Implement role authorization

app/models/ability.rb

@@ -2,16 +2,144 @@ class Ability
   include CanCan::Ability
 
   def initialize(user)
-    # guest user (not logged in)
-    user ||= User.new
-    if user.admin? || user.organizer?
-      # An admin can manage everything
-      can :manage, :all
+    # The first argument to `can` is the action you are giving the user permission to do.
+    # If you pass :manage it will apply to every action. Other common actions here are
+    # :read, :create, :update and :destroy.
+    #
+    # The second argument is the resource the user can perform the action on. If you pass
+    # :all it will apply to every resource. Otherwise pass a Ruby class of the resource.
+    #
+    # The third argument is an optional hash of conditions to further filter the objects.
+    # For example, here the user can only update published articles.
+    #
+    #   can :update, Article, :published => true
+    #
+    # See the wiki for details: https://github.com/ryanb/cancan/wiki/Defining-Abilities
+
+    # Order Abilities
+    # (Check https://github.com/CanCanCommunity/cancancan/wiki/Ability-Precedence)
+    # Check roles of user, using rolify. Role name is *case sensitive*
+    # user.is_organizer? or user.has_role? :organizer
+    # user.is_cfp_of? Conference or user.has_role? :cfp, Conference
+    # user.is_info_desk_of? Conference
+    # user.is_volunteer_coordinator_of? Conference
+    # user.is_attendee_of? Conference
+    # The following is wrong because a user will only have 'cfp' role for a specific conference
+    # user.is_cfp? # This is always false
+
+
+    user ||= User.new # guest user (not logged in)
+
+    if user.new_record?
+      guest(user)
     else
-      can [:update, :destroy], Event do |event|
-        event.users.include?(user)
+      roles = Role::ACTIONABLES.map {|i| i.parameterize.underscore}
+      if (user.roles.pluck(:name) & roles).empty? && !user.is_admin # User has no roles
+        signed_in(user)
+      else
+        user_with_roles(user)
       end
-      can [:create, :read], Event
     end
   end
+
+  def user_with_roles(user)
+    conf_ids_for_organizer = []
+    venue_ids_for_organizer = []
+    conf_ids_for_cfp = []
+    venue_ids_for_cfp = []
+    conf_ids_for_info_desk = []
+    conf_ids_for_volunteer_coordinator = []
+
+    # Ids of all the conferences for which the user has an 'organizer' role
+    conf_ids_for_organizer =
+        Conference.with_role(:organizer, user).pluck(:id) if user.has_role? :organizer, :any
+    venue_ids_for_organizer =
+        Conference.with_role(:organizer, user).pluck(:venue_id) if user.has_role? :organizer, :any
+    conf_ids_for_cfp =
+      Conference.with_role(:cfp, user).pluck(:id) if user.has_role? :cfp, :any
+    venue_ids_for_cfp =
+        Conference.with_role(:cfp, user).pluck(:venue_id) if user.has_role? :cfp, :any
+    # Ids of all the conferences for which the user has an 'info_desk' role
+    conf_ids_for_info_desk =
+        Conference.with_role(:info_desk, user).pluck(:id) if user.has_role? :info_desk, :any
+    # Ids of all the conferences for which the user has a 'volunteer_coordinator' role
+    conf_ids_for_volunteer_coordinator =
+        Conference.with_role(:volunteer_coordinator, user).pluck(:id) if user.has_role? :volunteer_coordinator, :any
+
+    signed_in(user) # Inherit abilities from signed user
+    # User with role
+    can :manage, User if user.is_admin # ??? || (user.has_role? :organizer, :any)
+    can [:new, :create], Conference if user.is_admin || (user.has_role? :organizer, :any)
+    can [:index, :show, :gallery_photos], Conference
+    can :manage, Conference, id: conf_ids_for_organizer
+#     can :manage, Conference do |conference|
+#       conference.id = conf_ids_for_organizer
+#     end
+    can :manage, Venue, id: venue_ids_for_organizer
+    can :index, Venue, id: venue_ids_for_cfp
+    can :manage, Registration, conference_id: conf_ids_for_organizer + conf_ids_for_info_desk
+    can :manage, Question, conference_id: conf_ids_for_organizer + conf_ids_for_info_desk
+    can :manage, Vposition, conference_id: conf_ids_for_organizer + conf_ids_for_volunteer_coordinator
+    can :manage, Vday, conference_id: conf_ids_for_organizer + conf_ids_for_volunteer_coordinator
+    # The ability to manage an Event means that:
+    # the user can also edit the schedule and that
+    # the user can also vote
+    can :manage, Event, conference_id: conf_ids_for_organizer + conf_ids_for_cfp
+    can :create, Event
+    can :manage, CallForPapers, conference_id: conf_ids_for_organizer + conf_ids_for_cfp
+    can :manage, EventType, conference_id: conf_ids_for_organizer + conf_ids_for_cfp
+    can :manage, Track, conference_id: conf_ids_for_organizer + conf_ids_for_cfp
+    can :manage, DifficultyLevel, conference_id: conf_ids_for_organizer + conf_ids_for_cfp
+    can :manage, EmailSettings, conference_id: conf_ids_for_organizer + conf_ids_for_cfp
+    can :manage, Campaign, conference_id: conf_ids_for_organizer
+    can :manage, Lodging, venue_id: venue_ids_for_organizer
+    can :manage, Photo, conference_id: conf_ids_for_organizer
+    can :manage, Room, conference_id: conf_ids_for_organizer + conf_ids_for_cfp
+    can :manage, Sponsor, conference_id: conf_ids_for_organizer
+    can :manage, SponsorshipLevel, conference_id: conf_ids_for_organizer
+    can :manage, SupporterLevel, conference_id: conf_ids_for_organizer
+    can :manage, Target, conference_id: conf_ids_for_organizer
+    can :manage, Commercial#, commercialable_type: 'Conference', commercialable_id: conf_ids_for_organizer
+    can :index, Commercial, commercialable_type: 'Conference'
+    # Manage commercials for events that belong to a conference of which user is organizer
+    can :manage, Commercial, commercialable_type: 'Event', commercialable_id: Event.where(conference_id: conf_ids_for_organizer + conf_ids_for_cfp).pluck(:id)
+    can :manage, Contact, conference_id: conf_ids_for_organizer
+    can :manage, Campaign, conference_id: conf_ids_for_organizer
+  end
+
+  def guest(user)
+    ## Abilities for everyone, even guests (not logged in users)
+    can [:show, :gallery_photos], Conference do |conference|
+      conference.make_conference_public == true
+    end
+
+    can :show, Event do |event|
+      event.state == 'confirmed'
+    end
+
+    can :index, :schedule # show?
+  end
+
+  def signed_in(user)
+    guest(user) # Inherits abilities of guest
+
+    # Conference Registration
+    can :manage, Registration, user_id: user.id
+
+    ## Proposals
+    # Users can manage their own proposals
+    can :manage, Event, id: user.events.pluck(:id)
+
+    # Submit proposals only for conferences that are not over yet
+    can :create, Event, conference_id: Conference.where('end_date >= ?', Date.today).pluck(:id)
+    # Users can manage their own commercials
+    can :manage, Commercial, commercialable_type: 'Event', commercialable_id: user.events.pluck(:id)
+    # View commercials of confirmed events
+    can :show, Commercial, commercialable_type: 'Event', commercialable_id: Event.where(state: 'confirmed').pluck(:id)
+
+    can :manage, EventAttachment do |ea|
+      Event.find(ea.event_id).event_users.where(user_id: user.id).present?
+    end
+    can :create, EventAttachment
+  end
 end

app/models/call_for_papers.rb

@@ -1,7 +1,7 @@
 class CallForPapers < ActiveRecord::Base
   attr_accessible :start_date, :end_date,
                   :description, :schedule_changes, :rating,
-                  :schedule_public, :include_cfp_in_splash
+                  :schedule_public, :include_cfp_in_splash, :conference_id
   belongs_to :conference
 
   validates_presence_of :start_date, :end_date

app/models/campaign.rb

@@ -1,6 +1,6 @@
 class Campaign < ActiveRecord::Base
-  attr_accessible :name, :utm_source, :utm_medium, :utm_term,
-                  :utm_content, :utm_campaign, :target_ids
+  attr_accessible :name, :target_ids, :conference_id,
+                  :utm_source, :utm_medium, :utm_term, :utm_content, :utm_campaign
 
   validates :name, :utm_campaign, presence: true
 

app/models/conference.rb

@@ -4,6 +4,7 @@
 class Conference < ActiveRecord::Base
   require 'uri'
   serialize :events_per_week, Hash
+  resourcify # Needed to call 'Conference.with_role' in /models/ability.rb
 
   attr_accessible :title, :short_title, :timezone, :html_export_path,
                   :start_date, :end_date, :rooms_attributes, :tracks_attributes,

app/models/difficulty_level.rb

@@ -1,6 +1,6 @@
 class DifficultyLevel < ActiveRecord::Base
-  attr_accessible :title, :description, :color
-  
+  attr_accessible :title, :description, :color, :conference_id
+
   belongs_to :conference
   has_many :events
 

app/models/event_attachment.rb

@@ -6,6 +6,7 @@ class EventAttachment < ActiveRecord::Base
 
   has_attached_file :attachment, path: ":rails_root/storage/:rails_env/attachments/:id/:style/:basename.:extension"
   include Rails.application.routes.url_helpers
+  do_not_validate_attachment_file_type :attachment
 
   def to_jq_upload
     {

app/models/event_type.rb

@@ -1,10 +1,11 @@
 class EventType < ActiveRecord::Base
-  attr_accessible :title, :length, :minimum_abstract_length, :maximum_abstract_length, :color
+  attr_accessible :title, :length, :minimum_abstract_length, :maximum_abstract_length, :color,
+                  :conference_id
 
   belongs_to :conference
 
   validates :title, presence: true
-  validates :length, numericality: {greater_than: 0} 
+  validates :length, numericality: {greater_than: 0}
   validates :minimum_abstract_length, presence: true
   validates :maximum_abstract_length, presence: true
 

app/models/lodging.rb

@@ -1,5 +1,5 @@
 class Lodging < ActiveRecord::Base
-  attr_accessible :name, :description, :photo, :website_link
+  attr_accessible :name, :description, :photo, :website_link, :venue_id
   belongs_to :venue
   has_attached_file :photo,
                     styles: { thumb: '100x100>', large: '300x300>' }

app/models/question.rb

@@ -1,14 +1,14 @@
 class Question < ActiveRecord::Base
-  attr_accessible :title, :global, :answers_attributes, :answer_ids, :question_type_id
-  
+  attr_accessible :title, :global, :answers_attributes, :answer_ids, :question_type_id, :conference_id
+
   belongs_to :question_type
   has_and_belongs_to_many :conferences
-  
+
   has_many :qanswers, dependent: :delete_all
   has_many :answers, through: :qanswers, dependent: :delete_all
-  
+
   validates :title, presence: true
   validates :answers, presence: true
-  
+
   accepts_nested_attributes_for :answers, allow_destroy: true
 end

app/models/role.rb

@@ -1,4 +1,10 @@
 class Role < ActiveRecord::Base
-  attr_accessible :name
+  attr_accessible :name, :description
   has_and_belongs_to_many :users
+  belongs_to :resource, polymorphic: true
+
+  scopify
+
+  LABELS = ['Attendee', 'Volunteer', 'Speaker', 'Sponsor', 'Press', 'Keynote Speaker']
+  ACTIONABLES = ['Organizer', 'CfP', 'Info Desk', 'Volunteers Coordinator']
 end

app/models/room.rb

@@ -1,5 +1,5 @@
 class Room < ActiveRecord::Base
-  attr_accessible :name, :size, :public
+  attr_accessible :name, :size, :public, :conference_id
 
   belongs_to :conference
   has_many :events

app/models/sponsor.rb

@@ -1,6 +1,5 @@
 class Sponsor < ActiveRecord::Base
-  attr_accessible :name, :description, :website_url, :logo,
-                  :sponsorship_level_id
+  attr_accessible :name, :description, :website_url, :logo, :sponsorship_level_id, :conference_id
   belongs_to :sponsorship_level
   belongs_to :conference
   has_attached_file :logo,

app/models/sponsorship_level.rb

@@ -1,5 +1,5 @@
 class SponsorshipLevel < ActiveRecord::Base
-  attr_accessible :title
+  attr_accessible :title, :conference_id
   validates_presence_of :title
   belongs_to :conference
   has_many :sponsors

app/models/supporter_level.rb

@@ -2,5 +2,5 @@ class SupporterLevel < ActiveRecord::Base
   belongs_to :conference
   has_many :supporter_registrations
 
-  attr_accessible :conference, :title, :url, :description, :ticket_price
+  attr_accessible :conference, :title, :url, :description, :ticket_price, :conference_id
 end

app/models/target.rb

@@ -1,7 +1,7 @@
 class Target < ActiveRecord::Base
   include ActionView::Helpers::TextHelper
 
-  attr_accessible :due_date, :target_count, :unit
+  attr_accessible :due_date, :target_count, :unit, :conference_id
 
   default_scope { order('due_date ASC') }
 

app/models/track.rb

@@ -1,5 +1,5 @@
 class Track < ActiveRecord::Base
-  attr_accessible :name, :description, :color
+  attr_accessible :name, :description, :color, :conference_id
 
   belongs_to :conference
 

app/models/user.rb

@@ -1,7 +1,10 @@
 class User < ActiveRecord::Base
+  rolify
   include Gravtastic
   gravtastic size: 32
 
+  before_create :setup_role
+
   # Include default devise modules. Others available are:
   # :token_authenticatable, :confirmable,
   # :lockable, :timeoutable and :omniauthable
@@ -13,7 +16,7 @@ class User < ActiveRecord::Base
   has_many :openids
 
   attr_accessible :email, :password, :password_confirmation, :remember_me, :role_id, :role_ids,
-                  :name, :email_public, :biography, :nickname, :affiliation
+                  :name, :email_public, :biography, :nickname, :affiliation, :is_admin
 
   has_many :event_users, dependent: :destroy
   has_many :events, -> { uniq }, through: :event_users
@@ -23,8 +26,6 @@ class User < ActiveRecord::Base
   has_many :subscriptions, dependent: :destroy
   accepts_nested_attributes_for :roles
 
-  before_create :setup_role
-
   validates :name, presence: true
 
   # Searches for user based on email. Returns found user or new user.
@@ -47,26 +48,24 @@ class User < ActiveRecord::Base
     user
   end
 
-  def role?(role)
-    Rails.logger.debug('Checking role in user')
-    !!roles.find_by_name(role.to_s.downcase.camelize)
-  end
-
-  def admin?
-    role?('Admin')
-  end
-
-  def organizer?
-    role?('Organizer')
-  end
-
   def get_roles
     roles
   end
 
   def setup_role
-    roles << Role.where(name: 'Admin') if User.count == 0
-    roles << Role.where(name: 'Participant') if roles.empty?
+    self.is_admin = true if User.count == 0
+  end
+
+  # Gets the roles of the user, groups them by role.name and returns the resource(s) of each role
+  # ====Returns
+  # * +Hash+ * ->  e.g. 'organizer' =>  "(conf1, conf2)"
+  def show_roles
+    result = {}
+    Role::ACTIONABLES.each do |role|
+      resources = self.roles.where(name: role.parameterize.underscore).map{ |myrole| Conference.find(myrole.resource_id).short_title }.join ', '
+      result[role.parameterize.underscore] = "(#{ resources })" unless resources.blank?
+    end
+    result
   end
 
   def self.prepare(params)