work on authorization in controllers and refine ability.rb

app/controllers/admin/events_controller.rb

@@ -1,9 +1,8 @@
 module Admin
   class EventsController < ApplicationController
-    load_and_authorize_resource :conference, find_by: :short_title
+    load_resource :conference, find_by: :short_title
     load_and_authorize_resource :event, through: :conference
-
-    before_action :get_event, except: [:index, :create]
+    before_filter :authorize_conference
 
     # FIXME: The timezome should only be applied on output, otherwise
     # you get lost in timezone conversions...
@@ -14,7 +13,6 @@ module Admin
     end
 
     def index
-      @conference = Conference.find_by(short_title: params[:conference_id])
       @events = @conference.events
       @tracks = @conference.tracks
       @machine_states = @events.state_machine.states.map
@@ -170,15 +168,6 @@ module Admin
 
     private
 
-    def get_event
-      @event = @conference.events.find_by_id(params[:id])
-      if !@event
-        redirect_to(admin_conference_events_path(conference_id: @conference.short_title),
-                    alert: 'Error! Could not find event!') && return
-      end
-      @event
-    end
-
     def update_state(transition, notice, mail = false, subject = false, send_mail = false)
       alert = @event.update_state(transition, mail, subject, send_mail, params[:send_mail].blank?)
 

app/controllers/admin/speakers_controller.rb

@@ -1,17 +1,15 @@
 module Admin
   class SpeakersController < ApplicationController
     load_and_authorize_resource :conference, find_by: :short_title
-    load_and_authorize_resource :speaker, through: :conference
+    load_resource :event, through: :conference
 
     respond_to :js, :html
 
     def edit
-      @event = @conference.events.find(params[:event_id])
       @speaker = @event.event_users.where(event_role: 'speaker').first
     end
 
     def update
-      @event = @conference.events.find(params[:event_id])
       @speaker = @event.event_users.where(event_role: 'speaker').first
       @speaker.user_id = params[:speaker][:user_id]
       @speaker.save

app/controllers/application_controller.rb

@@ -34,11 +34,15 @@ class ApplicationController < ActionController::Base
     @conferences =Conference.all
   end
 
+  def authorize_conference
+    authorize! :update, @conference
+  end
+
   def verify_user_admin
     if self.class.to_s.split('::').first == 'Admin' && verify_user
       unless (current_user.has_role? :organizer, :any) || (current_user.has_role? :cfp, :any) ||
           (current_user.has_role? :info_desk, :any) ||
-          (current_user.has_role? :volunteers_coordinator, :any)
+          (current_user.has_role? :volunteers_coordinator, :any) || (current_user.is_admin)
         raise CanCan::AccessDenied.new('You are not authorized to access this area!')
       end
     end

app/controllers/conference_registration_controller.rb

@@ -1,7 +1,7 @@
 class ConferenceRegistrationController < ApplicationController
   before_filter :verify_user
-  load_and_authorize_resource :conference, find_by: :short_title
-  authorize_resource :conference_registration, class: Registration
+  load_resource :conference, find_by: :short_title
+  load_and_authorize_resource :conference_registration, class: Registration
 
   def register
     @workshops = @conference.events.where('require_registration = ? AND state LIKE ?',

app/models/ability.rb

@@ -23,12 +23,13 @@ class Ability
 
     # Check roles of user, using rolify. Role name is *case sensitive*
     # user.is_organizer? or user.has_role? :organizer
-    # user.is_cfp_of? Conference or user.has_role? :cfp, Conference
-    # user.is_info_desk_of? Conference
-    # user.is_volunteer_coordinator_of? Conference
-    # user.is_attendee_of? Conference
+    # We only assign roles per conference, so:
+    # user.is_cfp_of? Conference.find(1) or user.has_role? :cfp, @conference
+    # user.is_info_desk_of? @conference
+    # user.is_volunteer_coordinator_of? @conference
+    # user.is_attendee_of? @conference
     # The following is wrong because a user will only have 'cfp' role for a specific conference
-    # user.is_cfp? # This is always false
+    # user.is_cfp? # Always FALSE
 
     # Ids of all the conferences for which the user has an 'organizer' role
     conf_ids_for_organizer =
@@ -48,31 +49,23 @@ class Ability
     event_ids_for_user =
       EventUser.where(user_id: user.id).pluck(:event_id)
 
-    ## Abilities for everyone, even guests (not logged in users)
-    can :show, Conference do |conference|
-      conference.make_conference_public
-    end
+    ## Abilities for everyone (incl. GUESTS - not logged in users)
+    can :show, Conference, make_conference_public: true
 
-    can :show, Event do |event|
-      event.state == 'confirmed'
-    end
+    can :show, Event, state: 'confirmed'
 
-    can :index, :schedule # show?
+    can :index, :schedule
 
     ## Abilities for signed in users
     unless user.new_record?
-      can :show, Conference do |conference|
-        conference.make_conference_public
-      end
-
       # Conference Registration
-      can :manage, Registration
+      can [:register, :update, :unregister], Registration, user_id: user.id
 
       # Proposals
       # Users can edit their own proposals
       # Organizer and CfP team can edit any proposal they want
       # Can manage an event if the user is a speaker or a submitter of that event
-#       can [:index, :create], Event
+
       can :create, Event
       can :manage, Event do |event|
         event.event_users.where(:user_id => user.id).present?
@@ -88,7 +81,7 @@ class Ability
     if user.is_admin # is_admin is an attribute of User
       can :create, Conference
       can :index, Conference # this will allow the Conference to appear in the menu
-      can :view, Conference # for /admin/conference overview
+      can :show, Conference # for /admin/conference overview
       can :manage, User # to make other users admins
     end