Allow other roles to view revision_history only with the versions they have access

app/controllers/admin/versions_controller.rb

@@ -4,7 +4,7 @@ module Admin
     load_and_authorize_resource class: PaperTrail::Version
 
     def index
-      @conf_ids_for_organizer = current_user.is_admin? ? Conference.pluck(:short_title) : Conference.with_role(:organizer, current_user).pluck(:short_title)
+      @conf_ids_with_role = current_user.is_admin? ? Conference.pluck(:short_title) : Conference.with_role([:organizer, :cfp, :info_desk], current_user).pluck(:short_title)
 
       return unless @conference.present?
       authorize! :index, PaperTrail::Version.new(conference_id: @conference.id)

app/models/ability.rb

@@ -211,8 +211,10 @@ class Ability
       (Conference.with_role(:cfp, user).pluck(:id).include? role.resource_id)
     end
 
-    can [:index, :revert_object, :revert_attribute], PaperTrail::Version, item_type: 'Event', conference_id: conf_ids_for_cfp
+    can [:index, :revert_object, :revert_attribute], PaperTrail::Version,
-    can [:index, :revert_object, :revert_attribute], PaperTrail::Version do |version|
+        item_type: %w(Event EventType Track DifficultyLevel EmailSettings Room Cfp Program Comment), conference_id: conf_ids_for_cfp
+    can [:index, :revert_object, :revert_attribute], PaperTrail::Version,
+        ["item_type = 'Commercial' AND conference_id IN (?) AND (object LIKE '%Event%' OR object_changes LIKE '%Event%')", conf_ids_for_cfp] do |version|
       version.item_type == 'Commercial' && conf_ids_for_cfp.include?(version.conference_id) &&
       (version.object.to_s.include?('Event') || version.object_changes.to_s.include?('Event'))
     end
@@ -237,6 +239,8 @@ class Ability
       role.resource_type == 'Conference' && role.name == 'info_desk' &&
       (Conference.with_role(:info_desk, user).pluck(:id).include? role.resource_id)
     end
+
+    can [:index, :revert_object, :revert_attribute], PaperTrail::Version, item_type: 'Registration', conference_id: conf_ids_for_info_desk
   end
 
   def signed_in_with_volunteers_coordinator_role(user)

app/views/admin/versions/index.html.haml

@@ -8,7 +8,7 @@
           %span.caret
         %ul.dropdown-menu
           %li= link_to 'All Conferences & Users',  admin_revision_history_path
-          - @conf_ids_for_organizer.each do |conference_short_title|
+          - @conf_ids_with_role.each do |conference_short_title|
             %li= link_to conference_short_title,  admin_conference_revision_history_path(conference_id: conference_short_title)
 
       %h1 Revision History

app/views/layouts/_admin_sidebar.html.haml

@@ -136,7 +136,7 @@
       = link_to(admin_conference_roles_path(@conference.short_title)) do
         %span.fa.fa-group
         Roles
-  - if can? :index, PaperTrail::Version.new(item_type: 'User')
+  - if can?(:index, PaperTrail::Version.new(conference_id: @conference.id, item_type: 'Event')) || can?(:index, PaperTrail::Version.new(conference_id: @conference.id, item_type: 'Registration'))
     %li{:class=> active_nav_li(admin_conference_revision_history_path(@conference.short_title))}
       = link_to(admin_conference_revision_history_path(@conference.short_title)) do
         %span.fa.fa-history

app/views/layouts/_admin_sidebar_index.html.haml

@@ -27,7 +27,7 @@
       = link_to(admin_users_path) do
         %span.fa.fa-user
         Users
-  - if can? :index, PaperTrail::Version.new(item_type: 'User')
+  - if can? :index, PaperTrail::Version
     %li
       = link_to(admin_revision_history_path) do
         %span.fa.fa-history

app/views/layouts/_user_menu.html.haml

@@ -44,7 +44,7 @@
     = link_to(admin_users_path) do
       %span.fa.fa-user
       Users
-- if can? :index, PaperTrail::Version.new(item_type: 'User')
+- if can? :index, PaperTrail::Version
   %li
     = link_to(admin_revision_history_path) do
       %span.fa.fa-history

spec/features/ability_spec.rb

@@ -56,6 +56,7 @@ feature 'Has correct abilities' do
     expect(page).to have_link('Difficulty Levels', href: "/admin/conferences/#{conference1.short_title}/program/difficulty_levels")
     expect(page).to have_link('Questions', href: "/admin/conferences/#{conference1.short_title}/questions")
     expect(page).to have_link('Roles', href: "/admin/conferences/#{conference1.short_title}/roles")
+    expect(page).to have_link('Revision History', href: "/admin/conferences/#{conference1.short_title}/revision_history")
 
     visit edit_admin_conference_path(conference1.short_title)
     expect(current_path).to eq(edit_admin_conference_path(conference1.short_title))
@@ -137,6 +138,7 @@ feature 'Has correct abilities' do
     expect(page).to have_link('Difficulty Levels', href: "/admin/conferences/#{conference2.short_title}/program/difficulty_levels")
     expect(page).to_not have_link('Questions', href: "/admin/conferences/#{conference2.short_title}/questions")
     expect(page).to have_link('Roles', href: "/admin/conferences/#{conference2.short_title}/roles")
+    expect(page).to have_link('Revision History', href: "/admin/conferences/#{conference2.short_title}/revision_history")
 
     visit edit_admin_conference_path(conference2.short_title)
     expect(current_path).to eq(root_path)
@@ -181,7 +183,7 @@ feature 'Has correct abilities' do
     expect(current_path).to eq(root_path)
 
     visit admin_revision_history_path
-    expect(current_path).to eq(root_path)
+    expect(current_path).to eq(admin_revision_history_path)
   end
 
   scenario 'when user is info desk' do
@@ -214,6 +216,7 @@ feature 'Has correct abilities' do
     expect(page).to_not have_link('Difficulty levels', href: "/admin/conferences/#{conference3.short_title}/program/difficulty_levels")
     expect(page).to have_link('Questions', href: "/admin/conferences/#{conference3.short_title}/questions")
     expect(page).to have_link('Roles', href: "/admin/conferences/#{conference3.short_title}/roles")
+    expect(page).to have_link('Revision History', href: "/admin/conferences/#{conference3.short_title}/revision_history")
 
     visit edit_admin_conference_path(conference3.short_title)
     expect(current_path).to eq(root_path)
@@ -258,6 +261,6 @@ feature 'Has correct abilities' do
     expect(current_path).to eq(root_path)
 
     visit admin_revision_history_path
-    expect(current_path).to eq(root_path)
+    expect(current_path).to eq(admin_revision_history_path)
   end
 end