From 24859233193fffa5cb729e1c768254923121cf4b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ana=20Mar=C3=ADa=20Mart=C3=ADnez=20G=C3=B3mez?=
 <ammartinez@suse.de>
Date: Sun, 19 Mar 2017 10:34:14 +0100
Subject: [PATCH] Move update favorites to a separate action

Introduce a separate action `toggle_favorite` to update user favorites events.
Otherwise users with permissions to update the event can have it as favorite.
---
 app/controllers/proposals_controller.rb      | 54 +++++++++-----------
 app/views/schedules/_event.html.haml         |  2 +-
 app/views/schedules/_schedule_item.html.haml |  2 +-
 config/routes.rb                             |  1 +
 4 files changed, 28 insertions(+), 31 deletions(-)

diff --git a/app/controllers/proposals_controller.rb b/app/controllers/proposals_controller.rb
index efdfa887..a64832e1 100644
--- a/app/controllers/proposals_controller.rb
+++ b/app/controllers/proposals_controller.rb
@@ -6,7 +6,7 @@ class ProposalsController < ApplicationController
   load_resource :program, through: :conference, singleton: true
   load_and_authorize_resource :event, parent: false, through: :program
   # We authorize manually in these actions
-  skip_authorize_resource :event, only: [:confirm, :restart, :withdraw]
+  skip_authorize_resource :event, only: [:confirm, :restart, :toogle_favorite, :withdraw]
 
   def index
     @event = @program.events.new
@@ -68,36 +68,32 @@ class ProposalsController < ApplicationController
   end
 
   def update
-    respond_to do |format|
-      format.html do
-        @url = conference_program_proposal_path(@conference.short_title, params[:id])
+    @url = conference_program_proposal_path(@conference.short_title, params[:id])
 
-        track = Track.find_by(id: params[:event][:track_id])
-        if track && !track.cfp_active
-          flash.now[:error] = 'You have selected a track that doesn\'t accept proposals'
-          render action: 'edit'
-          return
-        end
-
-        if @event.update(event_params)
-          redirect_to conference_program_proposals_path(conference_id: @conference.short_title),
-                      notice: 'Proposal was successfully updated.'
-        else
-          flash[:error] = "Could not update proposal: #{@event.errors.full_messages.join(', ')}"
-          render action: 'edit'
-        end
-      end
-      format.json do
-        user = User.find(params[:favourite_user_id])
-        users = @event.favourite_users
-        if users.include? user
-          @event.favourite_users.delete(user)
-        else
-          @event.favourite_users << User.find(params[:favourite_user_id])
-        end
-        render json: {}
-      end
+    track = Track.find_by(id: params[:event][:track_id])
+    if track && !track.cfp_active
+      flash.now[:error] = 'You have selected a track that doesn\'t accept proposals'
+      render action: 'edit'
+      return
     end
+
+    if @event.update(event_params)
+      redirect_to conference_program_proposals_path(conference_id: @conference.short_title),
+                  notice: 'Proposal was successfully updated.'
+    else
+      flash[:error] = "Could not update proposal: #{@event.errors.full_messages.join(', ')}"
+      render action: 'edit'
+    end
+  end
+  def toogle_favorite
+    user = User.find(params[:favourite_user_id])
+    users = @event.favourite_users
+    if users.include? user
+      @event.favourite_users.delete(user)
+    else
+      @event.favourite_users << user
+    end
+    render json: {}
   end
 
   def withdraw
diff --git a/app/views/schedules/_event.html.haml b/app/views/schedules/_event.html.haml
index 41eca5b8..e5d9a5b0 100644
--- a/app/views/schedules/_event.html.haml
+++ b/app/views/schedules/_event.html.haml
@@ -11,7 +11,7 @@
       = link_to('#', onClick: 'starClicked();') do
         %span#star-events{ class: "fa fa-lg #{ event.favourite_users.exists?(current_user.id) ? 'fa-star' : 'fa-star-o' }", |
                            "aria-hidden" => "true", |
-                           "data-url" => conference_program_proposal_path(@conference.short_title, event.id), |
+                           "data-url" => toogle_favorite_conference_program_proposal_path(@conference.short_title, event.id), |
                            "data-user" => current_user.id }
     %span.h3
       = event.title
diff --git a/app/views/schedules/_schedule_item.html.haml b/app/views/schedules/_schedule_item.html.haml
index 97ee0317..b7d01f7a 100644
--- a/app/views/schedules/_schedule_item.html.haml
+++ b/app/views/schedules/_schedule_item.html.haml
@@ -11,7 +11,7 @@
         = link_to('#', onClick: 'starClicked();') do
           %span#star{ class: "fa fa-lg #{ event.favourite_users.exists?(current_user.id) ? 'fa-star' : 'fa-star-o' }", |
                       "aria-hidden" =>"true", |
-                      "data-url" => conference_program_proposal_path(@conference.short_title, event.id), |
+                      "data-url" => toogle_favorite_conference_program_proposal_path(@conference.short_title, event.id), |
                       "data-user" => current_user.id }
       = event.title
 
diff --git a/config/routes.rb b/config/routes.rb
index 730d43cf..53171e44 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -166,6 +166,7 @@ Osem::Application.routes.draw do
           patch '/withdraw' => 'proposals#withdraw'
           patch '/confirm' => 'proposals#confirm'
           patch '/restart' => 'proposals#restart'
+          patch :toogle_favorite
         end
       end
       resources :tracks, except: :destroy do