gunghogeoduck/osem-fcy
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Load and authorize schedule in ScheduleController

Browse source
This commit is contained in:
Ana 2016-07-29 18:29:57 +02:00
parent 4abc60424d
commit c5e410843c
3 changed files with 12 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

6
app/controllers/admin/schedule_controller.rb
View file

@ -2,6 +2,7 @@ module Admin
class ScheduleController < Admin::BaseController
# By authorizing 'conference' resource, we can ensure there will be no unauthorized access to
# the schedule of a conference, which should not be accessed in the first place
load_and_authorize_resource :schedule
load_and_authorize_resource :conference, find_by: :short_title
load_and_authorize_resource :program, through: :conference, singleton: true
load_resource :venue, through: :conference, singleton: true
@ -19,7 +20,6 @@ module Admin
end
def show
authorize! :update, @program.events.new
@schedule_id = params[:id].to_i
schedule = Schedule.find(@schedule_id)
@event_schedules = schedule.event_schedules
@ -30,10 +30,6 @@ module Admin
end
def update
event = @program.events.new
authorize! :update, event
event.destroy
if params[:selected_schedule].present?
if params[:selected_schedule] == 'true'
@program.selected_schedule_id = params[:id].to_i

1
app/models/ability.rb
View file

@ -143,6 +143,7 @@ class Ability
can :manage, Vposition, conference_id: conf_ids_for_organizer
can :manage, Vday, conference_id: conf_ids_for_organizer
can :manage, Program, conference_id: conf_ids_for_organizer
can :manage, Schedule, program: { conference_id: conf_ids_for_organizer }
can :manage, Cfp, program: { conference_id: conf_ids_for_organizer}
can :manage, Event, program: { conference_id: conf_ids_for_organizer}
can :manage, EventType, program: { conference_id: conf_ids_for_organizer}

10
spec/models/ability_spec.rb
View file

@ -39,6 +39,8 @@ describe 'User' do
let(:conference_with_closed_registration) { create(:conference) }
let!(:closed_registration_period) { create(:registration_period, conference: conference_with_closed_registration, start_date: Date.current - 6.days, end_date: Date.current - 6.days) }
let!(:my_schedule) { create(:schedule, program: my_conference.program) }
let!(:other_schedule) { create(:schedule, program: conference_public.program) }
# Test abilities for not signed in users
context 'when user is not signed in' do
it{ should be_able_to(:index, Conference)}
@ -197,6 +199,8 @@ describe 'User' do
it{ should_not be_able_to(:manage, conference_public.questions.first) }
it{ should be_able_to(:manage, my_conference.program.cfp) }
it{ should_not be_able_to(:manage, conference_public.program.cfp) }
it{ should be_able_to(:manage, my_schedule) }
it{ should_not be_able_to(:manage, other_schedule) }
it{ should be_able_to(:manage, my_conference.venue) }
it{ should_not be_able_to(:manage, conference_public.venue) }
it{ should be_able_to(:manage, my_conference.lodgings.first) }
@ -262,6 +266,8 @@ describe 'User' do
it{ should_not be_able_to(:manage, conference_public.questions.first) }
it{ should be_able_to(:manage, my_conference.program.cfp) }
it{ should_not be_able_to(:manage, conference_public.program.cfp) }
it{ should_not be_able_to(:manage, my_schedule) }
it{ should_not be_able_to(:manage, other_schedule) }
it{ should_not be_able_to(:manage, my_conference.venue) }
it{ should be_able_to(:show, my_conference.venue) }
it{ should_not be_able_to(:manage, conference_public.venue) }
@ -321,6 +327,8 @@ describe 'User' do
it{ should_not be_able_to(:manage, conference_public.questions.first) }
it{ should_not be_able_to(:manage, my_conference.program.cfp) }
it{ should_not be_able_to(:manage, conference_public.program.cfp) }
it{ should_not be_able_to(:manage, my_schedule) }
it{ should_not be_able_to(:manage, other_schedule) }
it{ should_not be_able_to(:manage, my_conference.venue) }
it{ should_not be_able_to(:show, my_conference.venue) }
it{ should_not be_able_to(:manage, conference_public.venue) }
@ -380,6 +388,8 @@ describe 'User' do
it{ should_not be_able_to(:manage, conference_public.questions.first) }
it{ should_not be_able_to(:manage, my_conference.program.cfp) }
it{ should_not be_able_to(:manage, conference_public.program.cfp) }
it{ should_not be_able_to(:manage, my_schedule) }
it{ should_not be_able_to(:manage, other_schedule) }
it{ should_not be_able_to(:manage, my_conference.venue) }
it{ should_not be_able_to(:show, my_conference.venue) }
it{ should_not be_able_to(:manage, conference_public.venue) }