use single ability model
This commit is contained in:
Stella Rouzi
parent
0418924d8e
commit
ab17e6db11
3 changed files with 100 additions and 116 deletions
|
|
@ -45,11 +45,7 @@ class ApplicationController < ActionController::Base
|
||||||
end
|
end
|
||||||
|
|
||||||
def current_ability
|
def current_ability
|
||||||
if self.class.to_s.split('::').first == 'Admin'
|
@current_ability ||= Ability.new(current_user)
|
||||||
@current_ability ||= AdminAbility.new(current_user)
|
|
||||||
else
|
|
||||||
@current_ability ||= Ability.new(current_user)
|
|
||||||
end
|
|
||||||
end
|
end
|
||||||
|
|
||||||
rescue_from CanCan::AccessDenied do |exception|
|
rescue_from CanCan::AccessDenied do |exception|
|
||||||
|
|
|
||||||
|
|
@ -59,5 +59,104 @@ class Ability
|
||||||
can :show, Event # if confirmed...?
|
can :show, Event # if confirmed...?
|
||||||
can :index, :schedule # show?
|
can :index, :schedule # show?
|
||||||
|
|
||||||
|
# Check roles of user, using rolify. Role name is *case sensitive*
|
||||||
|
# user.is_organizer? or user.has_role? :organizer
|
||||||
|
# user.is_cfp_of? Conference or user.has_role? :cfp, Conference
|
||||||
|
# user.is_info_desk_of? Conference
|
||||||
|
# user.is_volunteer_coordinator_of? Conference
|
||||||
|
# user.is_attendee_of? Conference
|
||||||
|
# The following is wrong because a user will only have 'cfp' role for a specific conference
|
||||||
|
# user.is_cfp? # This is always false
|
||||||
|
|
||||||
|
# Ids of all the conferences for which the user has an 'organizer' role
|
||||||
|
conf_ids_for_organizer =
|
||||||
|
Conference.with_role(:organizer, user).pluck(:id) unless user.new_record?
|
||||||
|
# Ids of all the conferences for which the user has a 'cfp' role
|
||||||
|
conf_ids_for_cfp =
|
||||||
|
Conference.with_role(:cfp, user).pluck(:id) unless user.new_record?
|
||||||
|
# Ids of all the conferences for which the user has an 'info_desk' role
|
||||||
|
conf_ids_for_info_desk =
|
||||||
|
Conference.with_role(:info_desk, user).pluck(:id) unless user.new_record?
|
||||||
|
# Ids of all the conferences for which the user has a 'volunteer_coordinator' role
|
||||||
|
conf_ids_for_volunteer_coordinator =
|
||||||
|
Conference.with_role(:volunteer_coordinator, user).pluck(:id) unless user.new_record?
|
||||||
|
|
||||||
|
## Authorization for ORGANIZER
|
||||||
|
# If a user is organizer of a conference, they can manage everything related to this conference
|
||||||
|
|
||||||
|
if user.has_role? :organizer, :any
|
||||||
|
can :manage, :all, conference_id: conf_ids_for_organizer
|
||||||
|
|
||||||
|
# Registrations controller authorizes conference resource too, so we don't have to worry about
|
||||||
|
# accessing the new registration page of a conference we don't have access to
|
||||||
|
can :create, Registration, conference_id: conf_ids_for_organizer
|
||||||
|
|
||||||
|
# Override previous can because
|
||||||
|
# Models Conference, Venue, User, Schedule do not have a 'conference_id' attribute
|
||||||
|
cannot :manage, Conference
|
||||||
|
cannot :manage, Venue
|
||||||
|
cannot :manage, User
|
||||||
|
cannot :manage, :schedule
|
||||||
|
can :manage, :schedule
|
||||||
|
|
||||||
|
# Authorize explicitely, so that it doesn't look for a 'conference_id'
|
||||||
|
can :manage, :volunteer
|
||||||
|
|
||||||
|
# Authorize Conference by its 'id' attribute
|
||||||
|
can :manage, Conference, id: conf_ids_for_organizer
|
||||||
|
# Authorize venues of conferences, which user can manage
|
||||||
|
can :manage, Venue, conference: { id: conf_ids_for_organizer }
|
||||||
|
# id: Conference.where(id: conf_ids_for_organizer).map(&:venue_id)
|
||||||
|
# User can view the admin 'users' page if he is an organizer for any conference
|
||||||
|
can :manage, User if user.has_role?('organizer', :any)
|
||||||
|
# To assign roles to users
|
||||||
|
# can :manage, Role, resource_id: conf_ids_for_organizer
|
||||||
|
end
|
||||||
|
|
||||||
|
if user.is_admin # is_admin is an attribute of User
|
||||||
|
can :create, Conference
|
||||||
|
can :index, Conference # this will allow the Conference to appear in the menu
|
||||||
|
can :view, Conference # for /admin/conference overview
|
||||||
|
can :manage, User # to make other users admins
|
||||||
|
end
|
||||||
|
|
||||||
|
## Authorization for CfP
|
||||||
|
# A user can manage events of the conference, for which conference the user has a 'cfp' role
|
||||||
|
if user.has_role? :cfp, :any
|
||||||
|
# Can view dashboard for specific conference (show) and for all conference (index)
|
||||||
|
can [:index, :show], Conference, id: conf_ids_for_cfp
|
||||||
|
can :manage, Event, conference_id: conf_ids_for_cfp
|
||||||
|
can :manage, CallForPapers, conference_id: conf_ids_for_cfp
|
||||||
|
can :manage, EventType, conference_id: conf_ids_for_cfp
|
||||||
|
can :manage, Track, conference_id: conf_ids_for_cfp
|
||||||
|
can :manage, DifficultyLevel, conference_id: conf_ids_for_cfp
|
||||||
|
can :manage, :schedule
|
||||||
|
|
||||||
|
can :manage, EmailSettings, conference_id: conf_ids_for_cfp
|
||||||
|
can :index, User
|
||||||
|
end
|
||||||
|
|
||||||
|
## Authorization for Info Desk
|
||||||
|
if user.has_role? :info_desk, :any
|
||||||
|
can [:index, :show], Conference, id: conf_ids_for_info_desk
|
||||||
|
can :manage, Registration, conference_id: conf_ids_for_info_desk
|
||||||
|
can :manage, Question, conference_id: conf_ids_for_info_desk
|
||||||
|
|
||||||
|
# Previously we authorized Registrations of a specific conference, but that doesn't work
|
||||||
|
# if we want to create a new one, which does not belong to any conference yet
|
||||||
|
# Registrations controller authorizes conference resource too, so we don't have to worry about
|
||||||
|
# accessing the new registration page of a conference we don't have access to
|
||||||
|
can :create, Registration, conference_id: conf_ids_for_info_desk
|
||||||
|
|
||||||
|
can :index, User
|
||||||
|
end
|
||||||
|
|
||||||
|
## Authorization for Volunteer Coordinator
|
||||||
|
if user.has_role? :volunteer_coordinator, :any
|
||||||
|
can [:index, :show], Conference, id: conf_ids_for_volunteer_coordinator
|
||||||
|
can :manage, Vposition, conference_id: conf_ids_for_volunteer_coordinator
|
||||||
|
can :manage, Vday, conference_id: conf_ids_for_volunteer_coordinator
|
||||||
|
can :manage, :volunteer
|
||||||
|
end
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
|
||||||
|
|
@ -1,111 +0,0 @@
|
||||||
class AdminAbility
|
|
||||||
include CanCan::Ability
|
|
||||||
|
|
||||||
def initialize(user)
|
|
||||||
# Check roles of user, using rolify. Role name is *case sensitive*
|
|
||||||
# user.is_organizer? or user.has_role? :organizer
|
|
||||||
# user.is_cfp_of? Conference or user.has_role? :cfp, Conference
|
|
||||||
# user.is_info_desk_of? Conference
|
|
||||||
# user.is_volunteer_coordinator_of? Conference
|
|
||||||
# user.is_attendee_of? Conference
|
|
||||||
# The following is wrong because a user will only have 'cfp' role for a specific conference
|
|
||||||
# user.is_cfp? # This is always false
|
|
||||||
|
|
||||||
user ||= User.new # for guest
|
|
||||||
|
|
||||||
if user.new_record?
|
|
||||||
cannot :manage, :all
|
|
||||||
end
|
|
||||||
|
|
||||||
# Ids of all the conferences for which the user has an 'organizer' role
|
|
||||||
conf_ids_for_organizer =
|
|
||||||
Conference.with_role(:organizer, user).pluck(:id) unless user.new_record?
|
|
||||||
# Ids of all the conferences for which the user has a 'cfp' role
|
|
||||||
conf_ids_for_cfp =
|
|
||||||
Conference.with_role(:cfp, user).pluck(:id) unless user.new_record?
|
|
||||||
# Ids of all the conferences for which the user has an 'info_desk' role
|
|
||||||
conf_ids_for_info_desk =
|
|
||||||
Conference.with_role(:info_desk, user).pluck(:id) unless user.new_record?
|
|
||||||
# Ids of all the conferences for which the user has a 'volunteer_coordinator' role
|
|
||||||
conf_ids_for_volunteer_coordinator =
|
|
||||||
Conference.with_role(:volunteer_coordinator, user).pluck(:id) unless user.new_record?
|
|
||||||
|
|
||||||
## Authorization for ORGANIZER
|
|
||||||
# If a user is organizer of a conference, they can manage everything related to this conference
|
|
||||||
|
|
||||||
if user.has_role? :organizer, :any
|
|
||||||
can :manage, :all, conference_id: conf_ids_for_organizer
|
|
||||||
|
|
||||||
# Registrations controller authorizes conference resource too, so we don't have to worry about
|
|
||||||
# accessing the new registration page of a conference we don't have access to
|
|
||||||
can :create, Registration
|
|
||||||
|
|
||||||
# Override previous can because
|
|
||||||
# Models Conference, Venue, User, Schedule do not have a 'conference_id' attribute
|
|
||||||
cannot :manage, Conference
|
|
||||||
cannot :manage, Venue
|
|
||||||
cannot :manage, User
|
|
||||||
cannot :manage, :schedule
|
|
||||||
can :manage, :schedule
|
|
||||||
|
|
||||||
# Authorize explicitely, so that it doesn't look for a 'conference_id'
|
|
||||||
can :manage, :volunteer
|
|
||||||
|
|
||||||
# Authorize Conference by its 'id' attribute
|
|
||||||
can :manage, Conference, id: conf_ids_for_organizer
|
|
||||||
# Authorize venues of conferences, which user can manage
|
|
||||||
can :manage, Venue, conference: { id: conf_ids_for_organizer }
|
|
||||||
# id: Conference.where(id: conf_ids_for_organizer).map(&:venue_id)
|
|
||||||
# User can view the admin 'users' page if he is an organizer for any conference
|
|
||||||
can :manage, User if user.has_role?('organizer', :any)
|
|
||||||
# To assign roles to users
|
|
||||||
# can :manage, Role, resource_id: conf_ids_for_organizer
|
|
||||||
end
|
|
||||||
|
|
||||||
if user.is_admin # is_admin is an attribute of User
|
|
||||||
can :create, Conference
|
|
||||||
can :index, Conference # this will allow the Conference to appear in the menu
|
|
||||||
can :view, Conference # for /admin/conference overview
|
|
||||||
can :manage, User # to make other users admins
|
|
||||||
end
|
|
||||||
|
|
||||||
## Authorization for CfP
|
|
||||||
# A user can manage events of the conference, for which conference the user has a 'cfp' role
|
|
||||||
if user.has_role? :cfp, :any
|
|
||||||
# Can view dashboard for specific conference (show) and for all conference (index)
|
|
||||||
can [:index, :show], Conference, id: conf_ids_for_cfp
|
|
||||||
can :manage, Event, conference_id: conf_ids_for_cfp
|
|
||||||
can :manage, CallForPapers, conference_id: conf_ids_for_cfp
|
|
||||||
can :manage, EventType, conference_id: conf_ids_for_cfp
|
|
||||||
can :manage, Track, conference_id: conf_ids_for_cfp
|
|
||||||
can :manage, DifficultyLevel, conference_id: conf_ids_for_cfp
|
|
||||||
can :manage, :schedule
|
|
||||||
|
|
||||||
can :manage, EmailSettings, conference_id: conf_ids_for_cfp
|
|
||||||
can :index, User
|
|
||||||
end
|
|
||||||
|
|
||||||
## Authorization for Info Desk
|
|
||||||
if user.has_role? :info_desk, :any
|
|
||||||
can [:index, :show], Conference, id: conf_ids_for_info_desk
|
|
||||||
can :manage, Registration, conference_id: conf_ids_for_info_desk
|
|
||||||
can :manage, Question, conference_id: conf_ids_for_info_desk
|
|
||||||
|
|
||||||
# Previously we authorized Registrations of a specific conference, but that doesn't work
|
|
||||||
# if we want to create a new one, which does not belong to any conference yet
|
|
||||||
# Registrations controller authorizes conference resource too, so we don't have to worry about
|
|
||||||
# accessing the new registration page of a conference we don't have access to
|
|
||||||
can :create, Registration
|
|
||||||
|
|
||||||
can :index, User
|
|
||||||
end
|
|
||||||
|
|
||||||
## Authorization for Volunteer Coordinator
|
|
||||||
if user.has_role? :volunteer_coordinator, :any
|
|
||||||
can [:index, :show], Conference, id: conf_ids_for_volunteer_coordinator
|
|
||||||
can :manage, Vposition, conference_id: conf_ids_for_volunteer_coordinator
|
|
||||||
can :manage, Vday, conference_id: conf_ids_for_volunteer_coordinator
|
|
||||||
can :manage, :volunteer
|
|
||||||
end
|
|
||||||
end
|
|
||||||
end
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue