweditor@example.com')
+ assert contributor.present?
+ assert_equal 'editor', contributor.role
+ end
+
+ test "invites with an invalid role fall back to full" do
+ sign_in @owner
+
+ post universe_contributors_path(@universe), params: {
+ contributor: { email: 'newfull@example.com', role: 'bogus' }
+ }
+
+ contributor = @universe.contributors.find_by(email: 'newfull@example.com')
+ assert contributor.present?
+ assert_equal 'full', contributor.role
+ end
+
+ private
+
+ # The name field is created lazily per content type per user; make sure it exists
+ def name_field_for(content)
+ categories = content.class.attribute_categories(content.user)
+ if categories.empty?
+ content.class.create_default_attribute_categories(content.user)
+ categories = content.class.attribute_categories(content.user)
+ end
+
+ AttributeField.where(attribute_category_id: categories.map(&:id), field_type: 'name').first
+ end
+end
diff --git a/test/controllers/field_visibility_controller_test.rb b/test/controllers/field_visibility_controller_test.rb
new file mode 100644
index 000000000..9e339bef9
--- /dev/null
+++ b/test/controllers/field_visibility_controller_test.rb
@@ -0,0 +1,95 @@
+require 'test_helper'
+
+class FieldVisibilityControllerTest < ActionDispatch::IntegrationTest
+ include Devise::Test::IntegrationHelpers
+
+ setup do
+ @owner = users(:one)
+ @collaborator = users(:two)
+
+ @universe = Universe.create!(name: 'Field Guard Universe', user: @owner, privacy: 'private')
+ @character = Character.create!(name: 'Guarded Character', user: @owner, universe: @universe)
+
+ @category = AttributeCategory.create!(
+ user: @owner,
+ entity_type: 'character',
+ name: 'field_guard_test',
+ label: 'Field Guard Test'
+ )
+ end
+
+ def build_field(privacy)
+ AttributeField.create!(
+ user: @owner,
+ attribute_category: @category,
+ label: "#{privacy.humanize} Field",
+ field_type: 'text_area',
+ privacy: privacy
+ )
+ end
+
+ def update_field(field, value)
+ patch text_field_update_path(field.id), params: {
+ entity: { entity_type: 'Character', entity_id: @character.id },
+ field: { value: value }
+ }, headers: { 'Accept' => 'application/json' }
+ end
+
+ def value_of(field)
+ Attribute.find_by(attribute_field_id: field.id, entity_type: 'Character', entity_id: @character.id)&.value
+ end
+
+ test "editors can write to contributors-only fields" do
+ field = build_field('contributors')
+ Contributor.create!(universe: @universe, email: @collaborator.email, user: @collaborator, role: 'editor')
+ sign_in @collaborator
+
+ update_field(field, 'written by editor')
+
+ assert_response :success
+ assert_equal 'written by editor', value_of(field)
+ end
+
+ test "editors cannot write to private fields" do
+ field = build_field('private')
+ Contributor.create!(universe: @universe, email: @collaborator.email, user: @collaborator, role: 'editor')
+ sign_in @collaborator
+
+ update_field(field, 'should not save')
+
+ assert_response :forbidden
+ assert_nil value_of(field)
+ end
+
+ test "owners can write to their own private fields" do
+ field = build_field('private')
+ sign_in @owner
+
+ update_field(field, 'owner secret')
+
+ assert_response :success
+ assert_equal 'owner secret', value_of(field)
+ end
+
+ test "field visibility can be updated by the template owner" do
+ field = build_field('public')
+ sign_in @owner
+
+ put polymorphic_path(field), params: {
+ attribute_field: { privacy: 'contributors' }
+ }, headers: { 'Accept' => 'application/json' }
+
+ assert_equal 'contributors', field.reload.privacy
+ end
+
+ test "field visibility rejects invalid values" do
+ field = build_field('public')
+ sign_in @owner
+
+ put polymorphic_path(field), params: {
+ attribute_field: { privacy: 'everyone-but-dave' }
+ }, headers: { 'Accept' => 'application/json' }
+
+ assert_equal 'public', field.reload.privacy
+ end
+end
diff --git a/test/models/attribute_field_visibility_test.rb b/test/models/attribute_field_visibility_test.rb
new file mode 100644
index 000000000..8434dc892
--- /dev/null
+++ b/test/models/attribute_field_visibility_test.rb
@@ -0,0 +1,184 @@
+require 'test_helper'
+
+class AttributeFieldVisibilityTest < ActiveSupport::TestCase
+ def setup
+ @owner = users(:one)
+ @collaborator = users(:two)
+ @stranger = User.create!(email: 'stranger@example.com', password: 'password123')
+
+ @universe = Universe.create!(name: 'Visibility Universe', user: @owner, privacy: 'public')
+ @character = Character.create!(name: 'Visible Character', user: @owner, universe: @universe, privacy: 'public')
+
+ @category = AttributeCategory.create!(
+ user: @owner,
+ entity_type: 'character',
+ name: 'visibility_test',
+ label: 'Visibility Test'
+ )
+ end
+
+ def build_field(privacy)
+ AttributeField.create!(
+ user: @owner,
+ attribute_category: @category,
+ label: "#{privacy.humanize} Field",
+ field_type: 'text_area',
+ privacy: privacy
+ )
+ end
+
+ def add_contributor(role)
+ Contributor.create!(universe: @universe, email: @collaborator.email, user: @collaborator, role: role)
+ end
+
+ test "privacy validation accepts only known visibility levels" do
+ assert build_field('public').valid?
+ assert build_field('contributors').valid?
+ assert build_field('private').valid?
+
+ invalid = AttributeField.new(
+ user: @owner, attribute_category: @category, label: 'Bad', field_type: 'text_area', privacy: 'friends'
+ )
+ refute invalid.valid?
+ assert invalid.errors[:privacy].present?
+ end
+
+ test "effective_privacy prefers the privacy column and falls back for legacy private notes" do
+ field = build_field('contributors')
+ assert_equal 'contributors', field.effective_privacy
+
+ legacy = AttributeField.create!(
+ user: @owner, attribute_category: @category, label: 'Private Notes',
+ field_type: 'text_area', old_column_source: 'private_notes'
+ )
+ # Default column value is 'public', but legacy private notes stay private
+ assert_equal 'private', legacy.effective_privacy
+ refute legacy.can_be_public?
+
+ # Owners can open legacy private notes up to contributors
+ legacy.update!(privacy: 'contributors')
+ assert_equal 'contributors', legacy.effective_privacy
+ end
+
+ test "public fields are visible to everyone including logged-out viewers" do
+ field = build_field('public')
+
+ assert PermissionService.attribute_field_visible_to?(field: field, content: @character, viewer: nil)
+ assert PermissionService.attribute_field_visible_to?(field: field, content: @character, viewer: @stranger)
+ end
+
+ test "contributors-only fields are visible to owner, universe owner, and contributors of any role" do
+ field = build_field('contributors')
+
+ refute PermissionService.attribute_field_visible_to?(field: field, content: @character, viewer: nil)
+ refute PermissionService.attribute_field_visible_to?(field: field, content: @character, viewer: @stranger)
+
+ assert PermissionService.attribute_field_visible_to?(field: field, content: @character, viewer: @owner)
+
+ add_contributor('read_only')
+ reader = User.find(@collaborator.id)
+ assert PermissionService.attribute_field_visible_to?(field: field, content: @character, viewer: reader)
+ end
+
+ test "contributors-only fields on pages outside any universe are owner-only" do
+ field = build_field('contributors')
+ loner = Character.create!(name: 'No Universe', user: @owner, privacy: 'public')
+
+ assert PermissionService.attribute_field_visible_to?(field: field, content: loner, viewer: @owner)
+ refute PermissionService.attribute_field_visible_to?(field: field, content: loner, viewer: @stranger)
+ end
+
+ test "private fields are visible only to the page owner" do
+ field = build_field('private')
+
+ assert PermissionService.attribute_field_visible_to?(field: field, content: @character, viewer: @owner)
+
+ add_contributor('full')
+ contributor = User.find(@collaborator.id)
+ refute PermissionService.attribute_field_visible_to?(field: field, content: @character, viewer: contributor)
+ refute PermissionService.attribute_field_visible_to?(field: field, content: @character, viewer: @stranger)
+ refute PermissionService.attribute_field_visible_to?(field: field, content: @character, viewer: nil)
+ end
+
+ test "contributors-only fields on a universe page are visible to that universe's contributors" do
+ universe_category = AttributeCategory.create!(
+ user: @owner, entity_type: 'universe', name: 'universe_visibility', label: 'Universe Visibility'
+ )
+ field = AttributeField.create!(
+ user: @owner, attribute_category: universe_category,
+ label: 'Contributor Lore', field_type: 'text_area', privacy: 'contributors'
+ )
+
+ refute PermissionService.attribute_field_visible_to?(field: field, content: @universe, viewer: @stranger)
+
+ add_contributor('read_only')
+ reader = User.find(@collaborator.id)
+ assert PermissionService.attribute_field_visible_to?(field: field, content: @universe, viewer: reader)
+ end
+
+ test "content serializer strips fields the viewer can't see" do
+ field = build_field('contributors')
+ Attribute.create!(
+ user: @owner, attribute_field: field,
+ entity_type: 'Character', entity_id: @character.id, value: 'contributor secret'
+ )
+ private_field = build_field('private')
+ Attribute.create!(
+ user: @owner, attribute_field: private_field,
+ entity_type: 'Character', entity_id: @character.id, value: 'owner secret'
+ )
+
+ add_contributor('read_only')
+ contributor = User.find(@collaborator.id)
+
+ owner_labels = serialized_field_labels(viewer: @owner)
+ contributor_labels = serialized_field_labels(viewer: contributor)
+ stranger_labels = serialized_field_labels(viewer: @stranger)
+ public_labels = serialized_field_labels(viewer: nil)
+
+ assert_includes owner_labels, 'Contributors Field'
+ assert_includes owner_labels, 'Private Field'
+
+ assert_includes contributor_labels, 'Contributors Field'
+ refute_includes contributor_labels, 'Private Field'
+
+ refute_includes stranger_labels, 'Contributors Field'
+ refute_includes stranger_labels, 'Private Field'
+
+ refute_includes public_labels, 'Contributors Field'
+ refute_includes public_labels, 'Private Field'
+ end
+
+ test "api serializer strips fields the viewer can't see" do
+ field = build_field('contributors')
+ Attribute.create!(
+ user: @owner, attribute_field: field,
+ entity_type: 'Character', entity_id: @character.id, value: 'contributor secret'
+ )
+
+ add_contributor('read_only')
+ contributor = User.find(@collaborator.id)
+
+ owner_labels = api_field_labels(viewer: @owner)
+ contributor_labels = api_field_labels(viewer: contributor)
+ stranger_labels = api_field_labels(viewer: @stranger)
+ anonymous_labels = api_field_labels(viewer: nil)
+
+ assert_includes owner_labels, 'Contributors Field'
+ assert_includes contributor_labels, 'Contributors Field'
+ refute_includes stranger_labels, 'Contributors Field'
+ refute_includes anonymous_labels, 'Contributors Field'
+ end
+
+ private
+
+ def serialized_field_labels(viewer:)
+ data = ContentSerializer.new(@character.reload, viewing_user: viewer).data
+ data[:categories].flat_map { |category| category[:fields].map { |f| f[:label] } }
+ end
+
+ def api_field_labels(viewer:)
+ data = ApiContentSerializer.new(@character.reload, include_blank_fields: true, viewer: viewer).data
+ data[:categories].flat_map { |category| category[:fields].map { |f| f[:label] } }
+ end
+end
diff --git a/test/models/contributor_role_test.rb b/test/models/contributor_role_test.rb
new file mode 100644
index 000000000..f6497f081
--- /dev/null
+++ b/test/models/contributor_role_test.rb
@@ -0,0 +1,119 @@
+require 'test_helper'
+
+class ContributorRoleTest < ActiveSupport::TestCase
+ def setup
+ @owner = users(:one)
+ @collaborator = users(:two)
+
+ @universe = Universe.create!(name: 'Role Test Universe', user: @owner, privacy: 'private')
+ end
+
+ def add_contributor(role)
+ Contributor.create!(universe: @universe, email: @collaborator.email, user: @collaborator, role: role)
+ end
+
+ test "contributors default to the full role" do
+ contributor = Contributor.create!(universe: @universe, email: @collaborator.email, user: @collaborator)
+ assert_equal 'full', contributor.role
+ assert_equal 'Full Contributor', contributor.role_label
+ end
+
+ test "invalid roles are rejected" do
+ contributor = Contributor.new(universe: @universe, email: @collaborator.email, role: 'superadmin')
+ refute contributor.valid?
+ assert contributor.errors[:role].present?
+ end
+
+ test "role capability helpers" do
+ full = add_contributor('full')
+ assert full.can_edit_content?
+ assert full.can_create_content?
+
+ full.update!(role: 'editor')
+ assert full.can_edit_content?
+ refute full.can_create_content?
+
+ full.update!(role: 'read_only')
+ refute full.can_edit_content?
+ refute full.can_create_content?
+ end
+
+ test "full contributors have read, edit, and create access to the universe" do
+ add_contributor('full')
+
+ assert_includes @collaborator.contributable_universe_ids, @universe.id
+ assert_includes @collaborator.editable_universe_ids, @universe.id
+ assert_includes @collaborator.creatable_universe_ids, @universe.id
+ end
+
+ test "editors have read and edit access but not create access" do
+ add_contributor('editor')
+
+ assert_includes @collaborator.contributable_universe_ids, @universe.id
+ assert_includes @collaborator.editable_universe_ids, @universe.id
+ refute_includes @collaborator.creatable_universe_ids, @universe.id
+ end
+
+ test "read-only contributors have read access only" do
+ add_contributor('read_only')
+
+ assert_includes @collaborator.contributable_universe_ids, @universe.id
+ refute_includes @collaborator.editable_universe_ids, @universe.id
+ refute_includes @collaborator.creatable_universe_ids, @universe.id
+ end
+
+ test "permission service exposes role-aware universe checks" do
+ contributor = add_contributor('editor')
+
+ assert PermissionService.user_can_contribute_to_universe?(user: @collaborator, universe: @universe)
+ assert PermissionService.user_can_edit_universe_content?(user: @collaborator, universe: @universe)
+ refute PermissionService.user_can_create_universe_content?(user: @collaborator, universe: @universe)
+
+ contributor.update!(role: 'read_only')
+ @collaborator.reload
+ fresh_collaborator = User.find(@collaborator.id)
+
+ assert PermissionService.user_can_contribute_to_universe?(user: fresh_collaborator, universe: @universe)
+ refute PermissionService.user_can_edit_universe_content?(user: fresh_collaborator, universe: @universe)
+ refute PermissionService.user_can_create_universe_content?(user: fresh_collaborator, universe: @universe)
+ end
+
+ test "content in the universe is editable by editors but not read-only contributors" do
+ character = Character.create!(name: 'Universe Character', user: @owner, universe: @universe, privacy: 'private')
+
+ contributor = add_contributor('editor')
+ editor = User.find(@collaborator.id)
+ assert character.readable_by?(editor)
+ assert character.updatable_by?(editor)
+
+ contributor.update!(role: 'read_only')
+ read_only = User.find(@collaborator.id)
+ assert character.readable_by?(read_only)
+ refute character.updatable_by?(read_only)
+
+ # A user who isn't a contributor at all can't see private content
+ contributor.destroy
+ stranger = User.find(@collaborator.id)
+ refute character.readable_by?(stranger)
+ refute character.updatable_by?(stranger)
+ end
+
+ test "the universe page itself is editable by editors but not read-only contributors" do
+ contributor = add_contributor('editor')
+ editor = User.find(@collaborator.id)
+ assert @universe.updatable_by?(editor)
+
+ contributor.update!(role: 'read_only')
+ read_only = User.find(@collaborator.id)
+ assert @universe.readable_by?(read_only)
+ refute @universe.updatable_by?(read_only)
+ end
+
+ test "universe owners retain full access regardless of contributor roles" do
+ add_contributor('read_only')
+ owner = User.find(@owner.id)
+
+ assert_includes owner.editable_universe_ids, @universe.id
+ assert_includes owner.creatable_universe_ids, @universe.id
+ end
+end