From c71d15565e0180f729ae212eec79852a111fffa3 Mon Sep 17 00:00:00 2001 From: Aditya Prakash Date: Sun, 28 Feb 2016 12:07:13 +0530 Subject: [PATCH] Fix authorization of new and create in ConferenceRegistrationsController Before authorization we need to set conference relation. Change in proposal spec cause conference has to have valid registration period for successful redirect to registration after confirm proposal. --- .../conference_registrations_controller.rb | 8 +++++--- app/models/ability.rb | 6 +++++- spec/features/conference_registration_spec.rb | 11 +++++++++++ spec/features/proposal_spec.rb | 2 ++ spec/models/ability_spec.rb | 10 +++++++++- 5 files changed, 32 insertions(+), 5 deletions(-) diff --git a/app/controllers/conference_registrations_controller.rb b/app/controllers/conference_registrations_controller.rb index c9d7d216..40218b31 100644 --- a/app/controllers/conference_registrations_controller.rb +++ b/app/controllers/conference_registrations_controller.rb @@ -1,7 +1,7 @@ class ConferenceRegistrationsController < ApplicationController before_filter :authenticate_user!, except: [:new, :create] load_resource :conference, find_by: :short_title - authorize_resource :conference_registrations, class: Registration + authorize_resource :conference_registrations, class: Registration, except: [:new, :create] before_action :set_registration, only: [:edit, :update, :destroy, :show] def new @@ -25,8 +25,9 @@ class ConferenceRegistrationsController < ApplicationController return end - @registration = Registration.new - + @registration = Registration.new(conference_id: @conference.id) + # make sure that conference is open for registration + authorize! :new, @registration # @user variable needs to be set so that _sign_up_form_embedded works properly @user = @registration.build_user end @@ -50,6 +51,7 @@ class ConferenceRegistrationsController < ApplicationController end @registration.user = @user + authorize! :create, @registration if @registration.save # Trigger ahoy event diff --git a/app/models/ability.rb b/app/models/ability.rb index 16313da9..c20ddfc0 100644 --- a/app/models/ability.rb +++ b/app/models/ability.rb @@ -46,9 +46,13 @@ class Ability can :show, Commercial, commercialable_type: 'Event', commercialable_id: Event.where(state: 'confirmed').pluck(:id) can :show, User unless CONFIG['authentication']['ichain']['enabled'] - can [:show, :create], Registration do |registration| + can :show, Registration do |registration| registration.new_record? end + + can [:new, :create], Registration do |registration| + registration.conference.registration_open? && registration.new_record? + end can :show, Event do |event| event.new_record? end diff --git a/spec/features/conference_registration_spec.rb b/spec/features/conference_registration_spec.rb index b1ab5f08..3084e9d0 100644 --- a/spec/features/conference_registration_spec.rb +++ b/spec/features/conference_registration_spec.rb @@ -49,5 +49,16 @@ feature Registration do expect(conference.user_registered?(participant)).to be(true) end end + + context 'registration is closed' do + let(:conference_with_closed_registration) { create(:conference, registration_period: create(:registration_period)) } + + scenario 'registers for a conference', feature: true do + participant.is_admin = false + visit new_conference_conference_registrations_path(conference_with_closed_registration.short_title) + expect(current_path).to eq(root_path) + expect(flash).to eq 'You are not authorized to access this page.' + end + end end end diff --git a/spec/features/proposal_spec.rb b/spec/features/proposal_spec.rb index 720a1bc3..55c8ebb5 100644 --- a/spec/features/proposal_spec.rb +++ b/spec/features/proposal_spec.rb @@ -2,6 +2,7 @@ require 'spec_helper' feature Event do let!(:conference) { create(:conference) } + let!(:registration_period) { create(:registration_period, conference: conference, start_date: Date.current) } let!(:cfp) { create(:cfp, program_id: conference.program.id) } let!(:organizer_role) { Role.find_by(name: 'organizer', resource: conference) } let!(:organizer) { create(:user, email: 'admin@example.com', role_ids: [organizer_role.id]) } @@ -134,6 +135,7 @@ feature Event do click_link "confirm_proposal_#{@event.id}" expect(flash). to eq('The proposal was confirmed. Please register to attend the conference.') + expect(current_path).to eq(new_conference_conference_registrations_path(conference.short_title)) @event.reload expect(@event.state).to eq('confirmed') end diff --git a/spec/models/ability_spec.rb b/spec/models/ability_spec.rb index 71e11171..dd389545 100644 --- a/spec/models/ability_spec.rb +++ b/spec/models/ability_spec.rb @@ -35,6 +35,11 @@ describe 'User' do # Test abilities for not signed in users context 'when user is not signed in' do + let(:conference_with_open_registration) { create(:conference) } + let!(:open_registration_period) { create(:registration_period, conference: conference_with_open_registration, start_date: Date.current - 6.days) } + let(:conference_with_closed_registration) { create(:conference) } + let!(:closed_registration_period) { create(:registration_period, conference: conference_with_closed_registration, start_date: Date.current - 6.days, end_date: Date.current - 6.days) } + it{ should be_able_to(:index, Conference)} it{ should be_able_to(:show, conference_public)} @@ -55,8 +60,11 @@ describe 'User' do it{ should be_able_to(:show, User)} - it{ should be_able_to(:create, Registration)} it{ should be_able_to(:show, Registration.new)} + it{ should be_able_to(:create, Registration.new(conference_id: conference_with_open_registration.id))} + it{ should be_able_to(:new, Registration.new(conference_id: conference_with_open_registration.id))} + it{ should_not be_able_to(:new, Registration.new(conference_id: conference_with_closed_registration.id))} + it{ should_not be_able_to(:create, Registration.new(conference_id: conference_with_closed_registration.id))} it{ should_not be_able_to(:manage, registration)} it{ should be_able_to(:create, Event)}