test(api): cover Alchemy::Node guest and member ability rules

The nodes#index authorization fix is exercised through accessible_by,
which builds its query from the ability's SQL scope and never runs the
per-instance can? block. That left the guest and member Node rule
blocks in Permissions uncovered. Add ability specs that check can?
directly for both roles, asserting guests are denied nodes linking to
restricted or unpublished pages while members may still see restricted
ones.

Author: tvdeyen

spec/libraries/permissions_spec.rb

@@ -17,6 +17,10 @@
   let(:published_element) { mock_model(Alchemy::Element, restricted?: false, public?: true) }
   let(:restricted_element) { mock_model(Alchemy::Element, restricted?: true, public?: true) }
   let(:language) { build(:alchemy_language) }
+  let(:public_node) { build(:alchemy_node, name: nil, page: public_page) }
+  let(:external_node) { build(:alchemy_node, :with_url) }
+  let(:restricted_node) { build(:alchemy_node, name: nil, page: restricted_page) }
+  let(:unpublished_node) { build(:alchemy_node, name: nil, page: unpublic_page) }
 
   context "A guest user" do
     let(:user) { nil }
@@ -44,6 +48,13 @@
       is_expected.to be_able_to(:index, published_element)
       is_expected.not_to be_able_to(:index, restricted_element)
     end
+
+    it "can only see nodes linking to public not restricted pages or external urls" do
+      is_expected.to be_able_to(:read, public_node)
+      is_expected.to be_able_to(:read, external_node)
+      is_expected.not_to be_able_to(:read, restricted_node)
+      is_expected.not_to be_able_to(:read, unpublished_node)
+    end
   end
 
   context "A member" do
@@ -72,6 +83,13 @@
       is_expected.to be_able_to(:index, published_element)
       is_expected.to be_able_to(:index, restricted_element)
     end
+
+    it "can also see nodes linking to restricted pages" do
+      is_expected.to be_able_to(:read, public_node)
+      is_expected.to be_able_to(:read, external_node)
+      is_expected.to be_able_to(:read, restricted_node)
+      is_expected.not_to be_able_to(:read, unpublished_node)
+    end
   end
 
   context "An author" do