adding tests and some fixes in ability

app/controllers/proposal_controller.rb

@@ -1,6 +1,6 @@
 class ProposalController < ApplicationController
   before_filter :verify_user, except: [:show]
-  load_and_authorize_resource :conference, find_by: :short_title
+  load_resource :conference, find_by: :short_title
   load_and_authorize_resource :event, parent: false
   before_filter :setup
 

app/models/ability.rb

@@ -45,12 +45,25 @@ class Ability
     # Ids of all the conferences for which the user has a 'volunteer_coordinator' role
     conf_ids_for_volunteer_coordinator =
         Conference.with_role(:volunteer_coordinator, user).pluck(:id) unless user.new_record?
+    event_ids_for_user =
+      EventUser.where(user_id: user.id).pluck(:event_id)
 
-    # Abilities for signed in users
+    ## Abilities for everyone, even guests (not logged in users)
+    can :show, Conference do |conference|
+      conference.make_conference_public
+    end
+
+    can :show, Event do |event|
+      event.state == 'confirmed'
+    end
+
+    can :index, :schedule # show?
+
+    ## Abilities for signed in users
     unless user.new_record?
-      # Can manage any conference for which user is organizer
-      # We need this so that the user menus will properly display admin options
-      can :manage, Conference, id: Conference.with_role(:organizer, user).map(&:id)
+      can :show, Conference do |conference|
+        conference.make_conference_public
+      end
 
       # Conference Registration
       can :manage, Registration
@@ -58,31 +71,20 @@ class Ability
       # Proposals
       # Users can edit their own proposals
       # Organizer and CfP team can edit any proposal they want
-
       # Can manage an event if the user is a speaker or a submitter of that event
+#       can [:index, :create], Event
+      can :create, Event
       can :manage, Event do |event|
         event.event_users.where(:user_id => user.id).present?
       end
 
-      # Also an organizer can manage that Event
-      # With the following ability organizers can access the event/proposal directly from
-      # the same link as submitters: /conference/conference_id/proposal/id/edit
-      can :manage, Event, conference_id: Conference.with_role(:organizer, user).map(&:id)
-      can :manage, Event, conference_id: Conference.with_role(:cfp, user).map(&:id)
-
-      can :create, Event
       can :manage, EventAttachment do |ea|
         Event.find(ea.event_id).event_users.where(user_id: user.id).present?
       end
       can :create, EventAttachment
     end
 
-    # Abilities for everyone, even guests (not logged in users)
-    can :show, Conference#, make_conference_public: true
-    can :show, Event # if confirmed...?
-    can :index, :schedule # show?
-
-    ## Authorization for admins
+    ## Abilities for admins
     if user.is_admin # is_admin is an attribute of User
       can :create, Conference
       can :index, Conference # this will allow the Conference to appear in the menu
@@ -90,7 +92,7 @@ class Ability
       can :manage, User # to make other users admins
     end
 
-    ## Authorization for ORGANIZER
+    ## Abilities for ORGANIZER
     # If a user is organizer of a conference, they can manage everything related to this conference
 
     if user.has_role? :organizer, :any
@@ -117,12 +119,12 @@ class Ability
       can :manage, Venue, id: conf_ids_for_organizer_venue
       # id: Conference.where(id: conf_ids_for_organizer).map(&:venue_id)
       # User can view the admin 'users' page if he is an organizer for any conference
-      can :manage, User if user.has_role?('organizer', :any)
+      can :manage, User
       # To assign roles to users
       # can :manage, Role, resource_id: conf_ids_for_organizer
     end
 
-    ## Authorization for CfP
+    ## Abilities for CfP
     # A user can manage events of the conference, for which conference the user has a 'cfp' role
     if user.has_role? :cfp, :any
       # Can view dashboard for specific conference (show) and for all conference (index)
@@ -138,7 +140,7 @@ class Ability
       can :index, User
     end
 
-    ## Authorization for Info Desk
+    ## Abilities for Info Desk
     if user.has_role? :info_desk, :any
       can [:index, :show], Conference, id: conf_ids_for_info_desk
       can :manage, Registration, conference_id: conf_ids_for_info_desk
@@ -153,7 +155,7 @@ class Ability
       can :index, User
     end
 
-    ## Authorization for Volunteer Coordinator
+    ## Abilities for Volunteer Coordinator
     if user.has_role? :volunteer_coordinator, :any
       can [:index, :show], Conference, id: conf_ids_for_volunteer_coordinator
       can :manage, Vposition, conference_id: conf_ids_for_volunteer_coordinator

app/models/user.rb

@@ -54,7 +54,6 @@ class User < ActiveRecord::Base
 
   def setup_role
     is_admin = true if User.count == 0
-    roles << Role.where(name: 'participant') if roles.empty?
   end
 
   def self.prepare(params)

spec/models/ability_spec.rb

@@ -1,26 +1,57 @@
 require 'spec_helper'
-require "cancan/matchers"
+require 'cancan/matchers'
 
-describe "User" do
-  describe "abilities" do
+describe 'User' do
+  describe 'Abilities' do
     subject(:ability){ Ability.new(user) }
     let(:user){ nil }
+    let(:conference_not_public) { create(:conference, make_conference_public: false) }
+    let(:conference_public) { create(:conference)}
+    let(:event_confirmed) { create(:event, state: 'confirmed') }
+    let(:someevent) { create(:event) }
 
-    context "when is an admin" do
-      let!(:user) { create(:admin) }
+    context 'when is a guest' do  # Test abilities for guest users
 
-      it{ should be_able_to(:manage, Event.new) }
+      it{ should be_able_to(:show, conference_public)}
+      it{ should_not be_able_to(:show, conference_not_public)}
+
+      it{ should be_able_to(:show, event_confirmed)}
+      it{ should_not be_able_to(:show, someevent)}
+
+      it{ should be_able_to(:index, :schedule)}
+
+      it{ should_not be_able_to(:create, Event)}
+      it{ should_not be_able_to(:manage, Event)}
+      it{ should_not be_able_to(:manage, Conference)}
+      it{ should_not be_able_to(:manage, :any)}
     end
 
-    context "when is an participant" do
-      let(:user) { build(:participant) }
+    context 'when is a Signed In User' do # Test abilities for signed in users (without any role)
+      let(:user) { create(:participant) }
+      let(:registration1) { create(:registration, conference: conference_public, user: user) }
+      let(:registration2) { create(:registration, conference: conference_not_public, user: user) }
 
+
+      it{ should be_able_to(:create, Event) }
+      it{ should be_able_to(:index, Event) }
       it{ should_not be_able_to(:manage, Event.new) }
-      it{ should be_able_to(:create, Event.new) }
-      it{ should be_able_to(:read, Event.new) }
+      it{ should be_able_to(:show, event_confirmed) }
+
+      it{ should be_able_to(:manage, registration1) }
+      it{ should be_able_to(:manage, registration2) }
+
+      it{ should be_able_to(:show, conference_public)}
+      it{ should_not be_able_to(:show, conference_not_public)}
+      it{ should_not be_able_to(:manage, Conference) }
     end
 
-    context "when is an event owner" do
+    context '#is_admin?' do
+      let(:user) { create(:admin) }
+      it{ should be_able_to(:manage, User) }
+    end
+
+    context 'signed in users can manage their events' do
+>>>>>>> adding tests and some fixes in ability
       let(:user) { create(:participant) }
       let(:user2) { create(:participant) }
       let(:myevent) { create(:event, users: [user]) }
@@ -29,11 +60,56 @@ describe "User" do
       # Users are able to update and destroy their own events
       it{ should be_able_to(:update, myevent) }
       it{ should be_able_to(:destroy, myevent) }
+<<<<<<< HEAD
+=======
+      it{ should be_able_to(:manage, myevent) }
+>>>>>>> adding tests and some fixes in ability
 
       # Users are not able to update and destroy other users events
       it{ should_not be_able_to(:update, someevent) }
       it{ should_not be_able_to(:destroy, someevent) }
+<<<<<<< HEAD
     end
 
+=======
+      it{ should_not be_able_to(:manage, someevent) }
+    end
+
+    context 'when is an organizer' do
+      let!(:conference1) { create(:conference) }
+      let!(:conference2) { create(:conference) }
+      let(:role) { create(:role, name: 'organizer', resource: conference1) }
+      let(:user) { create(:user, role_ids: role.id) }
+      let(:someuser) { create(:user) }
+      let(:registration1) { create(:registration, user: someuser, conference_id: conference1.id) }
+
+      it{ should be_able_to(:manage, conference1) }
+      it{ should_not be_able_to(:manage, conference2) }
+      it{ should be_able_to(:manage, registration1) }
+      it{ should be_able_to(:create, Registration) }
+    end
+
+    context 'when is part of cfp' do
+      let!(:conference1) { create(:conference) }
+      let!(:conference2) { create(:conference) }
+      let(:role) { create(:role, name: 'cfp', resource: conference1) }
+      let(:user) { create(:user, role_ids: role.id) }
+      let(:event) { create(:event, conference_id: conference1.id) }
+      let(:someevent) { create(:event, conference_id: conference2.id) }
+      let(:cfp) { create(:call_for_papers, conference: conference1) }
+
+      it{ should_not be_able_to(:manage, conference1) }
+      it{ should_not be_able_to(:manage, conference2) }
+      it{ should be_able_to(:index, conference1) }
+      it{ should be_able_to(:show, conference1) }
+
+      it{ should be_able_to(:manage, event) }
+      it{ should_not be_able_to(:manage, someevent) }
+
+      it{ should be_able_to(:manage, cfp) }
+      it{ should be_able_to(:manage, create(:event_type, conference: conference1)) }
+#       it{ should_not be_able_to(:create, Registration) }
+    end
+>>>>>>> adding tests and some fixes in ability
   end
 end