Merge pull request #1001 from ChrisBr/ability

Fixes ability

app/controllers/proposal_controller.rb

@@ -2,7 +2,9 @@ class ProposalController < ApplicationController
   before_filter :authenticate_user!, except: [:show, :new, :create]
   load_resource :conference, find_by: :short_title
   load_resource :program, through: :conference, singleton: true
-  load_and_authorize_resource :event, parent: false, through: :program, except: [:new, :create]
+  load_and_authorize_resource :event, parent: false, through: :program
+  # We authorize manually in these actions
+  skip_authorize_resource :event, only: [:confirm, :restart, :withdraw]
 
   def index
     @event = @program.events.new
@@ -16,9 +18,6 @@ class ProposalController < ApplicationController
   end
 
   def new
-    @event = @program.events.new
-    @event.event_users.new(user: current_user, event_role: 'submitter') if current_user
-    authorize! :new, @event
     @user = User.new
     @url = conference_program_proposal_index_path(@conference.short_title)
   end
@@ -44,11 +43,6 @@ class ProposalController < ApplicationController
       end
     end
 
-    params[:event].delete :user
-
-    @event = Event.new(event_params)
-    @event.program = @program
-
     # User which creates the proposal is both `submitter` and `speaker` of proposal
     # by default.
     # TODO: Allow submitter to add speakers to proposals
@@ -56,8 +50,6 @@ class ProposalController < ApplicationController
                            event_role: 'submitter')
     @event.event_users.new(user: current_user,
                            event_role: 'speaker')
-    authorize! :new, @event
-
     if @event.save
       ahoy.track 'Event submission', title: 'New submission'
       redirect_to conference_program_proposal_index_path(@conference.short_title), notice: 'Proposal was successfully submitted.'

app/models/ability.rb

@@ -82,14 +82,12 @@ class Ability
 
     can [:create, :destroy], Subscription, user_id: user.id
 
-    can :manage, Event do |event|
+    can [:new, :create], Event do |event|
-      event.users.include?(user)
+      event.program.cfp_open? && event.new_record?
     end
 
-    # cannot create an event if program does not have open cfp
+    can [:update, :show, :delete, :index], Event do |event|
-    cannot [:new, :create], Event do |event|
+      event.users.include?(user)
-      user_inclusion = event.event_users.map { |event_user| event_user.user.id }.compact.include? user.id
-      !event.program.cfp_open? || !event.new_record? || !user_inclusion
     end
 
     # can manage the commercials of their own events

spec/features/proposal_spec.rb

@@ -13,6 +13,8 @@ feature Event do
     @options = {}
     @options[:send_mail] = 'false'
     @event = create(:event, program: conference.program, title: 'Example Proposal')
+    @event.event_users.create(user: participant, event_role: 'submitter')
+    @event.event_users.create(user: participant, event_role: 'speaker')
   end
 
   after(:each) do
@@ -63,10 +65,6 @@ feature Event do
   context 'as a participant' do
     before(:each) do
       @event.accept!(@options)
-      @event.event_users = [create(:event_user,
-                                   user_id: participant.id,
-                                   event_id: @event.id,
-                                   event_role: 'submitter')]
     end
 
     scenario 'not signed_in user submits proposal' do

spec/models/ability_spec.rb

@@ -103,11 +103,15 @@ describe 'User' do
       it{ should be_able_to(:create, Subscription.new(user_id: user.id)) }
       it{ should be_able_to(:destroy, subscription) }
 
-      it{ should be_able_to(:manage, user_event_with_cfp) }
+      it{ should be_able_to(:update, user_event_with_cfp) }
+      it{ should be_able_to(:show, user_event_with_cfp) }
+      it{ should be_able_to(:delete, user_event_with_cfp) }
       it{ should_not be_able_to(:new, Event.new(program: program_without_cfp)) }
       it{ should_not be_able_to(:create, Event.new(program: program_without_cfp)) }
-      it{ should_not be_able_to(:new, Event.new(program: program_with_cfp, event_users: [event_user2])) }
+      # TODO: At moment it's not possible to manually add someone else as event_user
-      it{ should_not be_able_to(:create, Event.new(program: program_with_cfp, event_users: [event_user2])) }
+      # This needs some more work once we allow user to add event_user
+      it 'should_not be_able to :new, Event.new(program: program_with_cfp, event_users: [event_user2])'
+      it 'should_not be_able to :create, Event.new(program: program_with_cfp, event_users: [event_user2])'
 
       it{ should_not be_able_to(:manage, event_unconfirmed) }