Consider RfC visibility to view / change RfCs

app/policies/application_policy.rb

@@ -31,6 +31,8 @@ class ApplicationPolicy
     # !! Order is important !!
     if @record.respond_to? :study_group # e.g. submission
       study_groups = @record.study_group
+    elsif @record.respond_to? :submission # e.g. request_for_comment
+      study_groups = @record.submission.study_group
     elsif @record.respond_to? :user # e.g. exercise
       study_groups = @record.author.study_groups.where(study_group_memberships: {role: :teacher})
     elsif @record.respond_to? :users # e.g. study_group

app/policies/request_for_comment_policy.rb

@@ -10,7 +10,7 @@ class RequestForCommentPolicy < ApplicationPolicy
   end
 
   def show?
-    everyone
+    admin? || rfc_visibility
   end
 
   def destroy?
@@ -18,11 +18,11 @@ class RequestForCommentPolicy < ApplicationPolicy
   end
 
   def mark_as_solved?
-    admin? || author?
+    admin? || (author? && rfc_visibility)
   end
 
   def set_thank_you_note?
-    admin? || author?
+    admin? || (author? && rfc_visibility)
   end
 
   def clear_question?
@@ -49,6 +49,19 @@ class RequestForCommentPolicy < ApplicationPolicy
     everyone
   end
 
+  def rfc_visibility
+    case @user.consumer.rfc_visibility
+      when 'all'
+        everyone
+      when 'consumer'
+        @record.author.consumer == @user.consumer
+      when 'study_group'
+        @record.submission.study_group.present? && @record.submission.study_group.id == @user.current_study_group_id
+      else
+        raise "Unknown RfC Visibility #{current_user.consumer.rfc_visibility}"
+    end
+  end
+
   class Scope < Scope
     def resolve
       if @user.admin?