Fix authorization of new and create in ConferenceRegistrationsController

Before authorization we need to set conference relation.
Change in proposal spec cause conference has to have valid registration
period for successful redirect to registration after confirm proposal.

app/controllers/conference_registrations_controller.rb

@@ -1,7 +1,7 @@
 class ConferenceRegistrationsController < ApplicationController
   before_filter :authenticate_user!, except: [:new, :create]
   load_resource :conference, find_by: :short_title
-  authorize_resource :conference_registrations, class: Registration
+  authorize_resource :conference_registrations, class: Registration, except: [:new, :create]
   before_action :set_registration, only: [:edit, :update, :destroy, :show]
 
   def new
@@ -25,8 +25,9 @@ class ConferenceRegistrationsController < ApplicationController
       return
     end
 
-    @registration = Registration.new
+    @registration = Registration.new(conference_id: @conference.id)
-
+    # make sure that conference is open for registration
+    authorize! :new, @registration
     # @user variable needs to be set so that _sign_up_form_embedded works properly
     @user = @registration.build_user
   end
@@ -50,6 +51,7 @@ class ConferenceRegistrationsController < ApplicationController
     end
 
     @registration.user = @user
+    authorize! :create, @registration
 
     if @registration.save
       # Trigger ahoy event

app/models/ability.rb

@@ -46,9 +46,13 @@ class Ability
     can :show, Commercial, commercialable_type: 'Event', commercialable_id: Event.where(state: 'confirmed').pluck(:id)
     can :show, User
     unless CONFIG['authentication']['ichain']['enabled']
-      can [:show, :create], Registration do |registration|
+      can :show, Registration do |registration|
         registration.new_record?
       end
+
+      can [:new, :create], Registration do |registration|
+        registration.conference.registration_open? && registration.new_record?
+      end
       can :show, Event do |event|
         event.new_record?
       end

spec/features/conference_registration_spec.rb

@@ -49,5 +49,16 @@ feature Registration do
         expect(conference.user_registered?(participant)).to be(true)
       end
     end
+
+    context 'registration is closed' do
+      let(:conference_with_closed_registration) { create(:conference, registration_period: create(:registration_period)) }
+
+      scenario 'registers for a conference', feature: true do
+        participant.is_admin = false
+        visit new_conference_conference_registrations_path(conference_with_closed_registration.short_title)
+        expect(current_path).to eq(root_path)
+        expect(flash).to eq 'You are not authorized to access this page.'
+      end
+    end
   end
 end

spec/features/proposal_spec.rb

@@ -2,6 +2,7 @@ require 'spec_helper'
 
 feature Event do
   let!(:conference) { create(:conference) }
+  let!(:registration_period) { create(:registration_period, conference: conference, start_date: Date.current) }
   let!(:cfp) { create(:cfp, program_id: conference.program.id) }
   let!(:organizer_role) { Role.find_by(name: 'organizer', resource: conference) }
   let!(:organizer) { create(:user, email: 'admin@example.com', role_ids: [organizer_role.id]) }
@@ -134,6 +135,7 @@ feature Event do
       click_link "confirm_proposal_#{@event.id}"
       expect(flash).
         to eq('The proposal was confirmed. Please register to attend the conference.')
+      expect(current_path).to eq(new_conference_conference_registrations_path(conference.short_title))
       @event.reload
       expect(@event.state).to eq('confirmed')
     end

spec/models/ability_spec.rb

@@ -35,6 +35,11 @@ describe 'User' do
 
     # Test abilities for not signed in users
     context 'when user is not signed in' do
+      let(:conference_with_open_registration) { create(:conference) }
+      let!(:open_registration_period) { create(:registration_period, conference: conference_with_open_registration, start_date: Date.current - 6.days) }
+      let(:conference_with_closed_registration) { create(:conference) }
+      let!(:closed_registration_period) { create(:registration_period, conference: conference_with_closed_registration, start_date: Date.current - 6.days, end_date: Date.current - 6.days) }
+
       it{ should be_able_to(:index, Conference)}
 
       it{ should be_able_to(:show, conference_public)}
@@ -55,8 +60,11 @@ describe 'User' do
 
       it{ should be_able_to(:show, User)}
 
-      it{ should be_able_to(:create, Registration)}
       it{ should be_able_to(:show, Registration.new)}
+      it{ should be_able_to(:create, Registration.new(conference_id: conference_with_open_registration.id))}
+      it{ should be_able_to(:new, Registration.new(conference_id: conference_with_open_registration.id))}
+      it{ should_not be_able_to(:new, Registration.new(conference_id: conference_with_closed_registration.id))}
+      it{ should_not be_able_to(:create, Registration.new(conference_id: conference_with_closed_registration.id))}
       it{ should_not be_able_to(:manage, registration)}
 
       it{ should be_able_to(:create, Event)}