Allow hiding and un-hiding of screenshot by moderators

app/controllers/packages_controller.rb

@@ -176,6 +176,40 @@ class PackagesController < ApplicationController
     end
   end
   
+  def hide_screenshot
+    # Is the user allowed to hide this screenshot?
+    @screenshot = Screenshot.find(params[:id])
+    
+    # Check if the user is allowed to change this screenshot
+    # - Is this the user's own screenshot? (anonymous)
+    if can? :hide, @screenshot
+      auditlog "Screenshot #{@screenshot.id} hidden",
+        package: @screenshot.package
+      @screenshot.hide!
+      flash['notice'] = "Screenshot hidden."
+      redirect_back(fallback_location: package_path(name: @screenshot.package.name))
+    else
+      head :forbidden
+    end
+  end
+  
+  def unhide_screenshot
+    # Is the user allowed to unhide this screenshot?
+    @screenshot = Screenshot.find(params[:id])
+    
+    # Check if the user is allowed to change this screenshot
+    # - Is this the user's own screenshot? (anonymous)
+    if can? :unhide, @screenshot
+      auditlog "Screenshot #{@screenshot.id} un-hidden",
+        package: @screenshot.package
+      @screenshot.unhide!
+      flash['notice'] = "Screenshot un-hidden."
+      redirect_back(fallback_location: package_path(name: @screenshot.package.name))
+    else
+      head :forbidden
+    end
+  end
+  
   def delete_screenshot
     # Is the user allowed to delete the screenshot?
     @screenshot = Screenshot.find(params[:id])

app/models/ability.rb

@@ -32,18 +32,19 @@ class Ability
     # See the wiki for details:
     # https://github.com/CanCanCommunity/cancancan/wiki/Defining-Abilities
 
+    # Everybody can see public screenshots
+    can :view, Screenshot, approved: true, hidden:false
+
     if user.present? # Logged-in users
-      # Allow to view all public/approved screenshots
+      # Allow to view own uploads (even not-yet-approved)
-      can :view, Screenshot, approved: true
-      # Allow to view any own uploads (even not-yet-approved)
       can :view, Screenshot, user_id: user.id
       can :destroy, Screenshot, user_id: user.id
 
       if user.admin_role?
         can :approve, Screenshot
         can :destroy, Screenshot
-        can :hide, Screenshot
+        can :hide, Screenshot, hidden: false
-        can :unhide, Screenshot
+        can :unhide, Screenshot, hidden: true
         can :destroy, User
         can :view, Screenshot
         can :destroy, Package
@@ -51,11 +52,10 @@ class Ability
       end
       if user.moderator_role?
         can :approve, Screenshot
-        can :hide, Screenshot
+        can :hide, Screenshot, hidden: false
+        can :unhide, Screenshot, hidden: true
         can :view, Screenshot
       end
-    else # Nobody logged in
-      can :view, Screenshot, approved: true
     end
   end
 end

app/models/screenshot.rb

@@ -5,7 +5,7 @@ class Screenshot < ApplicationRecord
   # Default sorting:
   # - unapproved first (to see them at the top when moderating)
   # - otherwise show newest first
-  default_scope { order(approved: :asc, created_at: :desc) }
+  default_scope { order(approved: :asc, hidden: :asc, created_at: :desc) }
 
   # Shrine
   include ImageUploader::Attachment(:simage) # adds an `simage` virtual attribute
@@ -63,6 +63,16 @@ class Screenshot < ApplicationRecord
     self.save!
   end
 
+  # Hide a screenshot from the public. Moderator level can do this.
+  def hide!
+    self.hidden = true
+    self.save!
+  end
+  def unhide!
+    self.hidden = false
+    self.save!
+  end
+
   # Get the newest screenshots regardless of the package it belongs to
   def self.newest
     self.order(created_at: :desc)

config/routes.rb

@@ -36,6 +36,8 @@ Rails.application.routes.draw do
   post 'upload/:name/json' => 'packages#upload_receive', as: :upload_receive_json, name: /[^\/]+/, returns: :json
   # TODO: "get" is probably the wrong method to delete a screenshot
   get 'delete_screenshot/:id' => 'packages#delete_screenshot', as: :delete_screenshot
+  get 'hide_screenshot/:id' => 'packages#hide_screenshot', as: :hide_screenshot
+  get 'unhide_screenshot/:id' => 'packages#unhide_screenshot', as: :unhide_screenshot
   patch 'update_screenshot_description/:id' => 'packages#update_screenshot_description', as: :update_screenshot_description
   #post 'report_screenshot/:id' => 'packages#report_screenshot', as: :report_screenshot
   # TODO: "get" is probably the wrong method to delete a screenshot

db/migrate/20210309233239_add_hidden_field_to_screenshots.rb

@@ -0,0 +1,5 @@
+class AddHiddenFieldToScreenshots < ActiveRecord::Migration[6.1]
+  def change
+    add_column :screenshots, :hidden, :boolean, default: false
+  end
+end

db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 2021_03_03_213303) do
+ActiveRecord::Schema.define(version: 2021_03_09_233239) do
 
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
@@ -96,6 +96,7 @@ ActiveRecord::Schema.define(version: 2021_03_03_213303) do
     t.integer "user_id", default: 0
     t.text "simage_data"
     t.inet "uploaderip"
+    t.boolean "hidden", default: false
     t.index ["id", "approved"], name: "id_approved"
     t.index ["id", "uploaderhash"], name: "id_uploaderhash"
   end