From 3a3d01150a0f4e0edfa2d1be11e99d5c9a32117f Mon Sep 17 00:00:00 2001 From: Nishanth Vijayan Date: Wed, 17 Aug 2016 05:05:46 +0530 Subject: [PATCH] Allow other roles to view revision_history only with the versions they have access --- app/controllers/admin/versions_controller.rb | 2 +- app/models/ability.rb | 8 ++++++-- app/views/admin/versions/index.html.haml | 2 +- app/views/layouts/_admin_sidebar.html.haml | 2 +- app/views/layouts/_admin_sidebar_index.html.haml | 2 +- app/views/layouts/_user_menu.html.haml | 2 +- spec/features/ability_spec.rb | 7 +++++-- 7 files changed, 16 insertions(+), 9 deletions(-) diff --git a/app/controllers/admin/versions_controller.rb b/app/controllers/admin/versions_controller.rb index 34aeffd1..69f57bb9 100644 --- a/app/controllers/admin/versions_controller.rb +++ b/app/controllers/admin/versions_controller.rb @@ -4,7 +4,7 @@ module Admin load_and_authorize_resource class: PaperTrail::Version def index - @conf_ids_for_organizer = current_user.is_admin? ? Conference.pluck(:short_title) : Conference.with_role(:organizer, current_user).pluck(:short_title) + @conf_ids_with_role = current_user.is_admin? ? Conference.pluck(:short_title) : Conference.with_role([:organizer, :cfp, :info_desk], current_user).pluck(:short_title) return unless @conference.present? authorize! :index, PaperTrail::Version.new(conference_id: @conference.id) diff --git a/app/models/ability.rb b/app/models/ability.rb index 699e4f54..773195f2 100644 --- a/app/models/ability.rb +++ b/app/models/ability.rb @@ -211,8 +211,10 @@ class Ability (Conference.with_role(:cfp, user).pluck(:id).include? role.resource_id) end - can [:index, :revert_object, :revert_attribute], PaperTrail::Version, item_type: 'Event', conference_id: conf_ids_for_cfp - can [:index, :revert_object, :revert_attribute], PaperTrail::Version do |version| + can [:index, :revert_object, :revert_attribute], PaperTrail::Version, + item_type: %w(Event EventType Track DifficultyLevel EmailSettings Room Cfp Program Comment), conference_id: conf_ids_for_cfp + can [:index, :revert_object, :revert_attribute], PaperTrail::Version, + ["item_type = 'Commercial' AND conference_id IN (?) AND (object LIKE '%Event%' OR object_changes LIKE '%Event%')", conf_ids_for_cfp] do |version| version.item_type == 'Commercial' && conf_ids_for_cfp.include?(version.conference_id) && (version.object.to_s.include?('Event') || version.object_changes.to_s.include?('Event')) end @@ -237,6 +239,8 @@ class Ability role.resource_type == 'Conference' && role.name == 'info_desk' && (Conference.with_role(:info_desk, user).pluck(:id).include? role.resource_id) end + + can [:index, :revert_object, :revert_attribute], PaperTrail::Version, item_type: 'Registration', conference_id: conf_ids_for_info_desk end def signed_in_with_volunteers_coordinator_role(user) diff --git a/app/views/admin/versions/index.html.haml b/app/views/admin/versions/index.html.haml index d7cc9798..860419af 100644 --- a/app/views/admin/versions/index.html.haml +++ b/app/views/admin/versions/index.html.haml @@ -8,7 +8,7 @@ %span.caret %ul.dropdown-menu %li= link_to 'All Conferences & Users', admin_revision_history_path - - @conf_ids_for_organizer.each do |conference_short_title| + - @conf_ids_with_role.each do |conference_short_title| %li= link_to conference_short_title, admin_conference_revision_history_path(conference_id: conference_short_title) %h1 Revision History diff --git a/app/views/layouts/_admin_sidebar.html.haml b/app/views/layouts/_admin_sidebar.html.haml index 0d2fe3c0..eab6a74b 100644 --- a/app/views/layouts/_admin_sidebar.html.haml +++ b/app/views/layouts/_admin_sidebar.html.haml @@ -136,7 +136,7 @@ = link_to(admin_conference_roles_path(@conference.short_title)) do %span.fa.fa-group Roles - - if can? :index, PaperTrail::Version.new(item_type: 'User') + - if can?(:index, PaperTrail::Version.new(conference_id: @conference.id, item_type: 'Event')) || can?(:index, PaperTrail::Version.new(conference_id: @conference.id, item_type: 'Registration')) %li{:class=> active_nav_li(admin_conference_revision_history_path(@conference.short_title))} = link_to(admin_conference_revision_history_path(@conference.short_title)) do %span.fa.fa-history diff --git a/app/views/layouts/_admin_sidebar_index.html.haml b/app/views/layouts/_admin_sidebar_index.html.haml index 4ae56dce..30ad5dcb 100644 --- a/app/views/layouts/_admin_sidebar_index.html.haml +++ b/app/views/layouts/_admin_sidebar_index.html.haml @@ -27,7 +27,7 @@ = link_to(admin_users_path) do %span.fa.fa-user Users - - if can? :index, PaperTrail::Version.new(item_type: 'User') + - if can? :index, PaperTrail::Version %li = link_to(admin_revision_history_path) do %span.fa.fa-history diff --git a/app/views/layouts/_user_menu.html.haml b/app/views/layouts/_user_menu.html.haml index 95c7937e..50aa14d3 100644 --- a/app/views/layouts/_user_menu.html.haml +++ b/app/views/layouts/_user_menu.html.haml @@ -44,7 +44,7 @@ = link_to(admin_users_path) do %span.fa.fa-user Users -- if can? :index, PaperTrail::Version.new(item_type: 'User') +- if can? :index, PaperTrail::Version %li = link_to(admin_revision_history_path) do %span.fa.fa-history diff --git a/spec/features/ability_spec.rb b/spec/features/ability_spec.rb index 2bcd8331..d5462db6 100644 --- a/spec/features/ability_spec.rb +++ b/spec/features/ability_spec.rb @@ -56,6 +56,7 @@ feature 'Has correct abilities' do expect(page).to have_link('Difficulty Levels', href: "/admin/conferences/#{conference1.short_title}/program/difficulty_levels") expect(page).to have_link('Questions', href: "/admin/conferences/#{conference1.short_title}/questions") expect(page).to have_link('Roles', href: "/admin/conferences/#{conference1.short_title}/roles") + expect(page).to have_link('Revision History', href: "/admin/conferences/#{conference1.short_title}/revision_history") visit edit_admin_conference_path(conference1.short_title) expect(current_path).to eq(edit_admin_conference_path(conference1.short_title)) @@ -137,6 +138,7 @@ feature 'Has correct abilities' do expect(page).to have_link('Difficulty Levels', href: "/admin/conferences/#{conference2.short_title}/program/difficulty_levels") expect(page).to_not have_link('Questions', href: "/admin/conferences/#{conference2.short_title}/questions") expect(page).to have_link('Roles', href: "/admin/conferences/#{conference2.short_title}/roles") + expect(page).to have_link('Revision History', href: "/admin/conferences/#{conference2.short_title}/revision_history") visit edit_admin_conference_path(conference2.short_title) expect(current_path).to eq(root_path) @@ -181,7 +183,7 @@ feature 'Has correct abilities' do expect(current_path).to eq(root_path) visit admin_revision_history_path - expect(current_path).to eq(root_path) + expect(current_path).to eq(admin_revision_history_path) end scenario 'when user is info desk' do @@ -214,6 +216,7 @@ feature 'Has correct abilities' do expect(page).to_not have_link('Difficulty levels', href: "/admin/conferences/#{conference3.short_title}/program/difficulty_levels") expect(page).to have_link('Questions', href: "/admin/conferences/#{conference3.short_title}/questions") expect(page).to have_link('Roles', href: "/admin/conferences/#{conference3.short_title}/roles") + expect(page).to have_link('Revision History', href: "/admin/conferences/#{conference3.short_title}/revision_history") visit edit_admin_conference_path(conference3.short_title) expect(current_path).to eq(root_path) @@ -258,6 +261,6 @@ feature 'Has correct abilities' do expect(current_path).to eq(root_path) visit admin_revision_history_path - expect(current_path).to eq(root_path) + expect(current_path).to eq(admin_revision_history_path) end end