From 3265840a1b0858c47b23c64ee648780cd1c6ffde Mon Sep 17 00:00:00 2001
From: maebeale <maebeale@users.noreply.github.com>
Date: Sun, 2 Aug 2026 10:13:46 -0400
Subject: [PATCH 1/7] Move dashboard form links into a Forms dropdown

Consolidate the dashboard's inline quick-links row into a top-right
Forms dropdown (below the sub-nav), reusing the parameterized
form_actions_menu partial the registrants page already uses. Its
"Manage forms" item deep-links to the Edit-event form-settings section
so admins have one obvious path to configure forms.

Also clarify the registration display toggle copy: "Show event details
at top of registration form".

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 app/views/events/_form.html.erb              |  2 +-
 app/views/events/_form_actions_menu.html.erb |  9 ++--
 app/views/events/dashboard.html.erb          | 46 ++++----------------
 spec/requests/events_spec.rb                 | 10 +++++
 4 files changed, 26 insertions(+), 41 deletions(-)

diff --git a/app/views/events/_form.html.erb b/app/views/events/_form.html.erb
index 7cb00627d4..5280689941 100644
--- a/app/views/events/_form.html.erb
+++ b/app/views/events/_form.html.erb
@@ -352,7 +352,7 @@
               </div>
 
               <div>
-                <label class="flex items-center gap-2 cursor-pointer"><%= f.check_box :autoshow_registration_details %><span class="text-sm font-medium text-gray-700">Show event details on registration page</span></label>
+                <label class="flex items-center gap-2 cursor-pointer"><%= f.check_box :autoshow_registration_details %><span class="text-sm font-medium text-gray-700">Show event details at top of registration form</span></label>
                 <p class="text-xs text-gray-500 mt-1">Add an at-a-glance list of dates, time, platform/location, fee, and deadline above the registration form. Pulled from this event's details.</p>
 
                 <div class="mt-2 space-y-2 pl-6">
diff --git a/app/views/events/_form_actions_menu.html.erb b/app/views/events/_form_actions_menu.html.erb
index 9de3fe0e61..d02f32b524 100644
--- a/app/views/events/_form_actions_menu.html.erb
+++ b/app/views/events/_form_actions_menu.html.erb
@@ -1,3 +1,6 @@
+<% button_label = local_assigns.fetch(:button_label, "Form actions") %>
+<% manage_label = local_assigns.fetch(:manage_label, "Change form settings") %>
+<% sample_return_to = local_assigns.fetch(:sample_return_to, "registrants") %>
 <% dropdown_id = "form-actions-menu-#{SecureRandom.hex(4)}" %>
 <% item_class = "block px-4 py-2 text-sm text-gray-700 hover:bg-gray-50" %>
 <div data-controller="dropdown" class="relative">
@@ -5,7 +8,7 @@
           data-action="dropdown#toggle"
           data-dropdown-payload-param='[{"<%= dropdown_id %>":"hidden"}]'
           class="btn btn-utility-outline">
-    <span>Form actions</span>
+    <span><%= button_label %></span>
     <i class="fa-solid fa-chevron-down w-3 h-3 text-gray-400"></i>
   </button>
 
@@ -23,11 +26,11 @@
         <%= link_to "Bulk payment form", new_event_bulk_payment_path(@event), class: item_class, target: "_blank", rel: "noopener noreferrer" %>
       <% end %>
       <div class="my-1 border-t border-gray-100"></div>
-      <%= link_to "Change form settings", edit_event_path(@event, anchor: "registration_form_section"), class: item_class %>
+      <%= link_to manage_label, edit_event_path(@event, anchor: "registration_form_section"), class: item_class %>
     <% else %>
       <%= link_to "Enable forms", edit_event_path(@event, anchor: "registration_form_section"), class: item_class %>
     <% end %>
     <div class="my-1 border-t border-gray-100"></div>
-    <%= link_to "Sample ticket", sample_ticket_event_path(@event, return_to: "registrants"), class: item_class, target: "_blank", rel: "noopener noreferrer" %>
+    <%= link_to "Sample ticket", sample_ticket_event_path(@event, return_to: sample_return_to), class: item_class, target: "_blank", rel: "noopener noreferrer" %>
   </div>
 </div>
diff --git a/app/views/events/dashboard.html.erb b/app/views/events/dashboard.html.erb
index 553935f130..b42a98c40a 100644
--- a/app/views/events/dashboard.html.erb
+++ b/app/views/events/dashboard.html.erb
@@ -6,6 +6,15 @@
     <%= render "events/subnav", event: @event, current: :dashboard %>
   </div>
 
+  <%# Forms dropdown — sits top-right below the sub-nav, holding the public form
+      links, the sample-ticket preview, and "Manage forms" (the Edit-event form
+      settings section). %>
+  <% if allowed_to?(:edit?, @event) %>
+    <div class="flex justify-end mb-6">
+      <%= render "form_actions_menu", button_label: "Forms", manage_label: "Manage forms", sample_return_to: "dashboard" %>
+    </div>
+  <% end %>
+
   <%# Centered title block %>
   <div class="text-center mb-8">
     <%= link_to @event.decorate.compact_label, edit_event_path(@event), title: @event.title, class: "text-sm font-semibold text-gray-500 uppercase tracking-wide hover:text-gray-700" %>
@@ -20,43 +29,6 @@
     </h1>
   </div>
 
-  <%# Quick links: registration forms and bulk payment. Each form link is gated by
-      its event setting — registration on an associated registration form, scholarship
-      on that form plus the "Enable scholarship application" checkbox (which is what
-      creates the scholarship event_form). The scholarship link points at the public
-      registration page, so it also needs the registration form or it dead-ends there.
-      Bulk payment is gated on the event having a bulk payment form.
-      Links open in a new tab. %>
-  <% link_base = "inline-flex items-center gap-2 rounded-lg border bg-white px-3 py-2 text-sm font-medium shadow-sm transition-colors" %>
-  <div class="flex flex-wrap items-center justify-center gap-2 sm:gap-3 mb-8">
-    <% if @event.event_forms.registration.exists? %>
-      <%= link_to new_event_public_registration_path(@event), target: "_blank", rel: "noopener noreferrer",
-            class: "#{link_base} #{DomainTheme.border_class_for(:events, intensity: 200)} text-gray-700 hover:#{DomainTheme.border_class_for(:events, intensity: 300)} hover:bg-gray-50" do %>
-        <i class="fa-solid fa-clipboard-list <%= DomainTheme.text_class_for(:events, intensity: 600) %>"></i>
-        Public registration form
-        <i class="fa-solid fa-arrow-up-right-from-square text-xs text-gray-400"></i>
-      <% end %>
-    <% end %>
-
-    <% if @event.event_forms.registration.exists? && @event.scholarship_form %>
-      <%= link_to new_event_public_registration_path(@event, scholarship_requested: true), target: "_blank", rel: "noopener noreferrer",
-            class: "#{link_base} #{DomainTheme.border_class_for(:scholarships, intensity: 200)} text-gray-700 hover:#{DomainTheme.border_class_for(:scholarships, intensity: 300)} hover:bg-gray-50" do %>
-        <i class="fa-solid fa-graduation-cap <%= DomainTheme.text_class_for(:scholarships, intensity: 600) %>"></i>
-        Scholarship form
-        <i class="fa-solid fa-arrow-up-right-from-square text-xs text-gray-400"></i>
-      <% end %>
-    <% end %>
-
-    <% if @event.bulk_payment_form %>
-      <%= link_to new_event_bulk_payment_path(@event), target: "_blank", rel: "noopener noreferrer",
-            class: "#{link_base} #{DomainTheme.border_class_for(:payments, intensity: 200)} text-gray-700 hover:#{DomainTheme.border_class_for(:payments, intensity: 300)} hover:bg-gray-50" do %>
-        <i class="fa-solid fa-money-check-dollar <%= DomainTheme.text_class_for(:payments, intensity: 600) %>"></i>
-        Bulk payment form
-        <i class="fa-solid fa-arrow-up-right-from-square text-xs text-gray-400"></i>
-      <% end %>
-    <% end %>
-  </div>
-
   <%# Money cards (paid events only) — shown first %>
   <% if @dashboard.free? %>
     <div class="bg-white rounded-xl border border-gray-200 p-4 text-center text-sm text-gray-500 mb-4">
diff --git a/spec/requests/events_spec.rb b/spec/requests/events_spec.rb
index 6d17e0e883..756dad9863 100644
--- a/spec/requests/events_spec.rb
+++ b/spec/requests/events_spec.rb
@@ -1613,6 +1613,16 @@ def ce_chip_text
         expect(response.body).to include("Bulk payments")
         expect(response.body).to include(bulk_payments_event_path(event))
       end
+
+      it "renders a Forms menu with a Manage forms link to the edit form-settings section" do
+        create(:event_form, event: event, form: create(:form), role: "registration")
+
+        get dashboard_event_path(event)
+
+        expect(response.body).to include("Forms")
+        expect(response.body).to include("Manage forms")
+        expect(response.body).to include(edit_event_path(event, anchor: "registration_form_section"))
+      end
     end
 
     context "as non-admin non-owner" do

From c4269310f7a84c760feecf3613b3504cc641d5d7 Mon Sep 17 00:00:00 2001
From: maebeale <maebeale@users.noreply.github.com>
Date: Sun, 2 Aug 2026 10:17:29 -0400
Subject: [PATCH 2/7] Rename dashboard Forms dropdown item to 'Edit form
 settings'

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 app/views/events/dashboard.html.erb | 6 +++---
 spec/requests/events_spec.rb        | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/app/views/events/dashboard.html.erb b/app/views/events/dashboard.html.erb
index b42a98c40a..3596842565 100644
--- a/app/views/events/dashboard.html.erb
+++ b/app/views/events/dashboard.html.erb
@@ -7,11 +7,11 @@
   </div>
 
   <%# Forms dropdown — sits top-right below the sub-nav, holding the public form
-      links, the sample-ticket preview, and "Manage forms" (the Edit-event form
-      settings section). %>
+      links, the sample-ticket preview, and "Edit form settings" (the Edit-event
+      form settings section). %>
   <% if allowed_to?(:edit?, @event) %>
     <div class="flex justify-end mb-6">
-      <%= render "form_actions_menu", button_label: "Forms", manage_label: "Manage forms", sample_return_to: "dashboard" %>
+      <%= render "form_actions_menu", button_label: "Forms", manage_label: "Edit form settings", sample_return_to: "dashboard" %>
     </div>
   <% end %>
 
diff --git a/spec/requests/events_spec.rb b/spec/requests/events_spec.rb
index 756dad9863..48a7e932d8 100644
--- a/spec/requests/events_spec.rb
+++ b/spec/requests/events_spec.rb
@@ -1614,13 +1614,13 @@ def ce_chip_text
         expect(response.body).to include(bulk_payments_event_path(event))
       end
 
-      it "renders a Forms menu with a Manage forms link to the edit form-settings section" do
+      it "renders a Forms menu with an Edit form settings link to the edit form-settings section" do
         create(:event_form, event: event, form: create(:form), role: "registration")
 
         get dashboard_event_path(event)
 
         expect(response.body).to include("Forms")
-        expect(response.body).to include("Manage forms")
+        expect(response.body).to include("Edit form settings")
         expect(response.body).to include(edit_event_path(event, anchor: "registration_form_section"))
       end
     end

From 0f6d6b41b7bb8862fafaafca07cbff69895f3727 Mon Sep 17 00:00:00 2001
From: maebeale <maebeale@users.noreply.github.com>
Date: Sun, 2 Aug 2026 10:21:45 -0400
Subject: [PATCH 3/7] Unify the Forms dropdown across dashboard and registrants
 pages

Both pages share _form_actions_menu, so make its defaults the shared
labels (Forms button, Edit form settings) and rename the public-form
items to Registration form / Scholarship form. Only sample_return_to
differs per page so each eyebrow returns to its origin.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 app/views/events/_form_actions_menu.html.erb | 8 ++++----
 app/views/events/dashboard.html.erb          | 2 +-
 app/views/events/sample_ticket.html.erb      | 6 +++---
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/app/views/events/_form_actions_menu.html.erb b/app/views/events/_form_actions_menu.html.erb
index d02f32b524..e0e5bcb993 100644
--- a/app/views/events/_form_actions_menu.html.erb
+++ b/app/views/events/_form_actions_menu.html.erb
@@ -1,5 +1,5 @@
-<% button_label = local_assigns.fetch(:button_label, "Form actions") %>
-<% manage_label = local_assigns.fetch(:manage_label, "Change form settings") %>
+<% button_label = local_assigns.fetch(:button_label, "Forms") %>
+<% manage_label = local_assigns.fetch(:manage_label, "Edit form settings") %>
 <% sample_return_to = local_assigns.fetch(:sample_return_to, "registrants") %>
 <% dropdown_id = "form-actions-menu-#{SecureRandom.hex(4)}" %>
 <% item_class = "block px-4 py-2 text-sm text-gray-700 hover:bg-gray-50" %>
@@ -17,10 +17,10 @@
        class="hidden absolute right-0 z-10 mt-1 bg-white border border-gray-200 rounded-md shadow-lg py-1 min-w-[180px]">
     <% if @event.event_forms.registration.exists? || @event.scholarship_form || @event.bulk_payment_form %>
       <% if @event.event_forms.registration.exists? %>
-        <%= link_to "Public registration", new_event_public_registration_path(@event), class: item_class, target: "_blank", rel: "noopener noreferrer" %>
+        <%= link_to "Registration form", new_event_public_registration_path(@event), class: item_class, target: "_blank", rel: "noopener noreferrer" %>
       <% end %>
       <% if @event.scholarship_form %>
-        <%= link_to "Scholarship version", new_event_public_registration_path(@event, scholarship_requested: true), class: item_class, target: "_blank", rel: "noopener noreferrer" %>
+        <%= link_to "Scholarship form", new_event_public_registration_path(@event, scholarship_requested: true), class: item_class, target: "_blank", rel: "noopener noreferrer" %>
       <% end %>
       <% if @event.bulk_payment_form %>
         <%= link_to "Bulk payment form", new_event_bulk_payment_path(@event), class: item_class, target: "_blank", rel: "noopener noreferrer" %>
diff --git a/app/views/events/dashboard.html.erb b/app/views/events/dashboard.html.erb
index 3596842565..9a979df633 100644
--- a/app/views/events/dashboard.html.erb
+++ b/app/views/events/dashboard.html.erb
@@ -11,7 +11,7 @@
       form settings section). %>
   <% if allowed_to?(:edit?, @event) %>
     <div class="flex justify-end mb-6">
-      <%= render "form_actions_menu", button_label: "Forms", manage_label: "Edit form settings", sample_return_to: "dashboard" %>
+      <%= render "form_actions_menu", sample_return_to: "dashboard" %>
     </div>
   <% end %>
 
diff --git a/app/views/events/sample_ticket.html.erb b/app/views/events/sample_ticket.html.erb
index 740d91f4cb..b0a2015590 100644
--- a/app/views/events/sample_ticket.html.erb
+++ b/app/views/events/sample_ticket.html.erb
@@ -1,7 +1,7 @@
 <% content_for(:page_bg_class, "admin-only bg-blue-100") %>
-<%# Eyebrow returns the admin to wherever they opened the preview from. The
-    Form actions menu lives on the registrants page; the dashboard has its own
-    quick link. Default to the dashboard when the origin is absent/unknown. %>
+<%# Eyebrow returns the admin to wherever they opened the preview from — the
+    Forms menu (shared by the dashboard and registrants page) passes the origin
+    via return_to. Default to the dashboard when the origin is absent/unknown. %>
 <% case params[:return_to]
    when "registrants" %>
   <% back_label = "← Registrants" %>

From 56c696fc86f91423c4d8f243af405ffafa592c5d Mon Sep 17 00:00:00 2001
From: maebeale <maebeale@users.noreply.github.com>
Date: Sun, 2 Aug 2026 10:32:07 -0400
Subject: [PATCH 4/7] Gate Forms dropdown links by cost and registration form;
 label public registration
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Scholarship and bulk payment links only make sense with a fee, so show
them only when the event has a cost. The registration link shows only
when a registration form is selected, and reads 'Public registration
form' when public registration is enabled (the flag reflects public
advertising, not access — so it doesn't affect the other links).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 app/views/events/_form_actions_menu.html.erb | 15 +++++---
 spec/requests/events_spec.rb                 | 37 ++++++++++++++++++++
 2 files changed, 47 insertions(+), 5 deletions(-)

diff --git a/app/views/events/_form_actions_menu.html.erb b/app/views/events/_form_actions_menu.html.erb
index e0e5bcb993..4ba14f3301 100644
--- a/app/views/events/_form_actions_menu.html.erb
+++ b/app/views/events/_form_actions_menu.html.erb
@@ -15,14 +15,19 @@
   <div id="<%= dropdown_id %>"
        data-dropdown-target="content"
        class="hidden absolute right-0 z-10 mt-1 bg-white border border-gray-200 rounded-md shadow-lg py-1 min-w-[180px]">
-    <% if @event.event_forms.registration.exists? || @event.scholarship_form || @event.bulk_payment_form %>
-      <% if @event.event_forms.registration.exists? %>
-        <%= link_to "Registration form", new_event_public_registration_path(@event), class: item_class, target: "_blank", rel: "noopener noreferrer" %>
+    <%# Scholarship and bulk payment only make sense once there's a fee, so gate
+        their links on the event having a cost. The public-registration flag only
+        governs how the registration page is advertised (not access to any of
+        these forms), so it just tweaks the registration link's wording. %>
+    <% has_cost = @event.cost_cents.to_i.positive? %>
+    <% if @event.registration_form.present? || @event.scholarship_form || @event.bulk_payment_form %>
+      <% if @event.registration_form.present? %>
+        <%= link_to @event.public_registration_enabled? ? "Public registration form" : "Registration form", new_event_public_registration_path(@event), class: item_class, target: "_blank", rel: "noopener noreferrer" %>
       <% end %>
-      <% if @event.scholarship_form %>
+      <% if @event.scholarship_form && has_cost %>
         <%= link_to "Scholarship form", new_event_public_registration_path(@event, scholarship_requested: true), class: item_class, target: "_blank", rel: "noopener noreferrer" %>
       <% end %>
-      <% if @event.bulk_payment_form %>
+      <% if @event.bulk_payment_form && has_cost %>
         <%= link_to "Bulk payment form", new_event_bulk_payment_path(@event), class: item_class, target: "_blank", rel: "noopener noreferrer" %>
       <% end %>
       <div class="my-1 border-t border-gray-100"></div>
diff --git a/spec/requests/events_spec.rb b/spec/requests/events_spec.rb
index 48a7e932d8..3346b95157 100644
--- a/spec/requests/events_spec.rb
+++ b/spec/requests/events_spec.rb
@@ -1623,6 +1623,43 @@ def ce_chip_text
         expect(response.body).to include("Edit form settings")
         expect(response.body).to include(edit_event_path(event, anchor: "registration_form_section"))
       end
+
+      it "shows the registration link only when a registration form is selected" do
+        get dashboard_event_path(event)
+        expect(response.body).not_to include("Registration form")
+
+        create(:event_form, event: event, form: create(:form), role: "registration")
+        get dashboard_event_path(event)
+        expect(response.body).to include("Registration form")
+      end
+
+      it "prefixes the registration link with Public when public registration is enabled" do
+        create(:event_form, event: event, form: create(:form), role: "registration")
+
+        get dashboard_event_path(event)
+        expect(response.body).not_to include("Public registration form")
+
+        event.update!(public_registration_enabled: true)
+        get dashboard_event_path(event)
+        expect(response.body).to include("Public registration form")
+      end
+
+      it "shows scholarship and bulk payment links only when the event has a cost" do
+        create(:event_form, event: event, form: create(:form), role: "scholarship")
+        create(:event_form, event: event, form: create(:form), role: "bulk_payment")
+
+        free_event = create(:event, cost_cents: 0)
+        create(:event_form, event: free_event, form: create(:form), role: "scholarship")
+        create(:event_form, event: free_event, form: create(:form), role: "bulk_payment")
+
+        get dashboard_event_path(free_event)
+        expect(response.body).not_to include("Scholarship form")
+        expect(response.body).not_to include("Bulk payment form")
+
+        get dashboard_event_path(event)
+        expect(response.body).to include("Scholarship form")
+        expect(response.body).to include("Bulk payment form")
+      end
     end
 
     context "as non-admin non-owner" do

From 93ff49ea792eed601f766b1464b30d0ab1050cab Mon Sep 17 00:00:00 2001
From: maebeale <maebeale@users.noreply.github.com>
Date: Sun, 2 Aug 2026 10:54:09 -0400
Subject: [PATCH 5/7] Gate public forms on public-registration flag; refine
 Forms dropdown
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Gate access to the public registration, scholarship, and bulk-payment
form pages on the event's public_registration_enabled flag: anonymous
visitors need the flag on; signed-in users and admins always may. This
mirrors the register button, which already only advertises registration
to anonymous visitors when the flag is on — closing the direct-URL gap.

Registration/scholarship go through Events::PublicRegistrationPolicy
(new?/create? = admin? || public_registration_enabled? || authenticated?);
bulk payment uses a controller before_action with the same rule.

Forms dropdown: hide the registration link when one-click is on and
public registration is off (nobody hits the form page then); prefix all
three links with 'Public' when public registration is enabled.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 ...ulk_payment_form_submissions_controller.rb |   9 ++
 .../events/public_registrations_controller.rb |   4 +-
 .../events/public_registration_policy.rb      |   9 +-
 app/views/events/_form_actions_menu.html.erb  |  31 +++--
 spec/factories/events.rb                      |   4 +
 .../bulk_payment_form_submissions_spec.rb     |  34 ++++++
 .../professional_field_identifiers_spec.rb    |   2 +-
 .../events/public_registrations_spec.rb       |  49 +++++++-
 spec/requests/events_spec.rb                  | 115 ++++++++++++------
 ...ublic_registration_form_submission_spec.rb |   2 +-
 spec/system/public_registration_new_spec.rb   |   1 +
 11 files changed, 208 insertions(+), 52 deletions(-)

diff --git a/app/controllers/events/bulk_payment_form_submissions_controller.rb b/app/controllers/events/bulk_payment_form_submissions_controller.rb
index 80babbcd38..efc7163af7 100644
--- a/app/controllers/events/bulk_payment_form_submissions_controller.rb
+++ b/app/controllers/events/bulk_payment_form_submissions_controller.rb
@@ -2,6 +2,7 @@ module Events
   class BulkPaymentFormSubmissionsController < ApplicationController
     skip_before_action :authenticate_user!, only: [ :new, :create, :show, :ticket, :resend_confirmation ]
     before_action :set_event, only: [ :new, :create, :show ]
+    before_action :ensure_public_or_authenticated, only: [ :new, :create ]
     before_action :set_form, only: [ :new, :create ]
 
     def new
@@ -118,6 +119,14 @@ def set_form
       end
     end
 
+    # Anonymous visitors may only reach the public bulk-payment form when public
+    # registration is enabled; signed-in users (and admins) always may. Mirrors
+    # Events::PublicRegistrationPolicy for the registration/scholarship forms.
+    def ensure_public_or_authenticated
+      return if current_user.present? || @event.public_registration_enabled?
+      redirect_to event_path(@event), alert: "#{Form::BULK_PAYMENT_PUBLIC_NAME} form is not open for public submissions."
+    end
+
     def validate_required_fields
       # The nested attendees field is validated separately, so exclude it here.
       fields = visible_form_fields.reject { |field| field.field_identifier == "bulk_payment_attendees" }
diff --git a/app/controllers/events/public_registrations_controller.rb b/app/controllers/events/public_registrations_controller.rb
index 5954a41e13..35613462d9 100644
--- a/app/controllers/events/public_registrations_controller.rb
+++ b/app/controllers/events/public_registrations_controller.rb
@@ -5,7 +5,7 @@ class PublicRegistrationsController < ApplicationController
     before_action :ensure_registerable, only: [ :new, :create ]
 
     def new
-      authorize! :public_registration, to: :new?
+      authorize! @event, to: :new?, with: Events::PublicRegistrationPolicy
 
       @registration_form = registration_form
       unless @registration_form
@@ -21,7 +21,7 @@ def new
     end
 
     def create
-      authorize! :public_registration, to: :create?
+      authorize! @event, to: :create?, with: Events::PublicRegistrationPolicy
 
       if params[:public_registration][:website_url].present?
         redirect_to new_event_public_registration_path(@event)
diff --git a/app/policies/events/public_registration_policy.rb b/app/policies/events/public_registration_policy.rb
index d00c405190..ba85ebff2c 100644
--- a/app/policies/events/public_registration_policy.rb
+++ b/app/policies/events/public_registration_policy.rb
@@ -1,10 +1,15 @@
 class Events::PublicRegistrationPolicy < ApplicationPolicy
+  # Anonymous visitors may only reach the public registration/scholarship form
+  # when public registration is enabled for the event. Signed-in users (and
+  # admins, who are always signed in) may always reach it — mirroring the
+  # register button, which shows for any signed-in user on a registerable event.
+  # `record` is the event (authorized via `authorize! @event, with: self`).
   def new?
-    true
+    admin? || record.public_registration_enabled? || authenticated?
   end
 
   def create?
-    true
+    new?
   end
 
   def show?
diff --git a/app/views/events/_form_actions_menu.html.erb b/app/views/events/_form_actions_menu.html.erb
index 4ba14f3301..074eed3195 100644
--- a/app/views/events/_form_actions_menu.html.erb
+++ b/app/views/events/_form_actions_menu.html.erb
@@ -15,20 +15,31 @@
   <div id="<%= dropdown_id %>"
        data-dropdown-target="content"
        class="hidden absolute right-0 z-10 mt-1 bg-white border border-gray-200 rounded-md shadow-lg py-1 min-w-[180px]">
-    <%# Scholarship and bulk payment only make sense once there's a fee, so gate
-        their links on the event having a cost. The public-registration flag only
-        governs how the registration page is advertised (not access to any of
-        these forms), so it just tweaks the registration link's wording. %>
+    <%# Menu wording and which links appear both key off the event's form settings:
+        - Links open the public-facing form pages. When public registration is on,
+          each is prefixed "Public …" to signal it's exposed to anonymous visitors.
+        - Registration link: shown when a registration form is selected AND that
+          form page is actually reachable by someone — i.e. public registration is
+          on (anonymous use it) OR one-click is off (signed-in users use it). When
+          one-click is on and public registration is off, nobody hits the form page
+          (signed-in users register in one click; anonymous are blocked), so hide it.
+        - Scholarship / bulk payment only make sense once there's a fee, so also
+          gate them on the event having a cost. %>
     <% has_cost = @event.cost_cents.to_i.positive? %>
+    <% public_form = @event.public_registration_enabled? %>
+    <% form_label = ->(name) { public_form ? "Public #{name} form" : "#{name.capitalize} form" } %>
+    <% show_registration = @event.registration_form.present? && (public_form || !@event.signed_in_one_click_enabled?) %>
+    <% show_scholarship = @event.scholarship_form.present? && has_cost %>
+    <% show_bulk_payment = @event.bulk_payment_form.present? && has_cost %>
     <% if @event.registration_form.present? || @event.scholarship_form || @event.bulk_payment_form %>
-      <% if @event.registration_form.present? %>
-        <%= link_to @event.public_registration_enabled? ? "Public registration form" : "Registration form", new_event_public_registration_path(@event), class: item_class, target: "_blank", rel: "noopener noreferrer" %>
+      <% if show_registration %>
+        <%= link_to form_label.call("registration"), new_event_public_registration_path(@event), class: item_class, target: "_blank", rel: "noopener noreferrer" %>
       <% end %>
-      <% if @event.scholarship_form && has_cost %>
-        <%= link_to "Scholarship form", new_event_public_registration_path(@event, scholarship_requested: true), class: item_class, target: "_blank", rel: "noopener noreferrer" %>
+      <% if show_scholarship %>
+        <%= link_to form_label.call("scholarship"), new_event_public_registration_path(@event, scholarship_requested: true), class: item_class, target: "_blank", rel: "noopener noreferrer" %>
       <% end %>
-      <% if @event.bulk_payment_form && has_cost %>
-        <%= link_to "Bulk payment form", new_event_bulk_payment_path(@event), class: item_class, target: "_blank", rel: "noopener noreferrer" %>
+      <% if show_bulk_payment %>
+        <%= link_to form_label.call("bulk payment"), new_event_bulk_payment_path(@event), class: item_class, target: "_blank", rel: "noopener noreferrer" %>
       <% end %>
       <div class="my-1 border-t border-gray-100"></div>
       <%= link_to manage_label, edit_event_path(@event, anchor: "registration_form_section"), class: item_class %>
diff --git a/spec/factories/events.rb b/spec/factories/events.rb
index 24ee680315..54ea19338c 100644
--- a/spec/factories/events.rb
+++ b/spec/factories/events.rb
@@ -25,6 +25,10 @@
       publicly_visible { true }
     end
 
+    trait :publicly_registerable do
+      public_registration_enabled { true }
+    end
+
     trait :publicly_featured do
       publicly_featured { true }
     end
diff --git a/spec/requests/events/bulk_payment_form_submissions_spec.rb b/spec/requests/events/bulk_payment_form_submissions_spec.rb
index abc0d38691..a1dabd080d 100644
--- a/spec/requests/events/bulk_payment_form_submissions_spec.rb
+++ b/spec/requests/events/bulk_payment_form_submissions_spec.rb
@@ -77,6 +77,38 @@ def post_bulk_payment(answer)
     end
   end
 
+  # Anonymous visitors may only reach the public bulk-payment form when public
+  # registration is enabled; signed-in users and admins always may. (The parent
+  # `before` signs in an admin, so sign out to exercise the anonymous path.)
+  describe "access control by public registration setting" do
+    it "redirects an anonymous visitor when public registration is disabled" do
+      sign_out admin
+      get new_event_bulk_payment_path(event)
+      expect(response).to redirect_to(event_path(event))
+    end
+
+    it "rejects an anonymous create when public registration is disabled" do
+      sign_out admin
+      post_bulk_payment("this answer easily has plenty of words")
+      expect(response).to redirect_to(event_path(event))
+    end
+
+    it "allows an anonymous visitor when public registration is enabled" do
+      sign_out admin
+      public_event = create(:event, :publicly_registerable, cost_cents: 0)
+      EventForm.create!(event: public_event, form: create(:form), role: "bulk_payment")
+
+      get new_event_bulk_payment_path(public_event)
+
+      expect(response).to have_http_status(:ok)
+    end
+
+    it "allows a signed-in admin when public registration is disabled" do
+      get new_event_bulk_payment_path(event)
+      expect(response).to have_http_status(:ok)
+    end
+  end
+
   describe "POST create with credit card payment" do
     let(:admin) { create(:user, :admin, :with_person) }
     let(:event) { create(:event, cost_cents: 15_00) }
@@ -133,6 +165,8 @@ def payer_params
   end
 
   describe "GET new with the seeded bulk payment form" do
+    # Public registration must be on for the signed-out (anonymous) view.
+    let(:event) { create(:event, :publicly_registerable, cost_cents: 0) }
     let(:seeded_form) do
       FormBuilderService.new(name: "Bulk Payment", sections: %i[bulk_payment], role: "bulk_payment").call
     end
diff --git a/spec/requests/events/professional_field_identifiers_spec.rb b/spec/requests/events/professional_field_identifiers_spec.rb
index 47dab03b15..895fef25c7 100644
--- a/spec/requests/events/professional_field_identifiers_spec.rb
+++ b/spec/requests/events/professional_field_identifiers_spec.rb
@@ -14,7 +14,7 @@
 #     and form-submission show pages.
 RSpec.describe "Events::PublicRegistrations professional fields", type: :request do
   let(:admin) { create(:user, :admin) }
-  let(:event) { create(:event, cost_cents: 0) }
+  let(:event) { create(:event, :publicly_registerable, cost_cents: 0) }
 
   # An AgeRange type (profile-specific so the person edit form lists it) with the
   # published ranges plus an unpublished range that must never be offered.
diff --git a/spec/requests/events/public_registrations_spec.rb b/spec/requests/events/public_registrations_spec.rb
index d14590847f..bd71b75d96 100644
--- a/spec/requests/events/public_registrations_spec.rb
+++ b/spec/requests/events/public_registrations_spec.rb
@@ -3,7 +3,7 @@
 RSpec.describe "Events::PublicRegistrations", type: :request do
   # A guest registering on a free event so we exercise the bare create path
   # without payment or auth.
-  let(:event) { create(:event, cost_cents: 0) }
+  let(:event) { create(:event, :publicly_registerable, cost_cents: 0) }
   let(:form) { create(:form) }
   let!(:essay_field) do
     create(:form_field, form: form, answer_type: :free_form_input_paragraph,
@@ -17,6 +17,51 @@ def post_registration(answer)
          params: { public_registration: { form_fields: { essay_field.id.to_s => answer } } }
   end
 
+  # Anonymous visitors may only reach the public registration/scholarship form
+  # when public registration is enabled; signed-in users and admins always may.
+  describe "access control by public registration setting" do
+    let(:admin) { create(:user, :admin) }
+    let(:visitor) { create(:user, :with_person) }
+
+    context "when public registration is disabled" do
+      let(:event) { create(:event, cost_cents: 0) }
+
+      it "redirects an anonymous visitor from the registration form" do
+        get new_event_public_registration_path(event)
+        expect(response).to redirect_to(root_path)
+      end
+
+      it "redirects an anonymous visitor from the scholarship form" do
+        get new_event_public_registration_path(event, scholarship_requested: true)
+        expect(response).to redirect_to(root_path)
+      end
+
+      it "rejects an anonymous create" do
+        post_registration("this answer easily has plenty of words")
+        expect(response).to redirect_to(root_path)
+      end
+
+      it "allows a signed-in user" do
+        sign_in visitor
+        get new_event_public_registration_path(event)
+        expect(response).to have_http_status(:ok)
+      end
+
+      it "allows an admin" do
+        sign_in admin
+        get new_event_public_registration_path(event)
+        expect(response).to have_http_status(:ok)
+      end
+    end
+
+    context "when public registration is enabled" do
+      it "allows an anonymous visitor to the registration form" do
+        get new_event_public_registration_path(event)
+        expect(response).to have_http_status(:ok)
+      end
+    end
+  end
+
   describe "POST create with a minimum word count" do
     it "rejects an answer with too few words" do
       expect {
@@ -570,7 +615,7 @@ def post_with_scholarship(scholarship_answer)
 
   describe "GET new payment method options" do
     # A paid event so the payment section is not stripped from the form.
-    let(:event) { create(:event, cost_cents: 150_00) }
+    let(:event) { create(:event, :publicly_registerable, cost_cents: 150_00) }
     let!(:payment_method_field) do
       field = create(:form_field, form: form, answer_type: :single_select_radio,
                      field_identifier: "payment_method", name: "Payment method",
diff --git a/spec/requests/events_spec.rb b/spec/requests/events_spec.rb
index 3346b95157..5a274156f0 100644
--- a/spec/requests/events_spec.rb
+++ b/spec/requests/events_spec.rb
@@ -1614,51 +1614,98 @@ def ce_chip_text
         expect(response.body).to include(bulk_payments_event_path(event))
       end
 
-      it "renders a Forms menu with an Edit form settings link to the edit form-settings section" do
-        create(:event_form, event: event, form: create(:form), role: "registration")
+      # The Forms dropdown (app/views/events/_form_actions_menu.html.erb) shows a
+      # link per public-facing form, gated by the event's form settings, and
+      # prefixes each label with "Public" when public registration is enabled.
+      describe "Forms dropdown" do
+        it "renders the menu with an Edit form settings link to the edit form-settings section" do
+          create(:event_form, event: event, form: create(:form), role: "registration")
+
+          get dashboard_event_path(event)
+
+          expect(response.body).to include("Forms")
+          expect(response.body).to include("Edit form settings")
+          expect(response.body).to include(edit_event_path(event, anchor: "registration_form_section"))
+        end
 
-        get dashboard_event_path(event)
+        context "registration link" do
+          it "is hidden when no registration form is selected" do
+            get dashboard_event_path(event)
+            expect(response.body).not_to include("Registration form")
+            expect(response.body).not_to include("Public registration form")
+          end
 
-        expect(response.body).to include("Forms")
-        expect(response.body).to include("Edit form settings")
-        expect(response.body).to include(edit_event_path(event, anchor: "registration_form_section"))
-      end
+          it "shows 'Registration form' when a form is selected and public registration is off" do
+            create(:event_form, event: event, form: create(:form), role: "registration")
 
-      it "shows the registration link only when a registration form is selected" do
-        get dashboard_event_path(event)
-        expect(response.body).not_to include("Registration form")
+            get dashboard_event_path(event)
 
-        create(:event_form, event: event, form: create(:form), role: "registration")
-        get dashboard_event_path(event)
-        expect(response.body).to include("Registration form")
-      end
+            expect(response.body).to include("Registration form")
+            expect(response.body).not_to include("Public registration form")
+          end
 
-      it "prefixes the registration link with Public when public registration is enabled" do
-        create(:event_form, event: event, form: create(:form), role: "registration")
+          it "shows 'Public registration form' when public registration is enabled" do
+            create(:event_form, event: event, form: create(:form), role: "registration")
+            event.update!(public_registration_enabled: true)
 
-        get dashboard_event_path(event)
-        expect(response.body).not_to include("Public registration form")
+            get dashboard_event_path(event)
 
-        event.update!(public_registration_enabled: true)
-        get dashboard_event_path(event)
-        expect(response.body).to include("Public registration form")
-      end
+            expect(response.body).to include("Public registration form")
+          end
 
-      it "shows scholarship and bulk payment links only when the event has a cost" do
-        create(:event_form, event: event, form: create(:form), role: "scholarship")
-        create(:event_form, event: event, form: create(:form), role: "bulk_payment")
+          it "is hidden when one-click is on and public registration is off (nobody uses the form page)" do
+            create(:event_form, event: event, form: create(:form), role: "registration")
+            event.update!(signed_in_one_click_enabled: true)
 
-        free_event = create(:event, cost_cents: 0)
-        create(:event_form, event: free_event, form: create(:form), role: "scholarship")
-        create(:event_form, event: free_event, form: create(:form), role: "bulk_payment")
+            get dashboard_event_path(event)
 
-        get dashboard_event_path(free_event)
-        expect(response.body).not_to include("Scholarship form")
-        expect(response.body).not_to include("Bulk payment form")
+            expect(response.body).not_to include("Registration form")
+          end
 
-        get dashboard_event_path(event)
-        expect(response.body).to include("Scholarship form")
-        expect(response.body).to include("Bulk payment form")
+          it "is shown when one-click is on but public registration is enabled (anonymous still use it)" do
+            create(:event_form, event: event, form: create(:form), role: "registration")
+            event.update!(signed_in_one_click_enabled: true, public_registration_enabled: true)
+
+            get dashboard_event_path(event)
+
+            expect(response.body).to include("Public registration form")
+          end
+        end
+
+        context "scholarship and bulk payment links" do
+          before do
+            create(:event_form, event: event, form: create(:form), role: "scholarship")
+            create(:event_form, event: event, form: create(:form), role: "bulk_payment")
+          end
+
+          it "shows them on a paid event" do
+            get dashboard_event_path(event)
+
+            expect(response.body).to include("Scholarship form")
+            expect(response.body).to include("Bulk payment form")
+          end
+
+          it "hides them on a free event" do
+            free_event = create(:event, cost_cents: 0)
+            create(:event_form, event: free_event, form: create(:form), role: "scholarship")
+            create(:event_form, event: free_event, form: create(:form), role: "bulk_payment")
+
+            get dashboard_event_path(free_event)
+
+            expect(response.body).not_to include("Scholarship form")
+            expect(response.body).not_to include("Bulk payment form")
+          end
+
+          it "prefixes them with Public when public registration is enabled" do
+            create(:event_form, event: event, form: create(:form), role: "registration")
+            event.update!(public_registration_enabled: true)
+
+            get dashboard_event_path(event)
+
+            expect(response.body).to include("Public scholarship form")
+            expect(response.body).to include("Public bulk payment form")
+          end
+        end
       end
     end
 
diff --git a/spec/system/public_registration_form_submission_spec.rb b/spec/system/public_registration_form_submission_spec.rb
index 381f0e2be0..a2e8d33083 100644
--- a/spec/system/public_registration_form_submission_spec.rb
+++ b/spec/system/public_registration_form_submission_spec.rb
@@ -8,7 +8,7 @@
 # questions the dev seeds attach, so the DOM matches what registrants really see.
 RSpec.describe "Public form submissions", type: :system do
   let(:event) do
-    create(:event, :published, :publicly_visible,
+    create(:event, :published, :publicly_visible, :publicly_registerable,
            title: "AWBW Facilitator Training",
            cost_cents: 150_000,
            start_date: 10.days.from_now.change(hour: 9),
diff --git a/spec/system/public_registration_new_spec.rb b/spec/system/public_registration_new_spec.rb
index ddee63b7ed..0224371d27 100644
--- a/spec/system/public_registration_new_spec.rb
+++ b/spec/system/public_registration_new_spec.rb
@@ -6,6 +6,7 @@
       :event,
       :published,
       :publicly_visible,
+      :publicly_registerable,
       title: "My Event",
       start_date: 2.days.from_now.change(hour: 10),
       end_date: 2.days.from_now.change(hour: 12)

From b531a14eea5ea3e1bb7186f6711b81984e4bb301 Mon Sep 17 00:00:00 2001
From: maebeale <maebeale@users.noreply.github.com>
Date: Sun, 2 Aug 2026 11:05:44 -0400
Subject: [PATCH 6/7] Split out permissioning: keep this PR dropdown-only
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move the public-form access-control changes (policy/controller gating and
the one-click-based link hiding) to a separate PR. This PR keeps just the
Forms dropdown: the links, cost-gating of scholarship/bulk payment, and
the 'Public …' label prefix keyed on public_registration_enabled? as a
display marker (its meaning before the permissioning work).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 ...ulk_payment_form_submissions_controller.rb |  9 ----
 .../events/public_registrations_controller.rb |  4 +-
 .../events/public_registration_policy.rb      |  9 +---
 app/views/events/_form_actions_menu.html.erb  | 17 +++----
 spec/factories/events.rb                      |  4 --
 .../bulk_payment_form_submissions_spec.rb     | 34 -------------
 .../professional_field_identifiers_spec.rb    |  2 +-
 .../events/public_registrations_spec.rb       | 49 +------------------
 spec/requests/events_spec.rb                  | 18 -------
 ...ublic_registration_form_submission_spec.rb |  2 +-
 spec/system/public_registration_new_spec.rb   |  1 -
 11 files changed, 14 insertions(+), 135 deletions(-)

diff --git a/app/controllers/events/bulk_payment_form_submissions_controller.rb b/app/controllers/events/bulk_payment_form_submissions_controller.rb
index efc7163af7..80babbcd38 100644
--- a/app/controllers/events/bulk_payment_form_submissions_controller.rb
+++ b/app/controllers/events/bulk_payment_form_submissions_controller.rb
@@ -2,7 +2,6 @@ module Events
   class BulkPaymentFormSubmissionsController < ApplicationController
     skip_before_action :authenticate_user!, only: [ :new, :create, :show, :ticket, :resend_confirmation ]
     before_action :set_event, only: [ :new, :create, :show ]
-    before_action :ensure_public_or_authenticated, only: [ :new, :create ]
     before_action :set_form, only: [ :new, :create ]
 
     def new
@@ -119,14 +118,6 @@ def set_form
       end
     end
 
-    # Anonymous visitors may only reach the public bulk-payment form when public
-    # registration is enabled; signed-in users (and admins) always may. Mirrors
-    # Events::PublicRegistrationPolicy for the registration/scholarship forms.
-    def ensure_public_or_authenticated
-      return if current_user.present? || @event.public_registration_enabled?
-      redirect_to event_path(@event), alert: "#{Form::BULK_PAYMENT_PUBLIC_NAME} form is not open for public submissions."
-    end
-
     def validate_required_fields
       # The nested attendees field is validated separately, so exclude it here.
       fields = visible_form_fields.reject { |field| field.field_identifier == "bulk_payment_attendees" }
diff --git a/app/controllers/events/public_registrations_controller.rb b/app/controllers/events/public_registrations_controller.rb
index 35613462d9..5954a41e13 100644
--- a/app/controllers/events/public_registrations_controller.rb
+++ b/app/controllers/events/public_registrations_controller.rb
@@ -5,7 +5,7 @@ class PublicRegistrationsController < ApplicationController
     before_action :ensure_registerable, only: [ :new, :create ]
 
     def new
-      authorize! @event, to: :new?, with: Events::PublicRegistrationPolicy
+      authorize! :public_registration, to: :new?
 
       @registration_form = registration_form
       unless @registration_form
@@ -21,7 +21,7 @@ def new
     end
 
     def create
-      authorize! @event, to: :create?, with: Events::PublicRegistrationPolicy
+      authorize! :public_registration, to: :create?
 
       if params[:public_registration][:website_url].present?
         redirect_to new_event_public_registration_path(@event)
diff --git a/app/policies/events/public_registration_policy.rb b/app/policies/events/public_registration_policy.rb
index ba85ebff2c..d00c405190 100644
--- a/app/policies/events/public_registration_policy.rb
+++ b/app/policies/events/public_registration_policy.rb
@@ -1,15 +1,10 @@
 class Events::PublicRegistrationPolicy < ApplicationPolicy
-  # Anonymous visitors may only reach the public registration/scholarship form
-  # when public registration is enabled for the event. Signed-in users (and
-  # admins, who are always signed in) may always reach it — mirroring the
-  # register button, which shows for any signed-in user on a registerable event.
-  # `record` is the event (authorized via `authorize! @event, with: self`).
   def new?
-    admin? || record.public_registration_enabled? || authenticated?
+    true
   end
 
   def create?
-    new?
+    true
   end
 
   def show?
diff --git a/app/views/events/_form_actions_menu.html.erb b/app/views/events/_form_actions_menu.html.erb
index 074eed3195..c9f8ce78f2 100644
--- a/app/views/events/_form_actions_menu.html.erb
+++ b/app/views/events/_form_actions_menu.html.erb
@@ -15,20 +15,15 @@
   <div id="<%= dropdown_id %>"
        data-dropdown-target="content"
        class="hidden absolute right-0 z-10 mt-1 bg-white border border-gray-200 rounded-md shadow-lg py-1 min-w-[180px]">
-    <%# Menu wording and which links appear both key off the event's form settings:
-        - Links open the public-facing form pages. When public registration is on,
-          each is prefixed "Public …" to signal it's exposed to anonymous visitors.
-        - Registration link: shown when a registration form is selected AND that
-          form page is actually reachable by someone — i.e. public registration is
-          on (anonymous use it) OR one-click is off (signed-in users use it). When
-          one-click is on and public registration is off, nobody hits the form page
-          (signed-in users register in one click; anonymous are blocked), so hide it.
-        - Scholarship / bulk payment only make sense once there's a fee, so also
-          gate them on the event having a cost. %>
+    <%# Links open the public-facing form pages, gated by the event's form
+        settings. When public registration is on, each label is prefixed
+        "Public …" to signal it's the publicly-exposed form. Scholarship and bulk
+        payment only make sense once there's a fee, so they also require the event
+        to have a cost. %>
     <% has_cost = @event.cost_cents.to_i.positive? %>
     <% public_form = @event.public_registration_enabled? %>
     <% form_label = ->(name) { public_form ? "Public #{name} form" : "#{name.capitalize} form" } %>
-    <% show_registration = @event.registration_form.present? && (public_form || !@event.signed_in_one_click_enabled?) %>
+    <% show_registration = @event.registration_form.present? %>
     <% show_scholarship = @event.scholarship_form.present? && has_cost %>
     <% show_bulk_payment = @event.bulk_payment_form.present? && has_cost %>
     <% if @event.registration_form.present? || @event.scholarship_form || @event.bulk_payment_form %>
diff --git a/spec/factories/events.rb b/spec/factories/events.rb
index 54ea19338c..24ee680315 100644
--- a/spec/factories/events.rb
+++ b/spec/factories/events.rb
@@ -25,10 +25,6 @@
       publicly_visible { true }
     end
 
-    trait :publicly_registerable do
-      public_registration_enabled { true }
-    end
-
     trait :publicly_featured do
       publicly_featured { true }
     end
diff --git a/spec/requests/events/bulk_payment_form_submissions_spec.rb b/spec/requests/events/bulk_payment_form_submissions_spec.rb
index a1dabd080d..abc0d38691 100644
--- a/spec/requests/events/bulk_payment_form_submissions_spec.rb
+++ b/spec/requests/events/bulk_payment_form_submissions_spec.rb
@@ -77,38 +77,6 @@ def post_bulk_payment(answer)
     end
   end
 
-  # Anonymous visitors may only reach the public bulk-payment form when public
-  # registration is enabled; signed-in users and admins always may. (The parent
-  # `before` signs in an admin, so sign out to exercise the anonymous path.)
-  describe "access control by public registration setting" do
-    it "redirects an anonymous visitor when public registration is disabled" do
-      sign_out admin
-      get new_event_bulk_payment_path(event)
-      expect(response).to redirect_to(event_path(event))
-    end
-
-    it "rejects an anonymous create when public registration is disabled" do
-      sign_out admin
-      post_bulk_payment("this answer easily has plenty of words")
-      expect(response).to redirect_to(event_path(event))
-    end
-
-    it "allows an anonymous visitor when public registration is enabled" do
-      sign_out admin
-      public_event = create(:event, :publicly_registerable, cost_cents: 0)
-      EventForm.create!(event: public_event, form: create(:form), role: "bulk_payment")
-
-      get new_event_bulk_payment_path(public_event)
-
-      expect(response).to have_http_status(:ok)
-    end
-
-    it "allows a signed-in admin when public registration is disabled" do
-      get new_event_bulk_payment_path(event)
-      expect(response).to have_http_status(:ok)
-    end
-  end
-
   describe "POST create with credit card payment" do
     let(:admin) { create(:user, :admin, :with_person) }
     let(:event) { create(:event, cost_cents: 15_00) }
@@ -165,8 +133,6 @@ def payer_params
   end
 
   describe "GET new with the seeded bulk payment form" do
-    # Public registration must be on for the signed-out (anonymous) view.
-    let(:event) { create(:event, :publicly_registerable, cost_cents: 0) }
     let(:seeded_form) do
       FormBuilderService.new(name: "Bulk Payment", sections: %i[bulk_payment], role: "bulk_payment").call
     end
diff --git a/spec/requests/events/professional_field_identifiers_spec.rb b/spec/requests/events/professional_field_identifiers_spec.rb
index 895fef25c7..47dab03b15 100644
--- a/spec/requests/events/professional_field_identifiers_spec.rb
+++ b/spec/requests/events/professional_field_identifiers_spec.rb
@@ -14,7 +14,7 @@
 #     and form-submission show pages.
 RSpec.describe "Events::PublicRegistrations professional fields", type: :request do
   let(:admin) { create(:user, :admin) }
-  let(:event) { create(:event, :publicly_registerable, cost_cents: 0) }
+  let(:event) { create(:event, cost_cents: 0) }
 
   # An AgeRange type (profile-specific so the person edit form lists it) with the
   # published ranges plus an unpublished range that must never be offered.
diff --git a/spec/requests/events/public_registrations_spec.rb b/spec/requests/events/public_registrations_spec.rb
index bd71b75d96..d14590847f 100644
--- a/spec/requests/events/public_registrations_spec.rb
+++ b/spec/requests/events/public_registrations_spec.rb
@@ -3,7 +3,7 @@
 RSpec.describe "Events::PublicRegistrations", type: :request do
   # A guest registering on a free event so we exercise the bare create path
   # without payment or auth.
-  let(:event) { create(:event, :publicly_registerable, cost_cents: 0) }
+  let(:event) { create(:event, cost_cents: 0) }
   let(:form) { create(:form) }
   let!(:essay_field) do
     create(:form_field, form: form, answer_type: :free_form_input_paragraph,
@@ -17,51 +17,6 @@ def post_registration(answer)
          params: { public_registration: { form_fields: { essay_field.id.to_s => answer } } }
   end
 
-  # Anonymous visitors may only reach the public registration/scholarship form
-  # when public registration is enabled; signed-in users and admins always may.
-  describe "access control by public registration setting" do
-    let(:admin) { create(:user, :admin) }
-    let(:visitor) { create(:user, :with_person) }
-
-    context "when public registration is disabled" do
-      let(:event) { create(:event, cost_cents: 0) }
-
-      it "redirects an anonymous visitor from the registration form" do
-        get new_event_public_registration_path(event)
-        expect(response).to redirect_to(root_path)
-      end
-
-      it "redirects an anonymous visitor from the scholarship form" do
-        get new_event_public_registration_path(event, scholarship_requested: true)
-        expect(response).to redirect_to(root_path)
-      end
-
-      it "rejects an anonymous create" do
-        post_registration("this answer easily has plenty of words")
-        expect(response).to redirect_to(root_path)
-      end
-
-      it "allows a signed-in user" do
-        sign_in visitor
-        get new_event_public_registration_path(event)
-        expect(response).to have_http_status(:ok)
-      end
-
-      it "allows an admin" do
-        sign_in admin
-        get new_event_public_registration_path(event)
-        expect(response).to have_http_status(:ok)
-      end
-    end
-
-    context "when public registration is enabled" do
-      it "allows an anonymous visitor to the registration form" do
-        get new_event_public_registration_path(event)
-        expect(response).to have_http_status(:ok)
-      end
-    end
-  end
-
   describe "POST create with a minimum word count" do
     it "rejects an answer with too few words" do
       expect {
@@ -615,7 +570,7 @@ def post_with_scholarship(scholarship_answer)
 
   describe "GET new payment method options" do
     # A paid event so the payment section is not stripped from the form.
-    let(:event) { create(:event, :publicly_registerable, cost_cents: 150_00) }
+    let(:event) { create(:event, cost_cents: 150_00) }
     let!(:payment_method_field) do
       field = create(:form_field, form: form, answer_type: :single_select_radio,
                      field_identifier: "payment_method", name: "Payment method",
diff --git a/spec/requests/events_spec.rb b/spec/requests/events_spec.rb
index 5a274156f0..d4bb092eb1 100644
--- a/spec/requests/events_spec.rb
+++ b/spec/requests/events_spec.rb
@@ -1652,24 +1652,6 @@ def ce_chip_text
 
             expect(response.body).to include("Public registration form")
           end
-
-          it "is hidden when one-click is on and public registration is off (nobody uses the form page)" do
-            create(:event_form, event: event, form: create(:form), role: "registration")
-            event.update!(signed_in_one_click_enabled: true)
-
-            get dashboard_event_path(event)
-
-            expect(response.body).not_to include("Registration form")
-          end
-
-          it "is shown when one-click is on but public registration is enabled (anonymous still use it)" do
-            create(:event_form, event: event, form: create(:form), role: "registration")
-            event.update!(signed_in_one_click_enabled: true, public_registration_enabled: true)
-
-            get dashboard_event_path(event)
-
-            expect(response.body).to include("Public registration form")
-          end
         end
 
         context "scholarship and bulk payment links" do
diff --git a/spec/system/public_registration_form_submission_spec.rb b/spec/system/public_registration_form_submission_spec.rb
index a2e8d33083..381f0e2be0 100644
--- a/spec/system/public_registration_form_submission_spec.rb
+++ b/spec/system/public_registration_form_submission_spec.rb
@@ -8,7 +8,7 @@
 # questions the dev seeds attach, so the DOM matches what registrants really see.
 RSpec.describe "Public form submissions", type: :system do
   let(:event) do
-    create(:event, :published, :publicly_visible, :publicly_registerable,
+    create(:event, :published, :publicly_visible,
            title: "AWBW Facilitator Training",
            cost_cents: 150_000,
            start_date: 10.days.from_now.change(hour: 9),
diff --git a/spec/system/public_registration_new_spec.rb b/spec/system/public_registration_new_spec.rb
index 0224371d27..ddee63b7ed 100644
--- a/spec/system/public_registration_new_spec.rb
+++ b/spec/system/public_registration_new_spec.rb
@@ -6,7 +6,6 @@
       :event,
       :published,
       :publicly_visible,
-      :publicly_registerable,
       title: "My Event",
       start_date: 2.days.from_now.change(hour: 10),
       end_date: 2.days.from_now.change(hour: 12)

From 392d528160fc9f89d814c4255eb699b631957921 Mon Sep 17 00:00:00 2001
From: maebeale <maebeale@users.noreply.github.com>
Date: Sun, 2 Aug 2026 11:08:56 -0400
Subject: [PATCH 7/7] Gate public event forms on the public-registration flag
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Anonymous visitors may only reach the public registration, scholarship,
and bulk-payment form pages when the event's public_registration_enabled
flag is on; signed-in users and admins always may. Mirrors the register
button, which already only advertises registration to anonymous visitors
when the flag is on — closing the direct-URL gap.

- Events::PublicRegistrationPolicy#new?/create? =
  admin? || public_registration_enabled? || authenticated? (covers the
  registration + scholarship pages, same controller).
- BulkPaymentFormSubmissionsController gets an equivalent before_action.
- Forms dropdown: hide the registration link when one-click is on and
  public registration is off (nobody reaches the form page then).
- Adds a :publicly_registerable factory trait; access + one-click specs.

Stacked on #2046 (Forms dropdown).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 ...ulk_payment_form_submissions_controller.rb |  9 ++++
 .../events/public_registrations_controller.rb |  4 +-
 .../events/public_registration_policy.rb      |  9 +++-
 app/views/events/_form_actions_menu.html.erb  | 17 ++++---
 spec/factories/events.rb                      |  4 ++
 .../bulk_payment_form_submissions_spec.rb     | 34 +++++++++++++
 .../professional_field_identifiers_spec.rb    |  2 +-
 .../events/public_registrations_spec.rb       | 49 ++++++++++++++++++-
 spec/requests/events_spec.rb                  | 18 +++++++
 ...ublic_registration_form_submission_spec.rb |  2 +-
 spec/system/public_registration_new_spec.rb   |  1 +
 11 files changed, 135 insertions(+), 14 deletions(-)

diff --git a/app/controllers/events/bulk_payment_form_submissions_controller.rb b/app/controllers/events/bulk_payment_form_submissions_controller.rb
index 80babbcd38..efc7163af7 100644
--- a/app/controllers/events/bulk_payment_form_submissions_controller.rb
+++ b/app/controllers/events/bulk_payment_form_submissions_controller.rb
@@ -2,6 +2,7 @@ module Events
   class BulkPaymentFormSubmissionsController < ApplicationController
     skip_before_action :authenticate_user!, only: [ :new, :create, :show, :ticket, :resend_confirmation ]
     before_action :set_event, only: [ :new, :create, :show ]
+    before_action :ensure_public_or_authenticated, only: [ :new, :create ]
     before_action :set_form, only: [ :new, :create ]
 
     def new
@@ -118,6 +119,14 @@ def set_form
       end
     end
 
+    # Anonymous visitors may only reach the public bulk-payment form when public
+    # registration is enabled; signed-in users (and admins) always may. Mirrors
+    # Events::PublicRegistrationPolicy for the registration/scholarship forms.
+    def ensure_public_or_authenticated
+      return if current_user.present? || @event.public_registration_enabled?
+      redirect_to event_path(@event), alert: "#{Form::BULK_PAYMENT_PUBLIC_NAME} form is not open for public submissions."
+    end
+
     def validate_required_fields
       # The nested attendees field is validated separately, so exclude it here.
       fields = visible_form_fields.reject { |field| field.field_identifier == "bulk_payment_attendees" }
diff --git a/app/controllers/events/public_registrations_controller.rb b/app/controllers/events/public_registrations_controller.rb
index 5954a41e13..35613462d9 100644
--- a/app/controllers/events/public_registrations_controller.rb
+++ b/app/controllers/events/public_registrations_controller.rb
@@ -5,7 +5,7 @@ class PublicRegistrationsController < ApplicationController
     before_action :ensure_registerable, only: [ :new, :create ]
 
     def new
-      authorize! :public_registration, to: :new?
+      authorize! @event, to: :new?, with: Events::PublicRegistrationPolicy
 
       @registration_form = registration_form
       unless @registration_form
@@ -21,7 +21,7 @@ def new
     end
 
     def create
-      authorize! :public_registration, to: :create?
+      authorize! @event, to: :create?, with: Events::PublicRegistrationPolicy
 
       if params[:public_registration][:website_url].present?
         redirect_to new_event_public_registration_path(@event)
diff --git a/app/policies/events/public_registration_policy.rb b/app/policies/events/public_registration_policy.rb
index d00c405190..ba85ebff2c 100644
--- a/app/policies/events/public_registration_policy.rb
+++ b/app/policies/events/public_registration_policy.rb
@@ -1,10 +1,15 @@
 class Events::PublicRegistrationPolicy < ApplicationPolicy
+  # Anonymous visitors may only reach the public registration/scholarship form
+  # when public registration is enabled for the event. Signed-in users (and
+  # admins, who are always signed in) may always reach it — mirroring the
+  # register button, which shows for any signed-in user on a registerable event.
+  # `record` is the event (authorized via `authorize! @event, with: self`).
   def new?
-    true
+    admin? || record.public_registration_enabled? || authenticated?
   end
 
   def create?
-    true
+    new?
   end
 
   def show?
diff --git a/app/views/events/_form_actions_menu.html.erb b/app/views/events/_form_actions_menu.html.erb
index c9f8ce78f2..074eed3195 100644
--- a/app/views/events/_form_actions_menu.html.erb
+++ b/app/views/events/_form_actions_menu.html.erb
@@ -15,15 +15,20 @@
   <div id="<%= dropdown_id %>"
        data-dropdown-target="content"
        class="hidden absolute right-0 z-10 mt-1 bg-white border border-gray-200 rounded-md shadow-lg py-1 min-w-[180px]">
-    <%# Links open the public-facing form pages, gated by the event's form
-        settings. When public registration is on, each label is prefixed
-        "Public …" to signal it's the publicly-exposed form. Scholarship and bulk
-        payment only make sense once there's a fee, so they also require the event
-        to have a cost. %>
+    <%# Menu wording and which links appear both key off the event's form settings:
+        - Links open the public-facing form pages. When public registration is on,
+          each is prefixed "Public …" to signal it's exposed to anonymous visitors.
+        - Registration link: shown when a registration form is selected AND that
+          form page is actually reachable by someone — i.e. public registration is
+          on (anonymous use it) OR one-click is off (signed-in users use it). When
+          one-click is on and public registration is off, nobody hits the form page
+          (signed-in users register in one click; anonymous are blocked), so hide it.
+        - Scholarship / bulk payment only make sense once there's a fee, so also
+          gate them on the event having a cost. %>
     <% has_cost = @event.cost_cents.to_i.positive? %>
     <% public_form = @event.public_registration_enabled? %>
     <% form_label = ->(name) { public_form ? "Public #{name} form" : "#{name.capitalize} form" } %>
-    <% show_registration = @event.registration_form.present? %>
+    <% show_registration = @event.registration_form.present? && (public_form || !@event.signed_in_one_click_enabled?) %>
     <% show_scholarship = @event.scholarship_form.present? && has_cost %>
     <% show_bulk_payment = @event.bulk_payment_form.present? && has_cost %>
     <% if @event.registration_form.present? || @event.scholarship_form || @event.bulk_payment_form %>
diff --git a/spec/factories/events.rb b/spec/factories/events.rb
index 24ee680315..54ea19338c 100644
--- a/spec/factories/events.rb
+++ b/spec/factories/events.rb
@@ -25,6 +25,10 @@
       publicly_visible { true }
     end
 
+    trait :publicly_registerable do
+      public_registration_enabled { true }
+    end
+
     trait :publicly_featured do
       publicly_featured { true }
     end
diff --git a/spec/requests/events/bulk_payment_form_submissions_spec.rb b/spec/requests/events/bulk_payment_form_submissions_spec.rb
index abc0d38691..a1dabd080d 100644
--- a/spec/requests/events/bulk_payment_form_submissions_spec.rb
+++ b/spec/requests/events/bulk_payment_form_submissions_spec.rb
@@ -77,6 +77,38 @@ def post_bulk_payment(answer)
     end
   end
 
+  # Anonymous visitors may only reach the public bulk-payment form when public
+  # registration is enabled; signed-in users and admins always may. (The parent
+  # `before` signs in an admin, so sign out to exercise the anonymous path.)
+  describe "access control by public registration setting" do
+    it "redirects an anonymous visitor when public registration is disabled" do
+      sign_out admin
+      get new_event_bulk_payment_path(event)
+      expect(response).to redirect_to(event_path(event))
+    end
+
+    it "rejects an anonymous create when public registration is disabled" do
+      sign_out admin
+      post_bulk_payment("this answer easily has plenty of words")
+      expect(response).to redirect_to(event_path(event))
+    end
+
+    it "allows an anonymous visitor when public registration is enabled" do
+      sign_out admin
+      public_event = create(:event, :publicly_registerable, cost_cents: 0)
+      EventForm.create!(event: public_event, form: create(:form), role: "bulk_payment")
+
+      get new_event_bulk_payment_path(public_event)
+
+      expect(response).to have_http_status(:ok)
+    end
+
+    it "allows a signed-in admin when public registration is disabled" do
+      get new_event_bulk_payment_path(event)
+      expect(response).to have_http_status(:ok)
+    end
+  end
+
   describe "POST create with credit card payment" do
     let(:admin) { create(:user, :admin, :with_person) }
     let(:event) { create(:event, cost_cents: 15_00) }
@@ -133,6 +165,8 @@ def payer_params
   end
 
   describe "GET new with the seeded bulk payment form" do
+    # Public registration must be on for the signed-out (anonymous) view.
+    let(:event) { create(:event, :publicly_registerable, cost_cents: 0) }
     let(:seeded_form) do
       FormBuilderService.new(name: "Bulk Payment", sections: %i[bulk_payment], role: "bulk_payment").call
     end
diff --git a/spec/requests/events/professional_field_identifiers_spec.rb b/spec/requests/events/professional_field_identifiers_spec.rb
index 47dab03b15..895fef25c7 100644
--- a/spec/requests/events/professional_field_identifiers_spec.rb
+++ b/spec/requests/events/professional_field_identifiers_spec.rb
@@ -14,7 +14,7 @@
 #     and form-submission show pages.
 RSpec.describe "Events::PublicRegistrations professional fields", type: :request do
   let(:admin) { create(:user, :admin) }
-  let(:event) { create(:event, cost_cents: 0) }
+  let(:event) { create(:event, :publicly_registerable, cost_cents: 0) }
 
   # An AgeRange type (profile-specific so the person edit form lists it) with the
   # published ranges plus an unpublished range that must never be offered.
diff --git a/spec/requests/events/public_registrations_spec.rb b/spec/requests/events/public_registrations_spec.rb
index d14590847f..bd71b75d96 100644
--- a/spec/requests/events/public_registrations_spec.rb
+++ b/spec/requests/events/public_registrations_spec.rb
@@ -3,7 +3,7 @@
 RSpec.describe "Events::PublicRegistrations", type: :request do
   # A guest registering on a free event so we exercise the bare create path
   # without payment or auth.
-  let(:event) { create(:event, cost_cents: 0) }
+  let(:event) { create(:event, :publicly_registerable, cost_cents: 0) }
   let(:form) { create(:form) }
   let!(:essay_field) do
     create(:form_field, form: form, answer_type: :free_form_input_paragraph,
@@ -17,6 +17,51 @@ def post_registration(answer)
          params: { public_registration: { form_fields: { essay_field.id.to_s => answer } } }
   end
 
+  # Anonymous visitors may only reach the public registration/scholarship form
+  # when public registration is enabled; signed-in users and admins always may.
+  describe "access control by public registration setting" do
+    let(:admin) { create(:user, :admin) }
+    let(:visitor) { create(:user, :with_person) }
+
+    context "when public registration is disabled" do
+      let(:event) { create(:event, cost_cents: 0) }
+
+      it "redirects an anonymous visitor from the registration form" do
+        get new_event_public_registration_path(event)
+        expect(response).to redirect_to(root_path)
+      end
+
+      it "redirects an anonymous visitor from the scholarship form" do
+        get new_event_public_registration_path(event, scholarship_requested: true)
+        expect(response).to redirect_to(root_path)
+      end
+
+      it "rejects an anonymous create" do
+        post_registration("this answer easily has plenty of words")
+        expect(response).to redirect_to(root_path)
+      end
+
+      it "allows a signed-in user" do
+        sign_in visitor
+        get new_event_public_registration_path(event)
+        expect(response).to have_http_status(:ok)
+      end
+
+      it "allows an admin" do
+        sign_in admin
+        get new_event_public_registration_path(event)
+        expect(response).to have_http_status(:ok)
+      end
+    end
+
+    context "when public registration is enabled" do
+      it "allows an anonymous visitor to the registration form" do
+        get new_event_public_registration_path(event)
+        expect(response).to have_http_status(:ok)
+      end
+    end
+  end
+
   describe "POST create with a minimum word count" do
     it "rejects an answer with too few words" do
       expect {
@@ -570,7 +615,7 @@ def post_with_scholarship(scholarship_answer)
 
   describe "GET new payment method options" do
     # A paid event so the payment section is not stripped from the form.
-    let(:event) { create(:event, cost_cents: 150_00) }
+    let(:event) { create(:event, :publicly_registerable, cost_cents: 150_00) }
     let!(:payment_method_field) do
       field = create(:form_field, form: form, answer_type: :single_select_radio,
                      field_identifier: "payment_method", name: "Payment method",
diff --git a/spec/requests/events_spec.rb b/spec/requests/events_spec.rb
index d4bb092eb1..5a274156f0 100644
--- a/spec/requests/events_spec.rb
+++ b/spec/requests/events_spec.rb
@@ -1652,6 +1652,24 @@ def ce_chip_text
 
             expect(response.body).to include("Public registration form")
           end
+
+          it "is hidden when one-click is on and public registration is off (nobody uses the form page)" do
+            create(:event_form, event: event, form: create(:form), role: "registration")
+            event.update!(signed_in_one_click_enabled: true)
+
+            get dashboard_event_path(event)
+
+            expect(response.body).not_to include("Registration form")
+          end
+
+          it "is shown when one-click is on but public registration is enabled (anonymous still use it)" do
+            create(:event_form, event: event, form: create(:form), role: "registration")
+            event.update!(signed_in_one_click_enabled: true, public_registration_enabled: true)
+
+            get dashboard_event_path(event)
+
+            expect(response.body).to include("Public registration form")
+          end
         end
 
         context "scholarship and bulk payment links" do
diff --git a/spec/system/public_registration_form_submission_spec.rb b/spec/system/public_registration_form_submission_spec.rb
index 381f0e2be0..a2e8d33083 100644
--- a/spec/system/public_registration_form_submission_spec.rb
+++ b/spec/system/public_registration_form_submission_spec.rb
@@ -8,7 +8,7 @@
 # questions the dev seeds attach, so the DOM matches what registrants really see.
 RSpec.describe "Public form submissions", type: :system do
   let(:event) do
-    create(:event, :published, :publicly_visible,
+    create(:event, :published, :publicly_visible, :publicly_registerable,
            title: "AWBW Facilitator Training",
            cost_cents: 150_000,
            start_date: 10.days.from_now.change(hour: 9),
diff --git a/spec/system/public_registration_new_spec.rb b/spec/system/public_registration_new_spec.rb
index ddee63b7ed..0224371d27 100644
--- a/spec/system/public_registration_new_spec.rb
+++ b/spec/system/public_registration_new_spec.rb
@@ -6,6 +6,7 @@
       :event,
       :published,
       :publicly_visible,
+      :publicly_registerable,
       title: "My Event",
       start_date: 2.days.from_now.change(hour: 10),
       end_date: 2.days.from_now.change(hour: 12)