Allow submission of proposal only if program has cfp

app/controllers/proposal_controller.rb

@@ -2,9 +2,11 @@ class ProposalController < ApplicationController
   before_filter :authenticate_user!, except: [:show, :new, :create]
   load_resource :conference, find_by: :short_title
   load_resource :program, through: :conference, singleton: true
-  load_and_authorize_resource :event, parent: false, through: :program
+  load_and_authorize_resource :event, parent: false, through: :program, except: [:new, :create]
 
   def index
+    @event = @program.events.new
+    @event.event_users.new(user: current_user, event_role: 'submitter')
     @events = current_user.proposals(@conference)
   end
 
@@ -14,6 +16,9 @@ class ProposalController < ApplicationController
   end
 
   def new
+    @event = @program.events.new
+    @event.event_users.new(user: current_user, event_role: 'submitter') if current_user
+    authorize! :new, @event
     @user = User.new
     @url = conference_program_proposal_index_path(@conference.short_title)
   end
@@ -46,6 +51,7 @@ class ProposalController < ApplicationController
                            event_role: 'submitter')
     @event.event_users.new(user: current_user,
                            event_role: 'speaker')
+    authorize! :new, @event
 
     unless @event.save
       flash[:error] = "Could not submit proposal: #{@event.errors.full_messages.join(', ')}"

app/models/ability.rb

@@ -76,8 +76,12 @@ class Ability
     can :manage, Event do |event|
       event.users.include?(user)
     end
-    # can create an event until the last day of a conference
-    can :create, Event, program_id: Conference.where('end_date >= ?', Date.today).map { |conference| conference.program.id}.compact
+
+    # cannot create an event if program does not have open cfp
+    cannot [:new, :create], Event do |event|
+      user_inclusion = event.event_users.map { |event_user| event_user.user.id }.compact.include? user.id
+      !event.program.cfp_open? || !event.new_record? || !user_inclusion
+    end
 
     # can manage the commercials of their own events
     can :manage, Commercial, commercialable_type: 'Event', commercialable_id: user.events.pluck(:id)

app/views/proposal/index.html.haml

@@ -98,5 +98,5 @@
                   class: 'btn btn-default', id: "edit_proposal_#{event.id}"
   .row
     .col-md-12
-      - if can? :create, @program.events.new
+      - if can? :create, @event
         = link_to "New Proposal", new_conference_program_proposal_path(@conference.short_title), :class => "btn btn-success pull-right"

spec/factories/events.rb

@@ -31,7 +31,7 @@ FactoryGirl.define do
       libero quis porta ultricies. Fusce pulvinar accumsan lobortis.
     EOS
     after(:build) do |event|
-      event.event_users << build(:submitter)
+      event.event_users << build(:submitter) unless event.submitter # so that we don't have two submitters
       # set an event_type if none is passed to the factory.
       # needs to be created here because otherwise it doesn't belong to the
       # same conference as the event

spec/models/ability_spec.rb

@@ -32,6 +32,9 @@ describe 'User' do
 
     let(:registration) { create(:registration) }
 
+    let(:program_with_cfp) { create(:program, cfp: create(:cfp)) }
+    let(:program_without_cfp) { create(:program) }
+
     # Test abilities for not signed in users
     context 'when user is not signed in' do
       it{ should be_able_to(:index, Conference)}
@@ -58,7 +61,9 @@ describe 'User' do
       it{ should be_able_to(:show, Registration.new)}
       it{ should_not be_able_to(:manage, registration)}
 
-      it{ should be_able_to(:create, Event)}
+      it{ should be_able_to(:new, Event.new(program: program_with_cfp)) }
+      it{ should_not be_able_to(:new, Event.new(program: program_without_cfp)) }
+      it{ should_not be_able_to(:create, Event.new(program: program_without_cfp))}
       it{ should be_able_to(:show, Event.new)}
 
       it{ should_not be_able_to(:manage, :any)}
@@ -68,12 +73,14 @@ describe 'User' do
     context 'when user is signed in' do
       let(:user) { create(:user) }
       let(:user2) { create(:user) }
+      let(:event_user2) { create(:submitter, user: user2) }
+
       let(:subscription) { create(:subscription, user: user) }
       let(:registration_public) { create(:registration, conference: conference_public, user: user) }
       let(:registration_not_public) { create(:registration, conference: conference_not_public, user: user) }
 
-      let(:user_event) { create(:event, users: [user]) }
-      let(:user_commercial) { create(:commercial, commercialable: user_event) }
+      let(:user_event_with_cfp) { create(:event, users: [user], program: program_with_cfp) }
+      let(:user_commercial) { create(:commercial, commercialable: user_event_with_cfp) }
 
       it{ should be_able_to(:manage, user) }
 
@@ -86,11 +93,15 @@ describe 'User' do
       it{ should be_able_to(:create, Subscription.new(user_id: user.id)) }
       it{ should be_able_to(:destroy, subscription) }
 
-      it{ should be_able_to(:create, Event) }
-      it{ should be_able_to(:manage, user_event) }
+      it{ should be_able_to(:manage, user_event_with_cfp) }
+      it{ should_not be_able_to(:new, Event.new(program: program_without_cfp)) }
+      it{ should_not be_able_to(:create, Event.new(program: program_without_cfp)) }
+      it{ should_not be_able_to(:new, Event.new(program: program_with_cfp, event_users: [event_user2])) }
+      it{ should_not be_able_to(:create, Event.new(program: program_with_cfp, event_users: [event_user2])) }
+
       it{ should_not be_able_to(:manage, event_unconfirmed) }
 
-      it{ should be_able_to(:create, user_event.commercials.new) }
+      it{ should be_able_to(:create, user_event_with_cfp.commercials.new) }
       it{ should be_able_to(:manage, user_commercial) }
       it{ should_not be_able_to(:manage, commercial_event_unconfirmed) }
     end