fix(notes): scope noteable lookup to the current practice

app/controllers/notes_controller.rb

@@ -32,10 +32,7 @@ def destroy
   private
 
   def find_noteable
-    params.each do |name, value|
-      return Regexp.last_match(1).classify.constantize.find(value) if name =~ /(.+)_id$/
-    end
-    nil
+    Patient.with_practice(current_user.practice_id).find(params[:patient_id])
   end
 
   def note_params

test/functional/notes_controller_test.rb

@@ -33,6 +33,24 @@ class NotesControllerTest < ActionController::TestCase
     end
   end
 
+  test 'should not create a note for a patient in another practice' do
+    assert_no_difference 'Note.count' do
+      assert_raises(ActiveRecord::RecordNotFound) do
+        post :create, params: { patient_id: patients(:three).id, note: { notes: 'Cross-practice note' }, format: :js }
+      end
+    end
+  end
+
+  test 'should not destroy a note for a patient in another practice' do
+    foreign_note = Note.create!(notes: 'Private note', user: users(:user_in_yet_another_practice), noteable: patients(:three))
+
+    assert_no_difference 'Note.count' do
+      assert_raises(ActiveRecord::RecordNotFound) do
+        delete :destroy, params: { patient_id: patients(:three).id, id: foreign_note.id, format: :js }
+      end
+    end
+  end
+
   test 'requires authentication' do
     @controller.session['user'] = nil