From 940f76bf139020d100bef64a55f706a11f5726ef Mon Sep 17 00:00:00 2001 From: Stella Rouzi Date: Fri, 18 Jul 2014 20:49:50 +0300 Subject: [PATCH] verify user if accessing admin area. Testing: setup organizer_conference_1_role --- app/controllers/application_controller.rb | 7 +++++ app/models/ability.rb | 5 +++- .../admin/conferences_controller_spec.rb | 30 ++++++++++++------- .../admin/users_controller_spec.rb | 4 +-- spec/factories/roles.rb | 8 ++++- spec/factories/users.rb | 7 +++-- spec/features/campaign_spec.rb | 4 +-- spec/features/cfp_spec.rb | 4 +-- spec/features/conference_spec.rb | 6 ++-- spec/features/difficulty_levels_spec.rb | 4 +-- spec/features/email_spec.rb | 4 +-- spec/features/event_types_spec.rb | 6 ++-- spec/features/lodgings_spec.rb | 4 +-- spec/features/proposal_spec.rb | 4 +-- spec/features/rooms_spec.rb | 4 +-- spec/features/sponsor_spec.rb | 4 +-- spec/features/sponsorship_level_spec.rb | 4 +-- spec/features/supporter_levels_spec.rb | 4 +-- spec/features/tracks_spec.rb | 4 +-- spec/features/venue_spec.rb | 4 +-- spec/features/volunteers_spec.rb | 4 +-- spec/models/user_spec.rb | 28 ++++++++--------- 22 files changed, 91 insertions(+), 62 deletions(-) diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 860cb494..5bf9ca6a 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -3,6 +3,7 @@ class ApplicationController < ActionController::Base protect_from_forgery before_filter :get_conferences before_filter :store_location + before_filter :verify_user_admin helper_method :date_string # Ensure every controller authorizes resource or skips authorization (skip_authorization_check) check_authorization unless: :devise_controller? @@ -33,6 +34,12 @@ class ApplicationController < ActionController::Base @conferences =Conference.all end + def verify_user_admin + if self.class.to_s.split('::').first == 'Admin' + verify_user + end + end + def verify_user :authenticate_user! diff --git a/app/models/ability.rb b/app/models/ability.rb index fce947c3..902edff6 100644 --- a/app/models/ability.rb +++ b/app/models/ability.rb @@ -71,6 +71,9 @@ class Ability # Ids of all the conferences for which the user has an 'organizer' role conf_ids_for_organizer = Conference.with_role(:organizer, user).pluck(:id) unless user.new_record? + # Ids of the venues of the conference for which (conferences) the user has an 'organizer' role + conf_ids_for_organizer_venue = + Conference.with_role(:organizer, user).pluck(:venue_id) unless user.new_record? # Ids of all the conferences for which the user has a 'cfp' role conf_ids_for_cfp = Conference.with_role(:cfp, user).pluck(:id) unless user.new_record? @@ -105,7 +108,7 @@ class Ability # Authorize Conference by its 'id' attribute can :manage, Conference, id: conf_ids_for_organizer # Authorize venues of conferences, which user can manage - can :manage, Venue, conference: { id: conf_ids_for_organizer } + can :manage, Venue, id: conf_ids_for_organizer_venue # id: Conference.where(id: conf_ids_for_organizer).map(&:venue_id) # User can view the admin 'users' page if he is an organizer for any conference can :manage, User if user.has_role?('organizer', :any) diff --git a/spec/controllers/admin/conferences_controller_spec.rb b/spec/controllers/admin/conferences_controller_spec.rb index 04256b28..25ba9ccb 100644 --- a/spec/controllers/admin/conferences_controller_spec.rb +++ b/spec/controllers/admin/conferences_controller_spec.rb @@ -3,11 +3,11 @@ require 'spec_helper' describe Admin::ConferenceController do # It is necessary to use bang version of let to build roles before user - let!(:participant_role) { create(:participant_role) } - let!(:organizer_role) { create(:organizer_role) } - let(:conference) { create(:conference) } - let(:organizer) { create(:organizer) } + let!(:participant_role) { create(:participant_role) } + let!(:organizer_role) { create(:organizer_conference_1_role, resource_id: conference.id) } + + let(:organizer) { create(:organizer_conference_1, is_admin: true) } let(:participant) { create(:participant) } shared_examples 'access as administration' do @@ -226,7 +226,9 @@ describe Admin::ConferenceController do it 'requires organizer privileges' do get :show, id: conference.short_title expect(response).to redirect_to(send(path)) - expect(flash[:alert]).to match(/#{message}/) + if message + expect(flash[:alert]).to match(/#{message}/) + end end end @@ -234,7 +236,9 @@ describe Admin::ConferenceController do it 'requires organizer privileges' do get :index expect(response).to redirect_to(send(path)) - expect(flash[:alert]).to match(/#{message}/) + if message + expect(flash[:alert]).to match(/#{message}/) + end end end @@ -242,7 +246,9 @@ describe Admin::ConferenceController do it 'requires organizer privileges' do get :new expect(response).to redirect_to(send(path)) - expect(flash[:alert]).to match(/#{message}/) + if message + expect(flash[:alert]).to match(/#{message}/) + end end end @@ -251,7 +257,9 @@ describe Admin::ConferenceController do post :create, conference: attributes_for(:conference, short_title: 'ExCon') expect(response).to redirect_to(send(path)) - expect(flash[:alert]).to match(/#{message}/) + if message + expect(flash[:alert]).to match(/#{message}/) + end end end @@ -261,7 +269,9 @@ describe Admin::ConferenceController do conference: attributes_for(:conference, short_title: 'ExCon') expect(response).to redirect_to(send(path)) - expect(flash[:alert]).to match(/#{message}/) + if message + expect(flash[:alert]).to match(/#{message}/) + end end end end @@ -277,7 +287,7 @@ describe Admin::ConferenceController do describe 'guest access' do - it_behaves_like 'access as participant or guest', :root_path, 'You are not authorized to access this page.' + it_behaves_like 'access as participant or guest', :new_user_session_path end end diff --git a/spec/controllers/admin/users_controller_spec.rb b/spec/controllers/admin/users_controller_spec.rb index 5c0b93e9..a98afa7d 100644 --- a/spec/controllers/admin/users_controller_spec.rb +++ b/spec/controllers/admin/users_controller_spec.rb @@ -1,8 +1,8 @@ require 'spec_helper' describe Admin::UsersController do - let!(:organizer_role) { create(:organizer_role) } + let!(:organizer_role) { create(:organizer_conference_1_role ) } let!(:participant_role) { create(:participant_role) } - let(:organizer) { create(:organizer) } + let(:organizer) { create(:organizer_conference_1) } let(:user) { create(:user) } before(:each) do sign_in(organizer) diff --git a/spec/factories/roles.rb b/spec/factories/roles.rb index 35740dd1..6bd4c883 100644 --- a/spec/factories/roles.rb +++ b/spec/factories/roles.rb @@ -2,11 +2,17 @@ FactoryGirl.define do factory :role do factory :organizer_role do - name 'Organizer' + name 'organizer' end factory :participant_role do name 'Participant' end + + factory :organizer_conference_1_role do + name 'organizer' + resource_type 'Conference' + resource_id 1 + end end end diff --git a/spec/factories/users.rb b/spec/factories/users.rb index 3f775429..5b029441 100644 --- a/spec/factories/users.rb +++ b/spec/factories/users.rb @@ -19,9 +19,12 @@ FactoryGirl.define do after(:create) { |user| user.role_ids = create(:participant_role).id } end - factory :organizer do - after(:create) { |user| user.role_ids = create(:organizer_role).id } + factory :organizer_conference_1 do + after(:create) { |user| user.role_ids = create(:organizer_conference_1_role).id } end + factory :admin do + is_admin true + end end end diff --git a/spec/features/campaign_spec.rb b/spec/features/campaign_spec.rb index 971b2267..6580d736 100644 --- a/spec/features/campaign_spec.rb +++ b/spec/features/campaign_spec.rb @@ -4,7 +4,7 @@ feature Campaign do # It is necessary to use bang version of let to build roles before user let!(:participant_role) { create(:participant_role) } - let!(:organizer_role) { create(:organizer_role) } + let!(:organizer_conference_1_role) { create(:organizer_conference_1_role) } shared_examples 'add and update campaign' do |user| scenario 'adds and update a campaign', feature: true, js: true do @@ -52,6 +52,6 @@ feature Campaign do end describe 'organizer' do - it_behaves_like 'add and update campaign', :organizer + it_behaves_like 'add and update campaign', :organizer_conference_1 end end diff --git a/spec/features/cfp_spec.rb b/spec/features/cfp_spec.rb index 433d084e..e024e11b 100644 --- a/spec/features/cfp_spec.rb +++ b/spec/features/cfp_spec.rb @@ -4,7 +4,7 @@ feature Conference do # It is necessary to use bang version of let to build roles before user let!(:participant_role) { create(:participant_role) } - let!(:organizer_role) { create(:organizer_role) } + let!(:organizer_conference_1_role) { create(:organizer_conference_1_role) } shared_examples 'add and update cfp' do |user| scenario 'adds a new cfp', feature: true, js: true do @@ -87,6 +87,6 @@ feature Conference do end describe 'organizer' do - it_behaves_like 'add and update cfp', :organizer + it_behaves_like 'add and update cfp', :organizer_conference_1 end end diff --git a/spec/features/conference_spec.rb b/spec/features/conference_spec.rb index c72ad9f0..6eed458d 100644 --- a/spec/features/conference_spec.rb +++ b/spec/features/conference_spec.rb @@ -4,7 +4,7 @@ feature Conference do # It is necessary to use bang version of let to build roles before user let!(:participant_role) { create(:participant_role) } - let!(:organizer_role) { create(:organizer_role) } + let!(:organizer_conference_1_role) { create(:organizer_conference_1_role) } shared_examples 'add and update conference' do |user| scenario 'adds a new conference', feature: true, js: true do @@ -36,7 +36,7 @@ feature Conference do scenario 'update conference', feature: true, js: true do conference = create(:conference) expected_count = Conference.count - sign_in create(user) + sign_in create(:organizer_conference_1_role) visit edit_admin_conference_path(conference.short_title) fill_in 'conference_title', with: 'New Con' @@ -56,6 +56,6 @@ feature Conference do end describe 'organizer' do - it_behaves_like 'add and update conference', :organizer + it_behaves_like 'add and update conference', :admin end end diff --git a/spec/features/difficulty_levels_spec.rb b/spec/features/difficulty_levels_spec.rb index e8d45340..c5ef30a4 100644 --- a/spec/features/difficulty_levels_spec.rb +++ b/spec/features/difficulty_levels_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' feature DifficultyLevel do # It is necessary to use bang version of let to build roles before user let!(:participant_role) { create(:participant_role) } - let!(:organizer_role) { create(:organizer_role) } + let!(:organizer_conference_1_role) { create(:organizer_conference_1_role) } shared_examples 'difficulty levels' do |user| scenario 'adds and updates difficulty level', feature: true, js: true do @@ -50,6 +50,6 @@ feature DifficultyLevel do end describe 'organizer' do - it_behaves_like 'difficulty levels', :organizer + it_behaves_like 'difficulty levels', :organizer_conference_1 end end diff --git a/spec/features/email_spec.rb b/spec/features/email_spec.rb index ed963909..877a4d24 100644 --- a/spec/features/email_spec.rb +++ b/spec/features/email_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' feature Event do # It is necessary to use bang version of let to build roles before user let!(:participant_role) { create(:participant_role) } - let!(:organizer_role) { create(:organizer_role) } + let!(:organizer_conference_1_role) { create(:organizer_conference_1_role) } shared_examples 'email settings' do |user| scenario 'updates email settings', @@ -91,6 +91,6 @@ feature Event do end describe 'organizer' do - it_behaves_like 'email settings', :organizer + it_behaves_like 'email settings', :organizer_conference_1 end end diff --git a/spec/features/event_types_spec.rb b/spec/features/event_types_spec.rb index 04e5df66..f417ac34 100644 --- a/spec/features/event_types_spec.rb +++ b/spec/features/event_types_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' feature EventType do # It is necessary to use bang version of let to build roles before user let!(:participant_role) { create(:participant_role) } - let!(:organizer_role) { create(:organizer_role) } + let!(:organizer_conference_1_role) { create(:organizer_conference_1_role) } shared_examples 'event types' do |user| scenario 'adds and updates event type', feature: true, js: true do @@ -12,7 +12,7 @@ feature EventType do visit admin_conference_event_types_path( conference_id: conference.short_title) - expect(page.all('div.nested-fields').count == 2).to be true + expect(page.all('div.nested-fields').count == 2).to be true # Add event type click_link 'Add event_type' expect(page.all('div.nested-fields').count == 3).to be true @@ -55,6 +55,6 @@ feature EventType do end describe 'organizer' do - it_behaves_like 'event types', :organizer + it_behaves_like 'event types', :organizer_conference_1 end end diff --git a/spec/features/lodgings_spec.rb b/spec/features/lodgings_spec.rb index 452bbbd0..a52d8ed4 100644 --- a/spec/features/lodgings_spec.rb +++ b/spec/features/lodgings_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' feature Lodging do # It is necessary to use bang version of let to build roles before user let!(:participant_role) { create(:participant_role) } - let!(:organizer_role) { create(:organizer_role) } + let!(:organizer_conference_1_role) { create(:organizer_conference_1_role) } shared_examples 'lodgings' do |user| scenario 'adds and updates lodgings', feature: true, js: true do @@ -56,6 +56,6 @@ feature Lodging do end describe 'organizer' do - it_behaves_like 'lodgings', :organizer + it_behaves_like 'lodgings', :organizer_conference_1 end end diff --git a/spec/features/proposal_spec.rb b/spec/features/proposal_spec.rb index 78a937e2..9f7e6bc6 100644 --- a/spec/features/proposal_spec.rb +++ b/spec/features/proposal_spec.rb @@ -3,13 +3,13 @@ require 'spec_helper' feature Event do # It is necessary to use bang version of let to build roles before user let!(:participant_role) { create(:participant_role) } - let!(:organizer_role) { create(:organizer_role) } + let!(:organizer_conference_1_role) { create(:organizer_conference_1_role) } shared_examples 'proposal workflow' do scenario 'submitts a proposal, accepts and confirms', feature: true, js: true do - organizer = create(:organizer, email: 'admin@example.com') + organizer = create(:organizer_conference_1, email: 'admin@example.com') participant = create(:participant, email: 'participant@example.com') expected_count = Event.count + 1 diff --git a/spec/features/rooms_spec.rb b/spec/features/rooms_spec.rb index 2160e565..0025267e 100644 --- a/spec/features/rooms_spec.rb +++ b/spec/features/rooms_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' feature Room do # It is necessary to use bang version of let to build roles before user let!(:participant_role) { create(:participant_role) } - let!(:organizer_role) { create(:organizer_role) } + let!(:organizer_conference_1_role) { create(:organizer_conference_1_role) } shared_examples 'rooms' do |user| scenario 'adds and updates rooms', feature: true, js: true do @@ -43,6 +43,6 @@ feature Room do end describe 'organizer' do - it_behaves_like 'rooms', :organizer + it_behaves_like 'rooms', :organizer_conference_1 end end diff --git a/spec/features/sponsor_spec.rb b/spec/features/sponsor_spec.rb index 4edf1f6b..c09a093e 100644 --- a/spec/features/sponsor_spec.rb +++ b/spec/features/sponsor_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' feature Sponsor do # It is necessary to use bang version of let to build roles before user let!(:participant_role) { create(:participant_role) } - let!(:organizer_role) { create(:organizer_role) } + let!(:organizer_conference_1_role) { create(:organizer_conference_1_role) } shared_examples 'sponsors' do |user| scenario 'adds and updates sponsors', feature: true, js: true do @@ -69,6 +69,6 @@ feature Sponsor do end describe 'organizer' do - it_behaves_like 'sponsors', :organizer + it_behaves_like 'sponsors', :organizer_conference_1 end end diff --git a/spec/features/sponsorship_level_spec.rb b/spec/features/sponsorship_level_spec.rb index 988a34f7..0974d770 100644 --- a/spec/features/sponsorship_level_spec.rb +++ b/spec/features/sponsorship_level_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' feature SponsorshipLevel do # It is necessary to use bang version of let to build roles before user let!(:participant_role) { create(:participant_role) } - let!(:organizer_role) { create(:organizer_role) } + let!(:organizer_conference_1_role) { create(:organizer_conference_1_role) } shared_examples 'sponsorship levels' do |user| scenario 'adds and updates sponsorship level', feature: true, js: true do @@ -36,6 +36,6 @@ feature SponsorshipLevel do end describe 'organizer' do - it_behaves_like 'sponsorship levels', :organizer + it_behaves_like 'sponsorship levels', :organizer_conference_1 end end diff --git a/spec/features/supporter_levels_spec.rb b/spec/features/supporter_levels_spec.rb index d64cbf4b..4b384e03 100644 --- a/spec/features/supporter_levels_spec.rb +++ b/spec/features/supporter_levels_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' feature SupporterLevel do # It is necessary to use bang version of let to build roles before user let!(:participant_role) { create(:participant_role) } - let!(:organizer_role) { create(:organizer_role) } + let!(:organizer_conference_1_role) { create(:organizer_conference_1_role) } shared_examples 'supporter levels' do |user| scenario 'adds and updates supporter level', feature: true, js: true do @@ -43,6 +43,6 @@ feature SupporterLevel do end describe 'organizer' do - it_behaves_like 'supporter levels', :organizer + it_behaves_like 'supporter levels', :organizer_conference_1 end end diff --git a/spec/features/tracks_spec.rb b/spec/features/tracks_spec.rb index 8e4ea960..d625bbae 100644 --- a/spec/features/tracks_spec.rb +++ b/spec/features/tracks_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' feature Track do # It is necessary to use bang version of let to build roles before user let!(:participant_role) { create(:participant_role) } - let!(:organizer_role) { create(:organizer_role) } + let!(:organizer_conference_1_role) { create(:organizer_conference_1_role) } shared_examples 'tracks' do |user| scenario 'adds and updates tracks', feature: true, js: true do @@ -50,6 +50,6 @@ feature Track do end describe 'organizer' do - it_behaves_like 'tracks', :organizer + it_behaves_like 'tracks', :organizer_conference_1 end end diff --git a/spec/features/venue_spec.rb b/spec/features/venue_spec.rb index 4416210a..3c838312 100644 --- a/spec/features/venue_spec.rb +++ b/spec/features/venue_spec.rb @@ -4,7 +4,7 @@ feature Conference do # It is necessary to use bang version of let to build roles before user let!(:participant_role) { create(:participant_role) } - let!(:organizer_role) { create(:organizer_role) } + let!(:organizer_role) { create(:organizer_conference_1_role) } shared_examples 'venue' do |user| scenario 'adds and updates venue' do @@ -59,7 +59,7 @@ feature Conference do end describe 'organizer' do - it_behaves_like 'venue', :organizer + it_behaves_like 'venue', :organizer_conference_1 end end diff --git a/spec/features/volunteers_spec.rb b/spec/features/volunteers_spec.rb index ee4556f1..907e4e69 100644 --- a/spec/features/volunteers_spec.rb +++ b/spec/features/volunteers_spec.rb @@ -3,8 +3,8 @@ require 'spec_helper' feature Conference do # It is necessary to use bang version of let to build roles before user let!(:participant_role) { create(:participant_role) } - let!(:organizer_role) { create(:organizer_role) } - let(:organizer) { create(:organizer) } + let!(:organizer_conference_1_role) { create(:organizer_conference_1_role) } + let(:organizer) { create(:organizer_conference_1) } let(:conference) { create(:conference) } shared_examples 'volunteer' do diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb index 25f1d3b8..103d5d8f 100644 --- a/spec/models/user_spec.rb +++ b/spec/models/user_spec.rb @@ -4,44 +4,44 @@ describe User do # It is necessary to use bang version of let to build roles before user let!(:participant_role) { create(:participant_role) } - let!(:organizer_role) { create(:organizer_role) } - let!(:organizer) { create(:user) } + let!(:organizer_conference_1_role ) { create(:organizer_conference_1_role ) } + let!(:organizer) { create(:organizer_conference_1 ) } it 'returns the correct role' do participant = create(:user, email: 'participant@example.de') - expect(organizer.roles.first).to eq(organizer_role) - expect(participant.roles.first).to eq(participant_role) + expect(organizer.roles.first).to eq(organizer_conference_1_role) + expect(participant.roles.first).to eq(organizer_conference_1_role) end it 'returns the correct roles' do - roles = [participant_role.id, organizer_role.id] + roles = [participant_role.id, organizer_conference_1_role.id] user_with_all_roles = create(:user, email: 'participant@example.de') user_with_all_roles.role_ids = roles user_with_all_roles.save expect(user_with_all_roles.roles.length).to eq(2) expect(user_with_all_roles.roles[0]).to eq(participant_role) - expect(user_with_all_roles.roles[1]).to eq(organizer_role) + expect(user_with_all_roles.roles[1]).to eq(organizer_conference_1_role ) end describe '#role?' do shared_examples '#role?' do |user, role, expected| it "returns #{expected} for #{role}" do user_obj = create(user, email: 'e@example.com') - expect(user_obj.role?(role)).to be expected - expect(user_obj.role?(role.downcase)).to be expected - expect(user_obj.role?(role.upcase)).to be expected - expect(user_obj.role?(role.downcase.capitalize)).to be expected + expect(user_obj.has_role?(role)).to be expected + expect(user_obj.has_role?(role.downcase)).to be expected + expect(user_obj.has_role?(role.upcase)).to be expected + expect(user_obj.has_role?(role.downcase.capitalize)).to be expected end end context 'organizer' do - it_behaves_like '#role?', :organizer, 'oRganIzeR', true - it_behaves_like '#role?', :organizer, 'partiCipant', false + it_behaves_like '#role?', :organizer_conference_1_role, 'oRganIzeR', true + it_behaves_like '#role?', :organizer_conference_1_role, 'partiCipant', false it 'assigns first user organizer role' do - expect(organizer.role?('Organizer')).to be true - expect(organizer.role_ids).to match_array([organizer_role.id]) + expect(organizer.has_role?('organizer', Conference.first)).to be true + expect(organizer.role_ids).to match_array([organizer_conference_1_role.id]) end end