From 439d632251793071bd78c160d4b8f6e6b9170b50 Mon Sep 17 00:00:00 2001 From: Stella Rouzi Date: Wed, 23 Jul 2014 18:05:25 +0300 Subject: [PATCH] adding tests and some fixes in ability --- app/controllers/proposal_controller.rb | 2 +- app/models/ability.rb | 48 +++++++------ app/models/user.rb | 1 - spec/models/ability_spec.rb | 98 +++++++++++++++++++++++--- 4 files changed, 113 insertions(+), 36 deletions(-) diff --git a/app/controllers/proposal_controller.rb b/app/controllers/proposal_controller.rb index e2472bfa..04597565 100644 --- a/app/controllers/proposal_controller.rb +++ b/app/controllers/proposal_controller.rb @@ -1,6 +1,6 @@ class ProposalController < ApplicationController before_filter :verify_user, except: [:show] - load_and_authorize_resource :conference, find_by: :short_title + load_resource :conference, find_by: :short_title load_and_authorize_resource :event, parent: false before_filter :setup diff --git a/app/models/ability.rb b/app/models/ability.rb index 7d833ed2..23a28c8a 100644 --- a/app/models/ability.rb +++ b/app/models/ability.rb @@ -45,12 +45,25 @@ class Ability # Ids of all the conferences for which the user has a 'volunteer_coordinator' role conf_ids_for_volunteer_coordinator = Conference.with_role(:volunteer_coordinator, user).pluck(:id) unless user.new_record? + event_ids_for_user = + EventUser.where(user_id: user.id).pluck(:event_id) - # Abilities for signed in users + ## Abilities for everyone, even guests (not logged in users) + can :show, Conference do |conference| + conference.make_conference_public + end + + can :show, Event do |event| + event.state == 'confirmed' + end + + can :index, :schedule # show? + + ## Abilities for signed in users unless user.new_record? - # Can manage any conference for which user is organizer - # We need this so that the user menus will properly display admin options - can :manage, Conference, id: Conference.with_role(:organizer, user).map(&:id) + can :show, Conference do |conference| + conference.make_conference_public + end # Conference Registration can :manage, Registration @@ -58,31 +71,20 @@ class Ability # Proposals # Users can edit their own proposals # Organizer and CfP team can edit any proposal they want - # Can manage an event if the user is a speaker or a submitter of that event +# can [:index, :create], Event + can :create, Event can :manage, Event do |event| event.event_users.where(:user_id => user.id).present? end - # Also an organizer can manage that Event - # With the following ability organizers can access the event/proposal directly from - # the same link as submitters: /conference/conference_id/proposal/id/edit - can :manage, Event, conference_id: Conference.with_role(:organizer, user).map(&:id) - can :manage, Event, conference_id: Conference.with_role(:cfp, user).map(&:id) - - can :create, Event can :manage, EventAttachment do |ea| Event.find(ea.event_id).event_users.where(user_id: user.id).present? end can :create, EventAttachment end - # Abilities for everyone, even guests (not logged in users) - can :show, Conference#, make_conference_public: true - can :show, Event # if confirmed...? - can :index, :schedule # show? - - ## Authorization for admins + ## Abilities for admins if user.is_admin # is_admin is an attribute of User can :create, Conference can :index, Conference # this will allow the Conference to appear in the menu @@ -90,7 +92,7 @@ class Ability can :manage, User # to make other users admins end - ## Authorization for ORGANIZER + ## Abilities for ORGANIZER # If a user is organizer of a conference, they can manage everything related to this conference if user.has_role? :organizer, :any @@ -117,12 +119,12 @@ class Ability can :manage, Venue, id: conf_ids_for_organizer_venue # id: Conference.where(id: conf_ids_for_organizer).map(&:venue_id) # User can view the admin 'users' page if he is an organizer for any conference - can :manage, User if user.has_role?('organizer', :any) + can :manage, User # To assign roles to users # can :manage, Role, resource_id: conf_ids_for_organizer end - ## Authorization for CfP + ## Abilities for CfP # A user can manage events of the conference, for which conference the user has a 'cfp' role if user.has_role? :cfp, :any # Can view dashboard for specific conference (show) and for all conference (index) @@ -138,7 +140,7 @@ class Ability can :index, User end - ## Authorization for Info Desk + ## Abilities for Info Desk if user.has_role? :info_desk, :any can [:index, :show], Conference, id: conf_ids_for_info_desk can :manage, Registration, conference_id: conf_ids_for_info_desk @@ -153,7 +155,7 @@ class Ability can :index, User end - ## Authorization for Volunteer Coordinator + ## Abilities for Volunteer Coordinator if user.has_role? :volunteer_coordinator, :any can [:index, :show], Conference, id: conf_ids_for_volunteer_coordinator can :manage, Vposition, conference_id: conf_ids_for_volunteer_coordinator diff --git a/app/models/user.rb b/app/models/user.rb index 6f51dc4a..565a1cb3 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -54,7 +54,6 @@ class User < ActiveRecord::Base def setup_role is_admin = true if User.count == 0 - roles << Role.where(name: 'participant') if roles.empty? end def self.prepare(params) diff --git a/spec/models/ability_spec.rb b/spec/models/ability_spec.rb index e8a801f2..f3549ea5 100644 --- a/spec/models/ability_spec.rb +++ b/spec/models/ability_spec.rb @@ -1,26 +1,57 @@ require 'spec_helper' -require "cancan/matchers" +require 'cancan/matchers' -describe "User" do - describe "abilities" do +describe 'User' do + describe 'Abilities' do subject(:ability){ Ability.new(user) } let(:user){ nil } + let(:conference_not_public) { create(:conference, make_conference_public: false) } + let(:conference_public) { create(:conference)} + let(:event_confirmed) { create(:event, state: 'confirmed') } + let(:someevent) { create(:event) } - context "when is an admin" do - let!(:user) { create(:admin) } + context 'when is a guest' do # Test abilities for guest users - it{ should be_able_to(:manage, Event.new) } + it{ should be_able_to(:show, conference_public)} + it{ should_not be_able_to(:show, conference_not_public)} + + it{ should be_able_to(:show, event_confirmed)} + it{ should_not be_able_to(:show, someevent)} + + it{ should be_able_to(:index, :schedule)} + + it{ should_not be_able_to(:create, Event)} + it{ should_not be_able_to(:manage, Event)} + it{ should_not be_able_to(:manage, Conference)} + it{ should_not be_able_to(:manage, :any)} end - context "when is an participant" do - let(:user) { build(:participant) } + context 'when is a Signed In User' do # Test abilities for signed in users (without any role) + let(:user) { create(:participant) } + let(:registration1) { create(:registration, conference: conference_public, user: user) } + let(:registration2) { create(:registration, conference: conference_not_public, user: user) } + + it{ should be_able_to(:create, Event) } + it{ should be_able_to(:index, Event) } it{ should_not be_able_to(:manage, Event.new) } - it{ should be_able_to(:create, Event.new) } - it{ should be_able_to(:read, Event.new) } + it{ should be_able_to(:show, event_confirmed) } + + it{ should be_able_to(:manage, registration1) } + it{ should be_able_to(:manage, registration2) } + + it{ should be_able_to(:show, conference_public)} + it{ should_not be_able_to(:show, conference_not_public)} + it{ should_not be_able_to(:manage, Conference) } end - context "when is an event owner" do + context '#is_admin?' do + let(:user) { create(:admin) } + it{ should be_able_to(:manage, User) } + end + + context 'signed in users can manage their events' do +>>>>>>> adding tests and some fixes in ability let(:user) { create(:participant) } let(:user2) { create(:participant) } let(:myevent) { create(:event, users: [user]) } @@ -29,11 +60,56 @@ describe "User" do # Users are able to update and destroy their own events it{ should be_able_to(:update, myevent) } it{ should be_able_to(:destroy, myevent) } +<<<<<<< HEAD +======= + it{ should be_able_to(:manage, myevent) } +>>>>>>> adding tests and some fixes in ability # Users are not able to update and destroy other users events it{ should_not be_able_to(:update, someevent) } it{ should_not be_able_to(:destroy, someevent) } +<<<<<<< HEAD end +======= + it{ should_not be_able_to(:manage, someevent) } + end + + context 'when is an organizer' do + let!(:conference1) { create(:conference) } + let!(:conference2) { create(:conference) } + let(:role) { create(:role, name: 'organizer', resource: conference1) } + let(:user) { create(:user, role_ids: role.id) } + let(:someuser) { create(:user) } + let(:registration1) { create(:registration, user: someuser, conference_id: conference1.id) } + + it{ should be_able_to(:manage, conference1) } + it{ should_not be_able_to(:manage, conference2) } + it{ should be_able_to(:manage, registration1) } + it{ should be_able_to(:create, Registration) } + end + + context 'when is part of cfp' do + let!(:conference1) { create(:conference) } + let!(:conference2) { create(:conference) } + let(:role) { create(:role, name: 'cfp', resource: conference1) } + let(:user) { create(:user, role_ids: role.id) } + let(:event) { create(:event, conference_id: conference1.id) } + let(:someevent) { create(:event, conference_id: conference2.id) } + let(:cfp) { create(:call_for_papers, conference: conference1) } + + it{ should_not be_able_to(:manage, conference1) } + it{ should_not be_able_to(:manage, conference2) } + it{ should be_able_to(:index, conference1) } + it{ should be_able_to(:show, conference1) } + + it{ should be_able_to(:manage, event) } + it{ should_not be_able_to(:manage, someevent) } + + it{ should be_able_to(:manage, cfp) } + it{ should be_able_to(:manage, create(:event_type, conference: conference1)) } +# it{ should_not be_able_to(:create, Registration) } + end +>>>>>>> adding tests and some fixes in ability end end