Merge 7822a8d4e3 into 6cde2a5f4a

app/controllers/conference_registrations_controller.rb

@@ -1,10 +1,13 @@
 class ConferenceRegistrationsController < ApplicationController
   before_filter :authenticate_user!, except: [:new, :create]
   load_resource :conference, find_by: :short_title
-  authorize_resource :conference_registrations, class: Registration
+  authorize_resource :conference_registrations, class: Registration, except: [:new, :create]
   before_action :set_registration, only: [:edit, :update, :destroy, :show]
 
   def new
+    @registration = Registration.new(conference_id: @conference.id)
+    authorize! :new, @registration
+
     # Redirect to registration edit when user is already registered
     if @conference.user_registered?(current_user)
       redirect_to edit_conference_conference_registrations_path(@conference.short_title)
@@ -15,18 +18,11 @@ class ConferenceRegistrationsController < ApplicationController
       return
     end
 
-    # avoid openid sign_in to redirect to register/new when the sign_in user had already a registration
-    if current_user && @conference.user_registered?(current_user)
-      redirect_to edit_conference_conference_registrations_path(@conference.short_title)
-    end
-
     if @conference.registration_limit_exceeded?
       redirect_to root_path, error: "Sorry, registration limit exceeded for #{@conference.title}"
       return
     end
 
-    @registration = Registration.new
-
     # @user variable needs to be set so that _sign_up_form_embedded works properly
     @user = @registration.build_user
   end
@@ -50,6 +46,7 @@ class ConferenceRegistrationsController < ApplicationController
     end
 
     @registration.user = @user
+    authorize! :create, @registration
 
     if @registration.save
       # Trigger ahoy event
@@ -90,9 +87,9 @@ class ConferenceRegistrationsController < ApplicationController
       redirect_to root_path,
                   notice: "You are not registered for #{@conference.title} anymore!"
     else
-      redirect_to root_path,
-                  error: "Could not update your registration for #{@conference.title}: "\
-                  "#{@registration.errors.full_messages.join('. ')}."
+      redirect_to conference_conference_registrations_path(@conference.short_title),
+                  flash: { error: "Could not delete your registration for #{@conference.title}: "\
+                  "#{@registration.errors.full_messages.join('. ')}." }
     end
   end
 

app/models/ability.rb

@@ -46,9 +46,13 @@ class Ability
     can :show, Commercial, commercialable_type: 'Event', commercialable_id: Event.where(state: 'confirmed').pluck(:id)
     can :show, User
     unless CONFIG['authentication']['ichain']['enabled']
-      can [:show, :create], Registration do |registration|
+      can :show, Registration do |registration|
         registration.new_record?
       end
+
+      can [:new, :create], Registration do |registration|
+        registration.conference.registration_open? && registration.new_record?
+      end
       can :show, Event do |event|
         event.new_record?
       end
@@ -68,6 +72,10 @@ class Ability
 
     can :manage, Registration, user_id: user.id
 
+    can [:new, :create], Registration do |registration|
+      registration.conference.registration_open?
+    end
+
     can :index, Ticket
     can :manage, TicketPurchase, user_id: user.id