Fix authorization of adding/removing users from roles

Only organizers should be able to add/remove users from all roles.
Only organizers should be able to edit/update the description of roles of their conference.
Cfp/info_desk/voluters coordinators should be to able to add/remove users only to their own teams.

app/controllers/admin/roles_controller.rb

@@ -2,11 +2,13 @@ module Admin
   class RolesController < Admin::BaseController
     load_and_authorize_resource :conference, find_by: :short_title
     before_action :set_selection
+    authorize_resource :role, except: :index
     # Show flash message with ajax calls
     after_action :prepare_unobtrusive_flash, only: :toggle_user
 
     def index
       @roles = Role.where(resource: @conference)
+      authorize! :index, @role
     end
 
     def show

app/models/ability.rb

@@ -123,9 +123,7 @@ class Ability
 
   def signed_in_with_organizer_role(user)
     # ids of all the conferences for which the user has the 'organizer' role
-    conf_ids_for_organizer = []
+    conf_ids_for_organizer = Conference.with_role(:organizer, user).pluck(:id)
-    conf_ids_for_organizer =
-        Conference.with_role(:organizer, user).pluck(:id) if user.has_role? :organizer, :any
 
     can [:new, :create], Conference if user.has_role?(:organizer, :any)
     can :manage, Conference, id: conf_ids_for_organizer
@@ -162,24 +160,15 @@ class Ability
                          commentable_id: Event.where(program_id: Program.where(conference_id: conf_ids_for_organizer).pluck(:id)).pluck(:id)
 
     # Abilities for Role (Conference resource)
-    can :index, Role
+    can [:index, :show], Role
-    can :manage, Role do |role|
+    can [:edit, :update, :toggle_user], Role do |role|
       role.resource_type == 'Conference' && (conf_ids_for_organizer.include? role.resource_id)
     end
-
-    # Can add or remove users from role, when user has that same role for the conference
-    # Eg. If you are member of the CfP team, you can add more CfP team members (add users to the role 'CfP')
-    can :toggle_user, Role do |role|
-      role.resource_type == 'Conference' &&
-      (Conference.with_role(role.name.parameterize.underscore.to_sym, user).pluck(:id).include? role.resource_id)
-    end
   end
 
   def signed_in_with_cfp_role(user)
     # ids of all the conferences for which the user has the 'cfp' role
-    conf_ids_for_cfp = []
+    conf_ids_for_cfp = Conference.with_role(:cfp, user).pluck(:id)
-    conf_ids_for_cfp =
-      Conference.with_role(:cfp, user).pluck(:id) if user.has_role? :cfp, :any
 
     can :manage, Event, program: { conference_id: conf_ids_for_cfp }
     can :manage, EventType, program: { conference_id: conf_ids_for_cfp }
@@ -196,66 +185,52 @@ class Ability
                          commentable_id: Event.where(program_id: Program.where(conference_id: conf_ids_for_cfp).pluck(:id)).pluck(:id)
 
     # Abilities for Role (Conference resource)
-    can :index, Role
+    can [:index, :show], Role
-
-    can :manage, Role do |role|
-      role.resource_type == 'Conference' && (conf_ids_for_cfp.include? role.resource_id)
-    end
 
     # Can add or remove users from role, when user has that same role for the conference
     # Eg. If you are member of the CfP team, you can add more CfP team members (add users to the role 'CfP')
     can :toggle_user, Role do |role|
-      role.resource_type == 'Conference' &&
+      role.resource_type == 'Conference' && role.name == 'cfp' &&
-      (Conference.with_role(role.name.parameterize.underscore.to_sym, user).pluck(:id).include? role.resource_id)
+      (Conference.with_role(:cfp, user).pluck(:id).include? role.resource_id)
     end
   end
 
   def signed_in_with_info_desk_role(user)
     # ids of all the conferences for which the user has the 'info_desk' role
-    conf_ids_for_info_desk = []
+    conf_ids_for_info_desk = Conference.with_role(:info_desk, user).pluck(:id)
-    conf_ids_for_info_desk =
-        Conference.with_role(:info_desk, user).pluck(:id) if user.has_role? :info_desk, :any
 
     can :manage, Registration, conference_id: conf_ids_for_info_desk
     can :manage, Question, conference_id: conf_ids_for_info_desk
     can :manage, Question do |question|
       !(question.conferences.pluck(:id) & conf_ids_for_info_desk).empty?
     end
-    # Abilities for Role (Conference resource)
-    can :index, Role
 
-    can :manage, Role do |role|
+    # Abilities for Role (Conference resource)
-      role.resource_type == 'Conference' && (conf_ids_for_info_desk.include? role.resource_id)
+    can [:index, :show], Role
-    end
 
     # Can add or remove users from role, when user has that same role for the conference
     # Eg. If you are member of the CfP team, you can add more CfP team members (add users to the role 'CfP')
     can :toggle_user, Role do |role|
-      role.resource_type == 'Conference' &&
+      role.resource_type == 'Conference' && role.name == 'info_desk' &&
-      (Conference.with_role(role.name.parameterize.underscore.to_sym, user).pluck(:id).include? role.resource_id)
+      (Conference.with_role(:info_desk, user).pluck(:id).include? role.resource_id)
     end
   end
 
   def signed_in_with_volunteers_coordinator_role(user)
     # ids of all the conferences for which the user has the 'volunteers_coordinator' role
-    conf_ids_for_volunteers_coordinator = []
+    conf_ids_for_volunteers_coordinator = Conference.with_role(:volunteers_coordinator, user).pluck(:id)
-    conf_ids_for_volunteers_coordinator =
-        Conference.with_role(:volunteers_coordinator, user).pluck(:id) if user.has_role? :volunteers_coordinator, :any
 
     can :manage, Vposition, conference_id: conf_ids_for_volunteers_coordinator
     can :manage, Vday, conference_id: conf_ids_for_volunteers_coordinator
-    # Abilities for Role (Conference resource)
-    can :index, Role
 
-    can :manage, Role do |role|
+    # Abilities for Role (Conference resource)
-      role.resource_type == 'Conference' && (conf_ids_for_volunteers_coordinator.include? role.resource_id)
+    can [:index, :show], Role
-    end
 
     # Can add or remove users from role, when user has that same role for the conference
     # Eg. If you are member of the CfP team, you can add more CfP team members (add users to the role 'CfP')
     can :toggle_user, Role do |role|
-      role.resource_type == 'Conference' &&
+      role.resource_type == 'Conference' && role.name == 'volunteers_coordinator' &&
-      (Conference.with_role(role.name.parameterize.underscore.to_sym, user).pluck(:id).include? role.resource_id)
+      (Conference.with_role(:volunteers_coordinator, user).pluck(:id).include? role.resource_id)
     end
   end
 end

app/views/admin/roles/_users.html.haml

@@ -3,16 +3,18 @@
 - if users.present?
   %table.table.table-striped.table-bordered.table-hover.datatable#users
     %thead
-      %th.col-md-1
+      - if ( can? :toggle_user, @role )
+        %th.col-md-1
       %th ID
       %th Name
       %th Email
     %tbody
       - users.each do |user|
         %tr
-          %td.text-right
+          - if ( can? :toggle_user, @role )
-            = hidden_field_tag "role[user_ids][]", nil
+            %td.text-right
-            = check_box_tag @conference.short_title, @role.id, (@role.user_ids.include? user.id), method: :post, url: "/admin/conference/#{@conference.short_title}/roles/#{@role.name}/toggle_user?user[email]=#{user.email}&user[state]=", class: 'switch-checkbox', data: { size: 'small', off_color: 'warning', on_text: 'Yes', off_text: 'No' }
+              = hidden_field_tag "role[user_ids][]", nil
+              = check_box_tag @conference.short_title, @role.id, (@role.user_ids.include? user.id), method: :post, url: "/admin/conference/#{@conference.short_title}/roles/#{@role.name}/toggle_user?user[email]=#{user.email}&user[state]=", class: 'switch-checkbox', data: { size: 'small', off_color: 'warning', on_text: 'Yes', off_text: 'No' }
           %td= user.id
           %td= user.name
           %td= user.email