diff --git a/app/controllers/admin/ticket_scannings_controller.rb b/app/controllers/admin/ticket_scannings_controller.rb new file mode 100644 index 00000000..488f28a1 --- /dev/null +++ b/app/controllers/admin/ticket_scannings_controller.rb @@ -0,0 +1,16 @@ +module Admin + class TicketScanningsController < Admin::BaseController + before_action :authenticate_user! + load_resource :physical_ticket, find_by: :token + # We authorize manually in these actions + skip_authorize_resource only: [:create] + + def create + @ticket_scanning = TicketScanning.new(physical_ticket: @physical_ticket) + authorize! :create, @ticket_scanning + @ticket_scanning.save + redirect_to conferences_path, + notice: "Ticket with token #{@physical_ticket.token} successfully scanned." + end + end +end diff --git a/app/models/admin_ability.rb b/app/models/admin_ability.rb index 4244d049..256262f4 100644 --- a/app/models/admin_ability.rb +++ b/app/models/admin_ability.rb @@ -145,6 +145,10 @@ class AdminAbility can :manage, Sponsor, conference_id: conf_ids can :manage, SponsorshipLevel, conference_id: conf_ids can :manage, Ticket, conference_id: conf_ids + can :create, TicketScanning do |ticket_scanning| + conf_id = ticket_scanning.physical_ticket.ticket_purchase.conference_id + conf_ids.include? conf_id + end can :index, Comment, commentable_type: 'Event', commentable_id: Event.where(program_id: Program.where(conference_id: conf_ids).pluck(:id)).pluck(:id) @@ -220,6 +224,10 @@ class AdminAbility can :manage, Question do |question| !(question.conferences.pluck(:id) & conf_ids_for_info_desk).empty? end + can :create, TicketScanning do |ticket_scanning| + conf_id = ticket_scanning.physical_ticket.ticket_purchase.conference_id + conf_ids_for_info_desk.include? conf_id + end # Abilities for Role (Conference resource) can [:index, :show], Role do |role| diff --git a/config/routes.rb b/config/routes.rb index 5a17d314..98211087 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -26,6 +26,7 @@ Osem::Application.routes.draw do patch :toggle_confirmation end end + resource :ticket_scanning, only: [:create] resources :comments, only: [:index] resources :conferences do resource :contact, except: [:index, :new, :create, :show, :destroy] diff --git a/spec/controllers/admin/ticket_scannings_controller_spec.rb b/spec/controllers/admin/ticket_scannings_controller_spec.rb new file mode 100644 index 00000000..245bd885 --- /dev/null +++ b/spec/controllers/admin/ticket_scannings_controller_spec.rb @@ -0,0 +1,60 @@ +require 'spec_helper' + +describe Admin::TicketScanningsController do + let(:admin) { create(:admin) } + let(:conference) { create(:conference) } + let(:user) { create(:user) } + let(:paid_ticket_purchase) { create(:ticket_purchase, conference: conference, user: user) } + let(:physical_ticket) { create(:physical_ticket, ticket_purchase: paid_ticket_purchase) } + + context 'logged in as user with no role' do + before :each do + sign_in user + end + describe 'POST #create' do + it 'does not create new ticket scanning' do + expected = expect do + post :create, physical_ticket_id: physical_ticket.token + end + expected.to_not change(TicketScanning, :count) + end + + it 'redirects to root' do + post :create, physical_ticket_id: physical_ticket.token + expect(flash[:alert]).to eq('You are not authorized to access this page.') + expect(response).to redirect_to(root_path) + end + end + end + + context 'logged in as admin' do + before :each do + sign_in admin + end + describe 'POST #create' do + context 'with valid physical_ticket' do + it 'creates new ticket scanning' do + expected = expect do + post :create, physical_ticket_id: physical_ticket.token + end + expected.to change { TicketScanning.count }.by(1) + end + + it 'redirects to index' do + post :create, physical_ticket_id: physical_ticket.token + expect(flash[:notice]).to eq("Ticket with token #{physical_ticket.token} successfully scanned.") + expect(response).to redirect_to(conferences_path) + end + end + + context 'with Invalid physical_ticket' do + it 'raises exception' do + expected = expect do + post :create, physical_ticket_id: 'XXXX' + end + expected.to raise_exception(ActiveRecord::RecordNotFound) + end + end + end + end +end