From ab17e6db1138e11ae4e80b15ca6646c5f9f51695 Mon Sep 17 00:00:00 2001 From: Stella Rouzi Date: Fri, 18 Jul 2014 15:23:02 +0300 Subject: [PATCH] use single ability model --- app/controllers/application_controller.rb | 6 +- app/models/ability.rb | 99 +++++++++++++++++++ app/models/admin_ability.rb | 111 ---------------------- 3 files changed, 100 insertions(+), 116 deletions(-) delete mode 100644 app/models/admin_ability.rb diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 86e29c90..860cb494 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -45,11 +45,7 @@ class ApplicationController < ActionController::Base end def current_ability - if self.class.to_s.split('::').first == 'Admin' - @current_ability ||= AdminAbility.new(current_user) - else - @current_ability ||= Ability.new(current_user) - end + @current_ability ||= Ability.new(current_user) end rescue_from CanCan::AccessDenied do |exception| diff --git a/app/models/ability.rb b/app/models/ability.rb index b250991a..fce947c3 100644 --- a/app/models/ability.rb +++ b/app/models/ability.rb @@ -59,5 +59,104 @@ class Ability can :show, Event # if confirmed...? can :index, :schedule # show? + # Check roles of user, using rolify. Role name is *case sensitive* + # user.is_organizer? or user.has_role? :organizer + # user.is_cfp_of? Conference or user.has_role? :cfp, Conference + # user.is_info_desk_of? Conference + # user.is_volunteer_coordinator_of? Conference + # user.is_attendee_of? Conference + # The following is wrong because a user will only have 'cfp' role for a specific conference + # user.is_cfp? # This is always false + + # Ids of all the conferences for which the user has an 'organizer' role + conf_ids_for_organizer = + Conference.with_role(:organizer, user).pluck(:id) unless user.new_record? + # Ids of all the conferences for which the user has a 'cfp' role + conf_ids_for_cfp = + Conference.with_role(:cfp, user).pluck(:id) unless user.new_record? + # Ids of all the conferences for which the user has an 'info_desk' role + conf_ids_for_info_desk = + Conference.with_role(:info_desk, user).pluck(:id) unless user.new_record? + # Ids of all the conferences for which the user has a 'volunteer_coordinator' role + conf_ids_for_volunteer_coordinator = + Conference.with_role(:volunteer_coordinator, user).pluck(:id) unless user.new_record? + + ## Authorization for ORGANIZER + # If a user is organizer of a conference, they can manage everything related to this conference + + if user.has_role? :organizer, :any + can :manage, :all, conference_id: conf_ids_for_organizer + + # Registrations controller authorizes conference resource too, so we don't have to worry about + # accessing the new registration page of a conference we don't have access to + can :create, Registration, conference_id: conf_ids_for_organizer + + # Override previous can because + # Models Conference, Venue, User, Schedule do not have a 'conference_id' attribute + cannot :manage, Conference + cannot :manage, Venue + cannot :manage, User + cannot :manage, :schedule + can :manage, :schedule + + # Authorize explicitely, so that it doesn't look for a 'conference_id' + can :manage, :volunteer + + # Authorize Conference by its 'id' attribute + can :manage, Conference, id: conf_ids_for_organizer + # Authorize venues of conferences, which user can manage + can :manage, Venue, conference: { id: conf_ids_for_organizer } + # id: Conference.where(id: conf_ids_for_organizer).map(&:venue_id) + # User can view the admin 'users' page if he is an organizer for any conference + can :manage, User if user.has_role?('organizer', :any) + # To assign roles to users + # can :manage, Role, resource_id: conf_ids_for_organizer + end + + if user.is_admin # is_admin is an attribute of User + can :create, Conference + can :index, Conference # this will allow the Conference to appear in the menu + can :view, Conference # for /admin/conference overview + can :manage, User # to make other users admins + end + + ## Authorization for CfP + # A user can manage events of the conference, for which conference the user has a 'cfp' role + if user.has_role? :cfp, :any + # Can view dashboard for specific conference (show) and for all conference (index) + can [:index, :show], Conference, id: conf_ids_for_cfp + can :manage, Event, conference_id: conf_ids_for_cfp + can :manage, CallForPapers, conference_id: conf_ids_for_cfp + can :manage, EventType, conference_id: conf_ids_for_cfp + can :manage, Track, conference_id: conf_ids_for_cfp + can :manage, DifficultyLevel, conference_id: conf_ids_for_cfp + can :manage, :schedule + + can :manage, EmailSettings, conference_id: conf_ids_for_cfp + can :index, User + end + + ## Authorization for Info Desk + if user.has_role? :info_desk, :any + can [:index, :show], Conference, id: conf_ids_for_info_desk + can :manage, Registration, conference_id: conf_ids_for_info_desk + can :manage, Question, conference_id: conf_ids_for_info_desk + + # Previously we authorized Registrations of a specific conference, but that doesn't work + # if we want to create a new one, which does not belong to any conference yet + # Registrations controller authorizes conference resource too, so we don't have to worry about + # accessing the new registration page of a conference we don't have access to + can :create, Registration, conference_id: conf_ids_for_info_desk + + can :index, User + end + + ## Authorization for Volunteer Coordinator + if user.has_role? :volunteer_coordinator, :any + can [:index, :show], Conference, id: conf_ids_for_volunteer_coordinator + can :manage, Vposition, conference_id: conf_ids_for_volunteer_coordinator + can :manage, Vday, conference_id: conf_ids_for_volunteer_coordinator + can :manage, :volunteer + end end end diff --git a/app/models/admin_ability.rb b/app/models/admin_ability.rb deleted file mode 100644 index 040af215..00000000 --- a/app/models/admin_ability.rb +++ /dev/null @@ -1,111 +0,0 @@ -class AdminAbility - include CanCan::Ability - - def initialize(user) - # Check roles of user, using rolify. Role name is *case sensitive* - # user.is_organizer? or user.has_role? :organizer - # user.is_cfp_of? Conference or user.has_role? :cfp, Conference - # user.is_info_desk_of? Conference - # user.is_volunteer_coordinator_of? Conference - # user.is_attendee_of? Conference - # The following is wrong because a user will only have 'cfp' role for a specific conference - # user.is_cfp? # This is always false - - user ||= User.new # for guest - - if user.new_record? - cannot :manage, :all - end - - # Ids of all the conferences for which the user has an 'organizer' role - conf_ids_for_organizer = - Conference.with_role(:organizer, user).pluck(:id) unless user.new_record? - # Ids of all the conferences for which the user has a 'cfp' role - conf_ids_for_cfp = - Conference.with_role(:cfp, user).pluck(:id) unless user.new_record? - # Ids of all the conferences for which the user has an 'info_desk' role - conf_ids_for_info_desk = - Conference.with_role(:info_desk, user).pluck(:id) unless user.new_record? - # Ids of all the conferences for which the user has a 'volunteer_coordinator' role - conf_ids_for_volunteer_coordinator = - Conference.with_role(:volunteer_coordinator, user).pluck(:id) unless user.new_record? - - ## Authorization for ORGANIZER - # If a user is organizer of a conference, they can manage everything related to this conference - - if user.has_role? :organizer, :any - can :manage, :all, conference_id: conf_ids_for_organizer - - # Registrations controller authorizes conference resource too, so we don't have to worry about - # accessing the new registration page of a conference we don't have access to - can :create, Registration - - # Override previous can because - # Models Conference, Venue, User, Schedule do not have a 'conference_id' attribute - cannot :manage, Conference - cannot :manage, Venue - cannot :manage, User - cannot :manage, :schedule - can :manage, :schedule - - # Authorize explicitely, so that it doesn't look for a 'conference_id' - can :manage, :volunteer - - # Authorize Conference by its 'id' attribute - can :manage, Conference, id: conf_ids_for_organizer - # Authorize venues of conferences, which user can manage - can :manage, Venue, conference: { id: conf_ids_for_organizer } - # id: Conference.where(id: conf_ids_for_organizer).map(&:venue_id) - # User can view the admin 'users' page if he is an organizer for any conference - can :manage, User if user.has_role?('organizer', :any) - # To assign roles to users - # can :manage, Role, resource_id: conf_ids_for_organizer - end - - if user.is_admin # is_admin is an attribute of User - can :create, Conference - can :index, Conference # this will allow the Conference to appear in the menu - can :view, Conference # for /admin/conference overview - can :manage, User # to make other users admins - end - - ## Authorization for CfP - # A user can manage events of the conference, for which conference the user has a 'cfp' role - if user.has_role? :cfp, :any - # Can view dashboard for specific conference (show) and for all conference (index) - can [:index, :show], Conference, id: conf_ids_for_cfp - can :manage, Event, conference_id: conf_ids_for_cfp - can :manage, CallForPapers, conference_id: conf_ids_for_cfp - can :manage, EventType, conference_id: conf_ids_for_cfp - can :manage, Track, conference_id: conf_ids_for_cfp - can :manage, DifficultyLevel, conference_id: conf_ids_for_cfp - can :manage, :schedule - - can :manage, EmailSettings, conference_id: conf_ids_for_cfp - can :index, User - end - - ## Authorization for Info Desk - if user.has_role? :info_desk, :any - can [:index, :show], Conference, id: conf_ids_for_info_desk - can :manage, Registration, conference_id: conf_ids_for_info_desk - can :manage, Question, conference_id: conf_ids_for_info_desk - - # Previously we authorized Registrations of a specific conference, but that doesn't work - # if we want to create a new one, which does not belong to any conference yet - # Registrations controller authorizes conference resource too, so we don't have to worry about - # accessing the new registration page of a conference we don't have access to - can :create, Registration - - can :index, User - end - - ## Authorization for Volunteer Coordinator - if user.has_role? :volunteer_coordinator, :any - can [:index, :show], Conference, id: conf_ids_for_volunteer_coordinator - can :manage, Vposition, conference_id: conf_ids_for_volunteer_coordinator - can :manage, Vday, conference_id: conf_ids_for_volunteer_coordinator - can :manage, :volunteer - end - end -end