gunghogeoduck/osem-fcy
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #942 from nishanthvijayan/fix-roles-authorization

Browse source 
Fix authorization issues with Roles
This commit is contained in:
Stella Rouzi 2016-04-25 17:18:24 +02:00
commit 0a5ba7a204
6 changed files with 77 additions and 51 deletions
Download patch file Download diff file Expand all files Collapse all files

4
spec/features/ability_spec.rb
View file

@ -11,13 +11,13 @@ feature 'Has correct abilities' do
let(:role_organizer) { Role.find_by(name: 'organizer', resource: conference1) }
let(:role_cfp) { Role.find_by(name: 'cfp', resource: conference2) }
let(:role_info_desk) { Role.find_by(name: 'info_desk', resource: conference3) }
let(:role_volunteer_coordinator) { Role.find_by(name: 'volunteers_coordinator', resource: conference4) }
let(:role_volunteers_coordinator) { Role.find_by(name: 'volunteers_coordinator', resource: conference4) }
let(:user) { create(:user) }
let(:user_organizer) { create(:user, role_ids: [role_organizer.id]) }
let(:user_cfp) { create(:user, role_ids: [role_cfp.id]) }
let(:user_info_desk) { create(:user, role_ids: [role_info_desk.id]) }
let(:user_volunteer_coordinator) { create(:user, role_ids: [role_volunteer_coordinator.id]) }
let(:user_volunteers_coordinator) { create(:user, role_ids: [role_volunteers_coordinator.id]) }
scenario 'when user has no role' do
sign_in user

47
spec/models/ability_spec.rb
View file

@ -126,6 +126,34 @@ describe 'User' do
it{ should_not be_able_to(:destroy, my_venue) }
end
shared_examples 'user with any role' do
before do
@other_conference = create(:conference)
end
%w(organizer cfp info_desk volunteers_coordinator).each do |role|
it{ should_not be_able_to(:toggle_user, Role.find_by(name: role, resource: @other_conference)) }
it{ should_not be_able_to(:update, Role.find_by(name: role, resource: @other_conference)) }
it{ should_not be_able_to(:edit, Role.find_by(name: role, resource: @other_conference)) }
it{ should be_able_to(:show, Role.find_by(name: role, resource: @other_conference)) }
it{ should be_able_to(:index, Role.find_by(name: role, resource: @other_conference)) }
end
end
shared_examples 'user with non-organizer role' do |role_name|
%w(organizer cfp info_desk volunteers_coordinator).each do |role|
if role == role_name
it{ should be_able_to(:toggle_user, Role.find_by(name: role, resource: my_conference)) }
else
it{ should_not be_able_to(:toggle_user, Role.find_by(name: role, resource: my_conference)) }
end
it{ should_not be_able_to(:update, Role.find_by(name: role, resource: my_conference)) }
it{ should_not be_able_to(:edit, Role.find_by(name: role, resource: my_conference)) }
it{ should be_able_to(:show, Role.find_by(name: role, resource: my_conference)) }
it{ should be_able_to(:index, Role.find_by(name: role, resource: my_conference)) }
end
end
context 'when user has the role organizer' do
let!(:my_conference) { create(:full_conference) }
let(:role) { Role.find_by(name: 'organizer', resource: my_conference) }
@ -190,6 +218,16 @@ describe 'User' do
it{ should_not be_able_to(:manage, other_event.commercials.first) }
it{ should be_able_to(:index, my_event.comment_threads.first) }
it{ should_not be_able_to(:index, other_event.comment_threads.first) }
%w(organizer cfp info_desk volunteers_coordinator).each do |role|
it{ should be_able_to(:toggle_user, Role.find_by(name: role, resource: my_conference)) }
it{ should be_able_to(:edit, Role.find_by(name: role, resource: my_conference)) }
it{ should be_able_to(:update, Role.find_by(name: role, resource: my_conference)) }
it{ should be_able_to(:show, Role.find_by(name: role, resource: my_conference)) }
it{ should be_able_to(:index, Role.find_by(name: role, resource: my_conference)) }
end
it_behaves_like 'user with any role'
end
context 'when user has the role cfp' do
@ -245,6 +283,9 @@ describe 'User' do
it{ should_not be_able_to(:manage, other_event.commercials.first) }
it{ should be_able_to(:index, my_event.comment_threads.first) }
it{ should_not be_able_to(:index, other_event.comment_threads.first) }
it_behaves_like 'user with any role'
it_behaves_like 'user with non-organizer role', 'cfp'
end
context 'when user has the role info_desk' do
@ -300,6 +341,9 @@ describe 'User' do
it{ should_not be_able_to(:manage, other_event.commercials.first) }
it{ should_not be_able_to(:index, my_event.comment_threads.first) }
it{ should_not be_able_to(:index, other_event.comment_threads.first) }
it_behaves_like 'user with any role'
it_behaves_like 'user with non-organizer role', 'info_desk'
end
context 'when user has the role volunteers_coordinator' do
@ -357,6 +401,9 @@ describe 'User' do
it{ should_not be_able_to(:index, other_event.comment_threads.first) }
it 'should be_able to :manage Vposition'
it 'should be_able to :manage Vday'
it_behaves_like 'user with any role'
it_behaves_like 'user with non-organizer role', 'volunteers_coordinator'
end
end
end