From aa3df0243eff061502050fa0d346f47fc9569789 Mon Sep 17 00:00:00 2001 From: shlok007 Date: Tue, 13 Jun 2017 20:57:55 +0530 Subject: [PATCH] mending permissions and test --- app/models/ability.rb | 22 ++++++++++++++-------- spec/models/ability_spec.rb | 10 +++++----- 2 files changed, 19 insertions(+), 13 deletions(-) diff --git a/app/models/ability.rb b/app/models/ability.rb index 7d1cf868..00a0b291 100644 --- a/app/models/ability.rb +++ b/app/models/ability.rb @@ -29,6 +29,7 @@ class Ability # Abilities for not signed in users (guests) def not_signed_in + can [:index], Organization can [:index], Conference can [:show], Conference do |conference| conference.splashpage && conference.splashpage.public == true @@ -168,7 +169,6 @@ class Ability # conferences that belong to organizations for which user is 'organization_admin' conf_ids_for_organization_admin_and_organizer = conf_ids_for_organization_admin.concat(Conference.with_role(:organizer, user).pluck(:id)).uniq can :manage, Resource, conference_id: conf_ids_for_organization_admin_and_organizer - can [:new, :create], Conference if user.has_role?(:organizer, :any) can :manage, Conference, id: conf_ids_for_organization_admin_and_organizer can :manage, Splashpage, conference_id: conf_ids_for_organization_admin_and_organizer can :manage, Contact, conference_id: conf_ids_for_organization_admin_and_organizer @@ -207,7 +207,10 @@ class Ability commentable_id: Event.where(program_id: Program.where(conference_id: conf_ids_for_organization_admin_and_organizer).pluck(:id)).pluck(:id) # Abilities for Role (Conference resource) - can [:index, :show], Role + can [:index, :show], Role do |role| + role.resource_type == 'Conference' + end + can [:edit, :update, :toggle_user], Role do |role| role.resource_type == 'Conference' && (conf_ids_for_organization_admin_and_organizer.include? role.resource_id) end @@ -239,8 +242,9 @@ class Ability commentable_id: Event.where(program_id: Program.where(conference_id: conf_ids_for_cfp).pluck(:id)).pluck(:id) # Abilities for Role (Conference resource) - can [:index, :show], Role - + can [:index, :show], Role do |role| + role.resource_type == 'Conference' + end # Can add or remove users from role, when user has that same role for the conference # Eg. If you are member of the CfP team, you can add more CfP team members (add users to the role 'CfP') can :toggle_user, Role do |role| @@ -268,8 +272,9 @@ class Ability end # Abilities for Role (Conference resource) - can [:index, :show], Role - + can [:index, :show], Role do |role| + role.resource_type == 'Conference' + end # Can add or remove users from role, when user has that same role for the conference # Eg. If you are member of the CfP team, you can add more CfP team members (add users to the role 'CfP') can :toggle_user, Role do |role| @@ -287,8 +292,9 @@ class Ability can :manage, Vday, conference_id: conf_ids_for_volunteers_coordinator # Abilities for Role (Conference resource) - can [:index, :show], Role - + can [:index, :show], Role do |role| + role.resource_type == 'Conference' + end # Can add or remove users from role, when user has that same role for the conference # Eg. If you are member of the CfP team, you can add more CfP team members (add users to the role 'CfP') can :toggle_user, Role do |role| diff --git a/spec/models/ability_spec.rb b/spec/models/ability_spec.rb index 980cc194..fcf9b384 100644 --- a/spec/models/ability_spec.rb +++ b/spec/models/ability_spec.rb @@ -141,7 +141,7 @@ describe 'User' do shared_examples 'user with any role' do before do @other_organization = create(:organization) - @other_conference = create(:conference) + @other_conference = create(:conference, organization: @other_organization) end it{ should_not be_able_to(:update, Role.find_by(name: 'organization_admin', resource: @other_organization)) } @@ -179,8 +179,6 @@ describe 'User' do it{ should_not be_able_to(:manage, other_conference) } it{ should be_able_to(:manage, my_conference) } it{ should be_able_to(:manage, organization) } - - it_behaves_like 'user with any role' end context 'when user has the role organizer' do @@ -199,8 +197,10 @@ describe 'User' do should be_able_to(:destroy, my_venue) end - it{ should be_able_to(:new, Conference) } - it{ should be_able_to(:create, Conference) } + it{ should_not be_able_to(:new, Organization)} + it{ should_not be_able_to(:create, Organization)} + it{ should_not be_able_to(:new, Conference.new) } + it{ should_not be_able_to(:create, Conference.new) } it{ should be_able_to(:manage, my_conference) } it{ should_not be_able_to(:manage, conference_public) } it{ should be_able_to(:manage, my_conference.splashpage) }