From 40098183e43d80ca79bf11562d3ff3baa8c44127 Mon Sep 17 00:00:00 2001 From: Stella Rouzi Date: Sun, 13 Jul 2014 08:50:46 +0300 Subject: [PATCH] set up abilities --- app/models/ability.rb | 53 ++++++++++++--- app/models/admin_ability.rb | 108 +++++++++++++++++++++++++++++- app/models/conference.rb | 1 + app/views/proposal/show.html.haml | 2 +- 4 files changed, 152 insertions(+), 12 deletions(-) diff --git a/app/models/ability.rb b/app/models/ability.rb index 4fbc3135..b250991a 100644 --- a/app/models/ability.rb +++ b/app/models/ability.rb @@ -2,15 +2,6 @@ class Ability include CanCan::Ability def initialize(user) - # Define abilities for the passed in user here. For example: - # - user ||= User.new # guest user (not logged in) - # if user.admin? - # can :manage, :all - # else - # can :read, :all - # end - # # The first argument to `can` is the action you are giving the user permission to do. # If you pass :manage it will apply to every action. Other common actions here are # :read, :create, :update and :destroy. @@ -24,5 +15,49 @@ class Ability # can :update, Article, :published => true # # See the wiki for details: https://github.com/ryanb/cancan/wiki/Defining-Abilities + + # Order Abilities + # (Check https://github.com/CanCanCommunity/cancancan/wiki/Ability-Precedence) + + user ||= User.new # guest user (not logged in) + + # Abilities per role + + # Abilities for signed in users + unless user.new_record? + # Can manage any conference for which user is organizer + # We need this so that the user menus will properly display admin options + can :manage, Conference, id: Conference.with_role(:organizer, user).map(&:id) + + # Conference Registration + can :manage, :conference_registration + + # Proposals + # Users can edit their own proposals + # Organizer and CfP team can edit any proposal they want + + # Can manage an event if the user is a speaker or a submitter of that event + can :manage, Event do |event| + event.event_users.where(:user_id => user.id).present? + end + + # Also an organizer can manage that Event + # With the following ability organizers can access the event/proposal directly from + # the same link as submitters: /conference/conference_id/proposal/id/edit + can :manage, Event, conference_id: Conference.with_role(:organizer, user).map(&:id) + can :manage, Event, conference_id: Conference.with_role(:cfp, user).map(&:id) + + can :create, Event + can :manage, EventAttachment do |ea| + Event.find(ea.event_id).event_users.where(user_id: user.id).present? + end + can :create, EventAttachment + end + + # Abilities for everyone, even guests (not logged in users) + can :show, Conference#, make_conference_public: true + can :show, Event # if confirmed...? + can :index, :schedule # show? + end end diff --git a/app/models/admin_ability.rb b/app/models/admin_ability.rb index d90e01e9..e4deb085 100644 --- a/app/models/admin_ability.rb +++ b/app/models/admin_ability.rb @@ -2,10 +2,114 @@ class AdminAbility include CanCan::Ability def initialize(user) + # Check roles of user, using rolify. Role name is *case sensitive* + # user.is_organizer? or user.has_role? :organizer + # user.is_cfp_of? Conference or user.has_role? :cfp, Conference + # user.is_info_desk_of? Conference + # user.is_volunteer_coordinator_of? Conference + # user.is_attendee_of? Conference + # The following is wrong because a user will only have 'cfp' role for a specific conference + # user.is_cfp? # This is always false + user ||= User.new # for guest - if user.role?('Conference Admin') - can :manage, :all + + if user.new_record? + cannot :manage, :all end + # Ids of all the conferences for which the user has an 'organizer' role + conf_ids_for_organizer = + Conference.with_role(:organizer, user).pluck(:id) unless user.new_record? + # Ids of all the conferences for which the user has a 'cfp' role + conf_ids_for_cfp = + Conference.with_role(:cfp, user).pluck(:id) unless user.new_record? + # Ids of all the conferences for which the user has an 'info_desk' role + conf_ids_for_info_desk = + Conference.with_role(:info_desk, user).pluck(:id) unless user.new_record? + # Ids of all the conferences for which the user has a 'volunteer_coordinator' role + conf_ids_for_volunteer_coordinator = + Conference.with_role(:volunteer_coordinator, user).pluck(:id) unless user.new_record? + + ## Authorization for ORGANIZER + # If a user is organizer of a conference, they can manage everything related to this conference + + if user.has_role? :organizer, :any + can :manage, :all, conference_id: conf_ids_for_organizer + + # Registrations controller authorizes conference resource too, so we don't have to worry about + # accessing the new registration page of a conference we don't have access to + can :create, Registration + + # Override previous can because + # Models Conference, Venue, User, Schedule do not have a 'conference_id' attribute + cannot :manage, Conference + cannot :manage, Venue + cannot :manage, User + cannot :manage, :schedule + can :manage, :schedule + +# cannot :manage, Registration +# can :manage, Registration, conference: { id: conf_ids_for_organizer} + # Authorize explicitely, so that it doesn't look for a 'conference_id' + can :manage, :volunteer + + # Authorize Conference by its 'id' attribute + can :manage, Conference, id: conf_ids_for_organizer + # Authorize venues of conferences, which user can manage + can :manage, Venue, conference: { id: conf_ids_for_organizer } + # id: Conference.where(id: conf_ids_for_organizer).map(&:venue_id) + # User can view the admin 'users' page if he is an organizer for any conference + can :manage, User if user.has_role?('organizer', :any) + # To assign roles to users + # can :manage, Role, resource_id: conf_ids_for_organizer + end + + if user.is_organizer? # A user can have 'organizer' role not associated to specific conference + can :create, Conference + # Can manage /admin/conference # any organizer of any conference and anyone who can create a conf can view the /admin/conference + end + + ## Authorization for CfP + # A user can manage events of the conference, for which conference the user has a 'cfp' role + if user.has_role? :cfp, :any + # Can view dashboard for specific conference (show) and for all conference (index) + can [:index, :show], Conference, id: conf_ids_for_cfp + can :manage, Event, conference_id: conf_ids_for_cfp + can :manage, CallForPapers, conference_id: conf_ids_for_cfp + can :manage, EventType, conference_id: conf_ids_for_cfp + can :manage, Track, conference_id: conf_ids_for_cfp + can :manage, DifficultyLevel, conference_id: conf_ids_for_cfp + can :manage, :schedule + + can :manage, EmailSettings, conference_id: conf_ids_for_cfp + can :index, User + end + + ## Authorization for Info Desk + if user.has_role? :info_desk, :any + can [:index, :show], Conference, id: conf_ids_for_info_desk + can :manage, Registration, conference_id: conf_ids_for_info_desk + can :manage, Question, conference_id: conf_ids_for_info_desk + + # Previously we authorized Registrations of a specific conference, but that doesn't work + # if we want to create a new one, which does not belong to any conference yet + # Registrations controller authorizes conference resource too, so we don't have to worry about + # accessing the new registration page of a conference we don't have access to + can :create, Registration + + can :index, User + end + + ## Authorization for Volunteer Coordinator + if user.has_role? :volunteer_coordinator, :any + can [:index, :show], Conference, id: conf_ids_for_volunteer_coordinator + can :manage, Vposition, conference_id: conf_ids_for_volunteer_coordinator + can :manage, Vday, conference_id: conf_ids_for_volunteer_coordinator + can :manage, :volunteer + end + + # Allow access to event_attachments that belong to events (via event_id), which + # events belong to a conference (via conference_id) that has an organizer role for current user +# can :manage, EventAttachment, event_id: (Event.where(conference_id: conf_ids_for_organizer).pluck(:id)) end end diff --git a/app/models/conference.rb b/app/models/conference.rb index d2a3a907..c8c949ef 100644 --- a/app/models/conference.rb +++ b/app/models/conference.rb @@ -4,6 +4,7 @@ class Conference < ActiveRecord::Base require 'uri' serialize :events_per_week, Hash + resourcify # Needed to call 'Conference.with_role' in /models/ability.rb and admin_ability.rb attr_accessible :title, :short_title, :social_tag, :contact_email, :timezone, :html_export_path, :start_date, :end_date, :rooms_attributes, :tracks_attributes, diff --git a/app/views/proposal/show.html.haml b/app/views/proposal/show.html.haml index 1478b3ae..fd4e44ef 100644 --- a/app/views/proposal/show.html.haml +++ b/app/views/proposal/show.html.haml @@ -7,7 +7,7 @@ %small = @event.subtitle = link_to "Schedule", conference_schedule_path(@conference.short_title), :class =>"btn btn-success pull-right" - - if has_role?(current_user, "admin") + - if can? :edit, @event = link_to "Edit", edit_admin_conference_event_path(@conference.short_title, @event), :class => "btn btn-mini btn-primary pull-right" .row .col-md-3