Implement role authorization

app/views/admin/commercials/index.html.haml

@@ -14,8 +14,11 @@
             = commercial.commercial_type
           .flexvideo
             = render partial: 'shared/media_item', locals: { commercial_type: commercial.commercial_type, commercial_id: commercial.commercial_id }
-          = link_to 'Edit', edit_admin_conference_commercial_path(@conference.short_title, commercial.id), class: 'btn btn-primary'
-          = link_to 'Delete', admin_conference_commercial_path(@conference.short_title, commercial.id),
-            method: :delete, data: { confirm: 'Are you sure?' }, class: 'btn btn-danger'
-%br
+          - if can? :update, commercial
+            = link_to 'Edit', edit_admin_conference_commercial_path(@conference.short_title, commercial.id), class: 'btn btn-primary'
+          - if can? :destroy, commercial
+            = link_to 'Delete', admin_conference_commercial_path(@conference.short_title, commercial.id),
+              method: :delete, data: { confirm: 'Are you sure?' }, class: 'btn btn-danger'
+- if can? :create, @conference.commercials.new
+  %br
   = link_to 'New Commercial', new_admin_conference_commercial_path, class: 'btn btn-primary'

app/views/admin/conference/_roles.html.haml

@@ -0,0 +1,29 @@
+.roles{ id: 'myroles' }
+  - unless @role.blank?
+    %p.text-muted
+      = @role.first.description
+
+  %hr
+  .row
+    .col-md-6
+      = semantic_form_for(:user, url: add_user_admin_conference_path(@conference.short_title, role: @selected), remote: true) do |f|
+        %h4
+          = f.input :email, label: "Add role '#{@selected}' to user: ", placeholder: "User's email"
+        = f.action :submit, as: :button, label: "Add User", button_html: {value: 'Add', class: 'btn btn-primary'}
+  .row
+    .col-md-12
+      %h3 Users with role #{@selected}
+      %table.table.table-striped.table-bordered.table-hover
+        %thead
+          %th ID
+          %th Name
+          %th Email
+        %tbody
+          - @role_users[@selection].each do |user|
+            %tr
+              %td
+                = link_to remove_user_admin_conference_path(@conference.short_title, user: user, role: @selected), method: :delete, remote: true, title: 'Remove user' do
+                  %i{class: 'fa fa-times'}
+                = user.id
+                %td= user.name
+                %td= user.email

app/views/admin/conference/_todo_list.html.haml

@@ -8,25 +8,49 @@
         = conference_progress['process'] + '%'
   %li{'class'=>class_for_todo(conference_progress['registration'])}
     %span{'class'=>icon_for_todo(conference_progress['registration'])}
-    = link_to 'Set up registration period', edit_admin_conference_path(conference_progress['short_title'], :anchor => 'conference-end-datepicker')
+    - if can? :update, @conference.registrations.build
+      = link_to 'Set up registration period', edit_admin_conference_path(conference_progress['short_title'], :anchor => 'conference-end-datepicker')
+    - else
+      Set up registration period
   %li{'class'=>class_for_todo(conference_progress['cfp'])}
     %span{'class'=>icon_for_todo(conference_progress['cfp'])}
-    = link_to 'Set up call for papers', admin_conference_callforpapers_path(conference_progress['short_title'])
+    - if can? :update, CallForPapers.new(conference_id: @conference.id)
+      = link_to 'Set up call for papers', admin_conference_callforpapers_path(conference_progress['short_title'])
+    - else
+      Set up call for papers
   %li{'class'=>class_for_todo(conference_progress['venue'])}
     %span{'class'=>icon_for_todo(conference_progress['venue'])}
-    = link_to 'Add venue', admin_conference_venue_info_path(conference_progress['short_title'])
+    - if can? :update, @conference.venue
+      = link_to 'Add venue', admin_conference_venue_info_path(conference_progress['short_title'])
+    - else
+      Add venue
   %li{'class'=>class_for_todo(conference_progress['rooms'])}
     %span{'class'=>icon_for_todo(conference_progress['rooms'])}
-    = link_to 'Add rooms', admin_conference_rooms_path(conference_progress['short_title'])
+    - if can? :update, @conference.rooms.build
+      = link_to 'Add rooms', admin_conference_rooms_path(conference_progress['short_title'])
+    - else
+      Add rooms
   %li{'class'=>class_for_todo(conference_progress['tracks'])}
     %span{'class'=>icon_for_todo(conference_progress['tracks'])}
-    = link_to 'Add tracks', admin_conference_tracks_path(conference_progress['short_title'])
+    - if can? :update, @conference.tracks.build
+      = link_to 'Add tracks', admin_conference_tracks_path(conference_progress['short_title'])
+    - else
+      Add tracks
   %li{'class'=>class_for_todo(conference_progress['event_types'])}
     %span{'class'=>icon_for_todo(conference_progress['event_types'])}
-    = link_to 'Add event types', admin_conference_eventtypes_path(conference_progress['short_title'])
+    - if can? :update, @conference.event_types.build
+      = link_to 'Add event types', admin_conference_event_types_path(conference_progress['short_title'])
+    - else
+      Add event types
   %li{'class'=>class_for_todo(conference_progress['difficulty_levels'])}
     %span{'class'=>icon_for_todo(conference_progress['difficulty_levels'])}
-    = link_to 'Add difficulty levels', admin_conference_difficulty_levels_path(conference_progress['short_title'])
+    - if can? :update, @conference.difficulty_levels.build
+      = link_to 'Add difficulty levels', admin_conference_difficulty_levels_path(conference_progress['short_title'])
+    - else
+      Add difficulty levels
   %li{class: class_for_todo(conference_progress['make_conference_public'])}
     %span{'class'=>icon_for_todo(conference_progress['make_conference_public'])}
-    = link_to 'Make Splash Page Public for Visitors', edit_admin_conference_path(conference_progress['short_title'])
+    - if can? :update, @conference
+      = link_to 'Make Splash Page Public for Visitors', edit_admin_conference_path(conference_progress['short_title'])
+    - else
+      Make Splash Page Public for Visitors

app/views/admin/conference/roles.html.haml

@@ -0,0 +1,22 @@
+.row
+  .col-md-6
+    = semantic_form_for(:user, url: roles_admin_conference_path(@conference.short_title), remote: true) do |f|
+      %h4
+        = f.input :roles, collection: @roles, label: 'Show users for role: '
+
+= render partial: 'roles'
+
+:javascript
+
+  $("#user_roles_input").change(function () {
+
+    var url = document.forms[0].action;
+    var selected_role = $(this).find('option:selected').attr('value');
+
+    $.ajax({
+      url: url,
+      type: "POST",
+      data: {user: { roles: selected_role } },
+      dataType: "script"
+    });
+  });

app/views/admin/conference/roles.js.erb

@@ -0,0 +1 @@
+$('#myroles').html("<%= escape_javascript(render partial: 'roles').html_safe %>");

app/views/admin/event_types/index.html.haml

@@ -1,5 +1,5 @@
 .row
   .col-md-8
-    = semantic_form_for(@conference, url: admin_conference_eventtypes_path(@conference.short_title, @conference.event_types)) do |f|
+    = semantic_form_for(@conference, url: admin_conference_event_types_path(@conference.short_title, @conference.event_types)) do |f|
       = dynamic_association :event_types, "Event Types", f
       = f.action :submit, :as => :button, :button_html => {:class => "btn btn-primary"}

app/views/admin/questions/_questions.html.haml

@@ -18,11 +18,11 @@
         = ','
         = label_tag dom_id(q), "Answers: #{q.answers.map {|a| a.title}.join(', ')}"
 
-      %td= link_to 'Edit', edit_admin_conference_question_path(@conference.short_title, q),
-                    class: 'btn btn-primary',
-                    disabled: q.global == true && !has_role?(current_user, 'Admin')
+      - if can? :update, q
+        %td= link_to 'Edit', edit_admin_conference_question_path(@conference.short_title, q),
+                      class: 'btn btn-primary', disabled: q.global == true
 
-      %td= link_to 'Delete', admin_conference_question_path(@conference.short_title, q),
-                    method: :delete, remote: true, class: 'btn btn-danger',
-                    confirm: "Delete question '#{q.title}'?",
-                    disabled: q.global == true && !has_role?(current_user, "Admin")
+      - if can? :destroy, q
+        %td= link_to 'Delete', admin_conference_question_path(@conference.short_title, q),
+                      method: :delete, remote: true, class: 'btn btn-danger',
+                      confirm: "Delete question '#{q.title}'?", disabled: q.global == true

app/views/admin/registrations/index.html.haml

@@ -7,9 +7,11 @@
           = "(#{@registrations.length})"
         = " - Attended (#{@attended})"
         .btn-group.pull-right
-          = link_to "New", new_admin_conference_registration_path(@conference.short_title), :class => "btn btn-default"
-          = link_to "Export PDF", admin_conference_registrations_path(@conference.short_title, :format => :pdf), :class => "btn btn-default"
-          = link_to "Export XLS", {:format => :xlsx}, :class => "btn btn-default"
+          - if can? :create, Registration
+            = link_to "New", new_admin_conference_registration_path(@conference.short_title), :class => "btn btn-default"
+          - if can? :read, Registration
+            = link_to "Export PDF", admin_conference_registrations_path(@conference.short_title, :format => :pdf), :class => "btn btn-default"
+            = link_to "Export XLS", {:format => :xlsx}, :class => "btn btn-default"
     %table.table.table-bordered.table-striped.table-hover#registrations
       %thead
         %th
@@ -21,7 +23,7 @@
         %th
         %th
         %th
-      - counter = 0    
+      - counter = 0
       - @registrations.each do |registration|
         %tr
           %td
@@ -33,7 +35,7 @@
                 - if registration.supporter_level && registration.supporter_level.title != 'Free'
                   %p{:style => "color:red"}
                     = registration.supporter_level.title
-          
+
               -elsif field == 'attended'
                 = link_to "#{registration.send(field.to_sym)}", admin_conference_registrations_change_field_path(@conference.short_title, :id => registration.id, :view_field => "#{field}"), :method => :patch, ":#{field}" => registration.send(field.to_sym), :class => "btn btn-success"
 
@@ -64,11 +66,11 @@
         "bLengthChange": false
       } );
   } );
-  
+
   function toggle(rowid) {
     if( document.getElementById(rowid).style.display=='none' ){
       document.getElementById(rowid).style.display = '';
     }else{
       document.getElementById(rowid).style.display = 'none';
     }
-  };
+  };

app/views/admin/users/_form.html.haml

@@ -1,8 +1,14 @@
 = semantic_form_for [:admin, @user] do |f|
-  = f.inputs "Basic Information" do
+  = f.inputs 'Basic Information' do
+    = f.input :is_admin, hint: 'An admin can create a new conference, manage users and make other users admins.'
     = f.input :name, :as => :string
     = f.input :email
-    = f.input :affiliation, :as => :string
-    = f.input :biography, :input_html => {:rows => 10}
-  = f.actions do
-    = f.action :submit, :button_html => {:class => "btn btn-primary"}
+    = f.input :affiliation, as: :string
+    = f.input :biography, input_html: { rows: 5, "onkeyup" => "word_count(this, 'biography-count', 150)" }
+    You have used
+    %span#biography-count #{@user.biography_word_count}
+    words.  Biographies are limited to 150 words.
+    %br
+    %br
+    = f.actions do
+      = f.action :submit, button_html: { class: 'btn btn-primary' }

app/views/admin/users/index.html.haml

@@ -5,7 +5,7 @@
       - if @users
         = "(#{@users.length})"
 
-      = link_to "New User", new_admin_user_path, :class => "btn btn-success pull-right"
+      = link_to "New User", new_admin_user_path, class: 'btn btn-success pull-right'
     .well
       %table.table.table-striped.table-bordered.table-hover#users
         %thead
@@ -18,7 +18,7 @@
           %th
             %b Name
           %th
-            %b # of Conference Registrations
+            %b Attended Conferences
           %th
             %b Roles
           %th
@@ -38,39 +38,24 @@
             %td
               = user.name
             %td
-              = user.registrations.count
+              = user.registrations.where(attended: true).count
             %td
-              .modal.fade{:id => "user-role-selection-#{user.id}", "role" => "dialog", "aria-hidden" => "true"}
-                .modal-dialog
-                  .modal-content
-                    .modal-header
-                      %button{"type"=>"button", :class=>"close", "data-dismiss"=>"modal", "aria-hidden"=>"true"}
-                        ×
-                      %h3{:id => "role-selector-header-#{user.id}"}
-                        Modifying Roles
-                    .modal-body
-                      - if current_user == user
-                        You cannot modify your own role!
-                        %br
-                        %button{:class=> "btn btn-danger", "data-dismiss"=> "modal", "aria-hidden"=>"true"}
-                          Cancel
-                      - else
-                        = "Give #{user.name} (#{user.email}) the following roles:"
-                        = semantic_form_for(user, :url => admin_user_path(user), :method => :put) do |f|
-                          = f.input :roles, :label => false
-                          %button{:class=> "btn btn-danger", "data-dismiss"=> "modal", "aria-hidden"=>"true"}
-                            Cancel
-                          = f.action :submit, :as => :button, :button_html => {:value => "Save", :class => "btn btn-primary"}
-              =link_to "#{user.roles.map { |role| role.name }.join ', '}", "#", "data-toggle" => "modal", "data-target" => "#user-role-selection-#{user.id}",id: "user-modify-role-#{user.id}"
-            %td
-              = link_to "Edit", edit_admin_user_path(user)
-            %td
-              = link_to "View", admin_user_path(user)
-            %td
-              - if current_user.id == user.id or user.role_ids.include? 3
-                =link_to 'Delete',admin_user_path(user), :method => :delete , :data => {:confirm => 'Are you sure ?'}, :disabled => true,:class => "btn btn-primary disabled btn-danger",:role => "button"
-              - else
-                =link_to 'Delete',admin_user_path(user), :method=> :delete , :data=> {:confirm => 'Are you sure ?'},:class => "btn btn-primary btn-danger"
+              - unless user.show_roles.blank?
+                = user.show_roles.first(2).map { |x| x[0].titleize + ' ' + x[1] }.join ', '
+                - if user.show_roles.count > 2
+                  = '...'
+            - if can? :show, user
+              %td
+                = link_to "View", admin_user_path(user), class: 'btn btn-success'
+            - if can? :update, user
+              %td
+                = link_to "Edit", edit_admin_user_path(user), class: 'btn btn-primary'
+            - if can? :destroy, user
+              %td
+                - if current_user.id == user.id or user.role_ids.include? 3
+                  =link_to 'Delete',admin_user_path(user), :method => :delete , :data => {:confirm => 'Are you sure ?'}, :disabled => true,:class => "btn btn-primary disabled btn-danger",:role => "button"
+                - else
+                  =link_to 'Delete',admin_user_path(user), :method=> :delete , :data=> {:confirm => 'Are you sure ?'},:class => "btn btn-primary btn-danger"
 
 
 :javascript

app/views/admin/users/show.html.haml

@@ -1,7 +1,11 @@
 %table.table
   - @show_attributes.each do |attr|
     %tr
-      %td
+      %td{style: 'width:20%'}
         %b
           = attr.capitalize.gsub('_', ' ')
-      %td= @user.send(attr)
+      - if attr == 'roles'
+        %td
+          = @user.show_roles.map { |x| x[0].titleize + ' ' + x[1] }.join ', '
+      - else
+        %td= @user.send(attr)

app/views/conference/_registration.html.haml

@@ -13,7 +13,7 @@
     -else
       %h4 Registration is Closed, it was from #{ date_string(@conference.registration_start_date, @conference.registration_end_date) }
   - if @conference.registration_open?
-    = link_to "Register for #{@conference.short_title}", register_conference_path(@conference.short_title), :class =>"btn btn-success btn-lg", target: '_blank'
+    = link_to "Register for #{@conference.short_title}", conference_register_path(@conference.short_title), :class =>"btn btn-success btn-lg", target: '_blank'
   - if @conference.use_supporter_levels?
     - if @conference.include_tickets_in_splash?
       = render 'tickets'

app/views/conference_registration/register.html.haml

@@ -1,6 +1,6 @@
 .row
   .col-md-12
-    = semantic_form_for(@registration, :url => register_conference_path(@conference.short_title), :html => { :method => :patch }) do |f|
+    = semantic_form_for(@registration, :url => conference_register_path(@conference.short_title), :html => { :method => :patch }) do |f|
       .tabbable
         %ul.nav.nav-tabs
           %li.active
@@ -16,7 +16,7 @@
               = render 'conference_registration/volunteer', :f => f
       - if @registered
         = f.action :submit, :button_html => { :value => "Update Registration", :class => "btn btn-primary" }
-        = link_to "Unregister", register_conference_path(@conference.short_title),:method => :delete, :class => "btn btn-danger",
+        = link_to "Unregister", conference_register_path(@conference.short_title),:method => :delete, :class => "btn btn-danger",
                     :confirm => "Are you sure you want to unregister?"
       - else
         = f.action :submit, :button_html => { :value => "Register", :class => "btn btn-primary", id: 'register' }

app/views/home/_conference_details.html.haml

@@ -31,9 +31,9 @@
                 = link_to "View Conference", conference_path(conference.short_title), :class =>"btn btn-default"
             - if conference.registration_open?
               - if conference.user_registered?(current_user)
-                = link_to "Modify Registration", register_conference_path(conference.short_title), :class =>"btn btn-default"
+                = link_to "Modify Registration", conference_register_path(conference.short_title), :class =>"btn btn-default"
               - else
-                = link_to "Register", register_conference_path(conference.short_title), :class =>"btn btn-success"
+                = link_to "Register", conference_register_path(conference.short_title), :class =>"btn btn-success"
             = link_to "Schedule", conference_schedule_path(conference.short_title), :class =>"btn btn-default" if conference.call_for_papers and conference.call_for_papers.schedule_public
             - if !current_user.nil? && current_user.proposal_count(conference) > 0
               = link_to "View My Proposals", conference_proposal_index_path(conference.short_title), :class =>"btn btn-default"

app/views/home/index.html.haml

@@ -2,4 +2,4 @@
   .col-md-12.page-header
     %h2.text-center Upcoming Conferences
 - @current.each do |conference|
-  = render :partial => "conference_details", :locals => {:conference => conference}
+  = render :partial => "conference_details", :locals => {:conference => conference}

app/views/layouts/_admin_sidebar.html.haml

@@ -10,97 +10,129 @@
           %span.glyphicon.glyphicon-home
           All Conferences
       - @conferences.each do |conference|
+        - if can? :show, conference
+          %li
+            = link_to(admin_conference_path(conference.short_title)) do
+              %span.glyphicon.glyphicon-cog
+              Manage
+              = conference.short_title
+      - if (current_user.is_admin) || (current_user.has_role? :organizer, :any)
         %li
-          = link_to(admin_conference_path(conference.short_title)) do
-            %span.glyphicon.glyphicon-cog
-            Manage
-            = conference.short_title
-      %li
-        = link_to(new_admin_conference_path) do
-          %span.glyphicon.glyphicon-plus
-          New Conference
+          = link_to(new_admin_conference_path) do
+            %span.glyphicon.glyphicon-plus
+            New Conference
   %hr
-  %li{:class=> "#{active_nav_li(admin_conference_path(@conference.short_title))} nav-header nav-header-bigger"}
-    = link_to(admin_conference_path(@conference.short_title)) do
-      %span.fa.fa-tachometer
-      Dashboard
-  %li{:class=> "#{active_nav_li(edit_admin_conference_path(@conference.short_title))}"}
-    = link_to(edit_admin_conference_path(@conference.short_title)) do
-      %span.fa.fa-home
-      Basics
-    %ul
-      %li{:class=> "#{active_nav_li(edit_admin_conference_contact_path(@conference.short_title))}"}
-        = link_to(edit_admin_conference_contact_path(@conference.short_title)) do
-          %span.fa.fa-envelope-o
-          Contact
-      %li{:class=> "#{active_nav_li(admin_conference_commercials_path(@conference.short_title))}"}
-        = link_to(admin_conference_commercials_path(@conference.short_title)) do
-          %span.fa.fa-film
-          Commercials
-      %li{:class=> "#{active_nav_li(admin_conference_photos_path(@conference.short_title))}"}
-        = link_to(admin_conference_photos_path(@conference.short_title)) do
-          %span.fa.fa-picture-o
-          Photos
-  %li{:class=> active_nav_li(admin_conference_events_path(@conference.short_title))}
-    = link_to(admin_conference_events_path(@conference.short_title)) do
-      %span.glyphicon.glyphicon-comment
-      Events
-  %li{:class=> active_nav_li(admin_conference_registrations_path(@conference.short_title))}
-    = link_to(admin_conference_registrations_path(@conference.short_title)) do
-      %span.glyphicon.glyphicon-user
-      Registrations
-  %li{class: active_nav_li(admin_conference_schedule_path(@conference.short_title))}
-    = link_to(admin_conference_schedule_path(@conference.short_title), target: '_blank') do
-      %span.glyphicon.glyphicon-calendar
-      Schedule
-  %li{class: active_nav_li(admin_conference_campaigns_path(@conference.short_title))}
-    = link_to(admin_conference_campaigns_path(@conference.short_title)) do
-      %span.glyphicon.glyphicon-bullhorn
-      Campaigns
+  - if can? :show, @conference
+    %li{:class=> "#{active_nav_li(admin_conference_path(@conference.short_title))} nav-header nav-header-bigger"}
+      = link_to(admin_conference_path(@conference.short_title)) do
+        %span.fa.fa-tachometer
+        Dashboard
+  - if can? :update, @conference
+    %li{:class=> "#{active_nav_li(edit_admin_conference_path(@conference.short_title))}"}
+      = link_to(edit_admin_conference_path(@conference.short_title)) do
+        %span.fa.fa-home
+        Basics
+      - if can? :update, Contact.new(conference_id: @conference.id)
+        %ul
+          %li{:class=> "#{active_nav_li(edit_admin_conference_contact_path(@conference.short_title))}"}
+            = link_to(edit_admin_conference_contact_path(@conference.short_title)) do
+              %span.fa.fa-envelope-o
+              Contact
+          - if can? :index, @conference.commercials.build
+            %li{:class=> "#{active_nav_li(admin_conference_commercials_path(@conference.short_title))}"}
+              = link_to(admin_conference_commercials_path(@conference.short_title)) do
+                %span.fa.fa-film
+                Commercials
+          - if can? :update, @conference.photos.build
+            %li{:class=> "#{active_nav_li(admin_conference_photos_path(@conference.short_title))}"}
+              = link_to(admin_conference_photos_path(@conference.short_title)) do
+                %span.fa.fa-picture-o
+                Photos
+  - if can? :update, @conference.events.build
+    %li{:class=> active_nav_li(admin_conference_events_path(@conference.short_title))}
+      = link_to(admin_conference_events_path(@conference.short_title)) do
+        %span.glyphicon.glyphicon-comment
+        Events
+  - if can? :update, Registration.new(conference_id: @conference.id)
+    %li{:class=> active_nav_li(admin_conference_registrations_path(@conference.short_title))}
+      = link_to(admin_conference_registrations_path(@conference.short_title)) do
+        %span.glyphicon.glyphicon-user
+        Registrations
+  - if can? :update, @conference.events.build
+    %li{class: active_nav_li(admin_conference_schedule_path(@conference.short_title))}
+      = link_to(admin_conference_schedule_path(@conference.short_title), target: '_blank') do
+        %span.glyphicon.glyphicon-calendar
+        Schedule
+  - if can? :update, @conference
+    %li{class: active_nav_li(admin_conference_campaigns_path(@conference.short_title))}
+      = link_to(admin_conference_campaigns_path(@conference.short_title)) do
+        %span.glyphicon.glyphicon-bullhorn
+        Campaigns
   %hr
-  %li{:class=> "#{active_nav_li(admin_conference_targets_path(@conference.short_title))}"}
-    = link_to(admin_conference_targets_path(@conference.short_title)) do
-      %span.glyphicon.glyphicon-flag
-      Targets
-  %li{:class=> "#{active_nav_li(admin_conference_venue_info_path(@conference.short_title))} myAccordion"}
-    = link_to(admin_conference_venue_info_path(@conference.short_title)) do
-      %span.glyphicon.glyphicon-road
-      Venue
-      %span.small.glyphicon.glyphicon-chevron-right
-    %ul.nav.nav-stacked.nav-pills.small.collapse.subNav
-      %li{:class=> active_nav_li(admin_conference_rooms_path(@conference.short_title))}
-        = link_to 'Rooms', admin_conference_rooms_path(@conference.short_title)
-      %li{ class: active_nav_li(admin_conference_lodgings_path(@conference.short_title)) }
-        = link_to 'Lodgings', admin_conference_lodgings_path(@conference.short_title)
-  %li{:class=> "#{active_nav_li(admin_conference_sponsorship_levels_path(@conference.short_title))} myAccordion" }
-    = link_to(admin_conference_sponsorship_levels_path(@conference.short_title)) do
-      %span.glyphicon.glyphicon-star
-      Sponsorship
-      %span.small.glyphicon.glyphicon-chevron-right
-    %ul.nav.nav-stacked.nav-pills.small.collapse.subNav
-      %li{:class=> active_nav_li(admin_conference_sponsors_path(@conference.short_title))}
-        = link_to 'Sponsors', admin_conference_sponsors_path(@conference.short_title)
-  %li{ class: active_nav_li(admin_conference_supporter_levels_path(@conference.short_title)) }
-    = link_to(admin_conference_supporter_levels_path(@conference.short_title)) do
-      %span.glyphicon.glyphicon-usd
-      Supporter Levels
-  %li{:class=> active_nav_li(admin_conference_emails_path(@conference.short_title))}
-    = link_to(admin_conference_emails_path(@conference.short_title)) do
-      %span.glyphicon.glyphicon-envelope
-      E-Mails
-  %li{:class=> "#{active_nav_li(admin_conference_callforpapers_path(@conference.short_title))} myAccordion"}
-    = link_to(admin_conference_callforpapers_path(@conference.short_title)) do
-      %span.glyphicon.glyphicon-comment
-      Call for papers
-      %span.small.glyphicon.glyphicon-chevron-right
-    %ul.nav.nav-stacked.nav-pills.small.collapse.subNav
-      %li{:class=> active_nav_li(admin_conference_tracks_path(@conference.short_title))}
-        = link_to 'Tracks', admin_conference_tracks_path(@conference.short_title)
-      %li{:class=> active_nav_li(admin_conference_eventtypes_path(@conference.short_title))}
-        = link_to 'Event types', admin_conference_eventtypes_path(@conference.short_title)
-      %li{:class=> active_nav_li(admin_conference_difficulty_levels_path(@conference.short_title))}
-        = link_to 'Difficulty levels', admin_conference_difficulty_levels_path(@conference.short_title)
+  - if can? :update, @conference
+    %li{:class=> "#{active_nav_li(edit_admin_conference_path(@conference.short_title))} nav-header nav-header-bigger"}
+      = link_to(edit_admin_conference_path(@conference.short_title)) do
+        %span.glyphicon.glyphicon-cog
+        Settings
+  - if can? :update, @conference.targets.build
+    %li{:class=> "#{active_nav_li(admin_conference_targets_path(@conference.short_title))}"}
+      = link_to(admin_conference_targets_path(@conference.short_title)) do
+        %span.glyphicon.glyphicon-flag
+        Targets
+  - if can? :index, @conference.venue
+    %li{:class=> "#{active_nav_li(admin_conference_venue_info_path(@conference.short_title))} myAccordion"}
+      = link_to(admin_conference_venue_info_path(@conference.short_title)) do
+        %span.glyphicon.glyphicon-road
+        Venue
+        %span.small.glyphicon.glyphicon-chevron-right
+      %ul.nav.nav-stacked.nav-pills.small.collapse.subNav
+        - if can? :update, @conference.rooms.build
+          %li{:class=> active_nav_li(admin_conference_rooms_path(@conference.short_title))}
+            = link_to 'Rooms', admin_conference_rooms_path(@conference.short_title)
+        - if can? :update, @conference.venue.lodgings.build
+          %li{ class: active_nav_li(admin_conference_lodgings_path(@conference.short_title)) }
+            = link_to 'Lodgings', admin_conference_lodgings_path(@conference.short_title)
+  - if can? :update, @conference.sponsorship_levels.build
+    %li{:class=> "#{active_nav_li(admin_conference_sponsorship_levels_path(@conference.short_title))} myAccordion" }
+      = link_to(admin_conference_sponsorship_levels_path(@conference.short_title)) do
+        %span.glyphicon.glyphicon-star
+        Sponsorship
+        %span.small.glyphicon.glyphicon-chevron-right
+      %ul.nav.nav-stacked.nav-pills.small.collapse.subNav
+        - if can? :update, @conference.sponsors.build
+          %li{:class=> active_nav_li(admin_conference_sponsors_path(@conference.short_title))}
+            = link_to 'Sponsors', admin_conference_sponsors_path(@conference.short_title)
+  - if can? :update, @conference.supporter_levels.build
+    %li{ class: active_nav_li(admin_conference_supporter_levels_path(@conference.short_title)) }
+      = link_to(admin_conference_supporter_levels_path(@conference.short_title)) do
+        %span.glyphicon.glyphicon-usd
+        Supporter Levels
+  - if can? :update, @conference.email_settings
+    %li{:class=> active_nav_li(admin_conference_emails_path(@conference.short_title))}
+      = link_to(admin_conference_emails_path(@conference.short_title)) do
+        %span.glyphicon.glyphicon-envelope
+        E-Mails
+  - if can? :update, CallForPapers.new(conference_id: @conference.id)
+    %li{:class=> "#{active_nav_li(admin_conference_callforpapers_path(@conference.short_title))} myAccordion"}
+      = link_to(admin_conference_callforpapers_path(@conference.short_title)) do
+        %span.glyphicon.glyphicon-comment
+        Call for papers
+        %span.small.glyphicon.glyphicon-chevron-right
+      %ul.nav.nav-stacked.nav-pills.small.collapse.subNav
+        - if can? :update, @conference.tracks.build
+          %li{:class=> active_nav_li(admin_conference_tracks_path(@conference.short_title))}
+            = link_to 'Tracks', admin_conference_tracks_path(@conference.short_title)
+        - if can? :update, @conference.event_types.build
+          %li{:class=> active_nav_li(admin_conference_event_types_path(@conference.short_title))}
+            = link_to 'Event types', admin_conference_event_types_path(@conference.short_title)
+        - if can? :update, @conference.difficulty_levels.build, conference_id: @conference.id
+          %li{:class=> active_nav_li(admin_conference_difficulty_levels_path(@conference.short_title))}
+            = link_to 'Difficulty levels', admin_conference_difficulty_levels_path(@conference.short_title)
+  - if can? :update, Question.new(conference_id: @conference.id)
     %li{:class=> active_nav_li(admin_conference_questions_path(@conference.short_title))}
       = link_to(admin_conference_questions_path(@conference.short_title)) do
         %span.glyphicon.glyphicon-question-sign
         Questions
+  - if can? :manage, @conference
+    %li{:class=> active_nav_li(roles_admin_conference_path(@conference.short_title))}
+      = link_to 'Roles', roles_admin_conference_path(@conference.short_title)

app/views/layouts/_admin_sidebar_index.html.haml

@@ -10,17 +10,20 @@
           %span.glyphicon.glyphicon-home
           All Conferences
       - @conferences.each do |conference|
+        - if can? :show, conference
+          %li
+            = link_to(admin_conference_path(conference.short_title)) do
+              %span.glyphicon.glyphicon-cog
+              Manage
+              = conference.short_title
+      - if (current_user.is_admin) || (current_user.has_role? :organizer, :any)
         %li
-          = link_to(admin_conference_path(conference.short_title)) do
-            %span.glyphicon.glyphicon-cog
-            Manage
-            = conference.short_title
-      %li
-        = link_to(new_admin_conference_path) do
-          %span.glyphicon.glyphicon-plus
-          New Conference
-  %hr
-  %li
-    = link_to(admin_users_path) do
-      %span.glyphicon.glyphicon-user
-      Users
+          = link_to(new_admin_conference_path) do
+            %span.glyphicon.glyphicon-plus
+            New Conference
+  - if can? :index, User
+    %hr
+    %li
+      = link_to(admin_users_path) do
+        %span.glyphicon.glyphicon-user
+        Users

app/views/layouts/_user_menu.html.haml

@@ -11,13 +11,13 @@
   = link_to(destroy_user_session_path, :method=>'delete') do
     %span.glyphicon.glyphicon-minus
     Sign out
--if has_role?(current_user, "admin") || has_role?(current_user, "organizer")
+- if can? :index, Conference
   %li.divider
     %li
       = link_to(admin_conference_index_path()) do
         %span.glyphicon.glyphicon-home
         Administration
-    -if @conference and @conference.id
+    -if @conference and @conference.id and can? :show, @conference
       %li
         = link_to(admin_conference_path(@conference.short_title)) do
           %span.glyphicon.glyphicon-cog

app/views/proposal/_form.html.haml

@@ -26,11 +26,14 @@
                       = commercial.commercial_type
                     .flexvideo
                       = render partial: 'shared/media_item', locals: { commercial_type: commercial.commercial_type, commercial_id: commercial.commercial_id }
-                    = link_to 'Edit', edit_conference_proposal_commercial_path(@conference.short_title, @event.id, commercial.id), class: 'btn btn-primary'
-                    = link_to 'Delete', conference_proposal_commercial_path(@conference.short_title, @event.id, commercial.id),
+                    - if can? :update, commercial
+                      = link_to 'Edit', edit_conference_proposal_commercial_path(@conference.short_title, @event.id, commercial.id), class: 'btn btn-primary'
+                    - if can? :destrooy, commercial
+                      = link_to 'Delete', conference_proposal_commercial_path(@conference.short_title, @event.id, commercial.id),
                       :method => :delete, :data => { :confirm => 'Are you sure?' }, class: 'btn btn-danger'
-          %hr
-          = link_to 'Add Commercial', new_conference_proposal_commercial_path(@conference.short_title, @event.id), class: 'btn btn-primary'
+          - if can? :create, @event.commercials.new
+            %hr
+            = link_to 'Add Commercial', new_conference_proposal_commercial_path(@conference.short_title, @event.id), class: 'btn btn-primary'
 
         #attachment-content.tab-pane
           = form_for EventAttachment.new, :url => conference_proposal_event_attachment_index_path(@conference.short_title, @event), :html => { :multipart => true, :id => "fileupload"  } do |f|
@@ -68,7 +71,7 @@
           data.formData = inputs.serializeArray();
       });
       $.getJSON($('#fileupload').prop('action'), function (files) {
-        var fu = $('#fileupload').data('fileupload'),
+        var fu = $('#fileupload').data('blueimpFileupload'),
           template;
         fu._adjustMaxNumberOfFiles(-files.length);
         template = fu._renderDownload(files)

app/views/proposal/_proposal_form.html.haml

@@ -1,20 +1,20 @@
 = semantic_form_for(@event, :url => @url) do |f|
   %section#basic
   = f.inputs :name => "Session Information" do
-    - if !@conference.call_for_papers.schedule_changes && @event.state == "confirmed" && !organizer_or_admin?
+    - if can? :update, @event or can? :create, @event
+      = f.input :title, :as => :string, :required => true
+    - else
       Title: #{@event.title}
       %br
       %br
-    - else
-      = f.input :title, :as => :string, :required => true
     = f.input :subtitle, :as => :string
   %section#details
-    - if (@event.state === "unconfirmed" || @event.state === "confirmed") && !organizer_or_admin? && !@conference.call_for_papers.schedule_changes
+    - if can? :update, @event or can? :create, @event
+      = f.input :event_type_id,:as => :select, :collection => @conference.event_types.map {|x| ["#{x.title} - #{show_time(x.length)}", x.id]}, :include_blank => false, :label => "Session Type"
+    - else
       Event type: #{@event.event_type.title}
       %br
       %br
-    - else
-      = f.input :event_type_id,:as => :select, :collection => @conference.event_types.map {|x| ["#{x.title} - #{show_time(x.length)}", x.id]}, :include_blank => false, :label => "Session Type"
     = f.input :difficulty_level, :as => :select, :collection => @conference.difficulty_levels, :include_blank => "(Please select)" if @conference.use_difficulty_levels
     = f.input :require_registration
     = f.input :abstract, :input_html => {:rows => 5, :class => "span11"},

app/views/proposal/index.html.haml

@@ -2,7 +2,7 @@
   .col-md-12.page-header
     %h1
       = "My Proposals for #{@conference.title}"
-    - if @conference.cfp_open? || organizer_or_admin?
+    - if @conference.cfp_open? || (current_user.has_role? :organizer, @conference)
       = link_to "New Proposal", new_conference_proposal_path(@conference.short_title), :class => "btn btn-success pull-right"
 - if current_user.proposal_count(@conference) > 0
   .row
@@ -27,7 +27,7 @@
                 (Pre-registered: #{pre_registered(event).count})
               - if event.confirmed? && !@conference.user_registered?(current_user)
                 %br
-                = link_to "Register to attend", register_conference_path(@conference.short_title), :style => "font-size:10px;"
+                = link_to "Register to attend", conference_register_path(@conference.short_title), :style => "font-size:10px;"
             %td
               .pull-right
                 - if event.transition_possible? :confirm

app/views/proposal/new.html.haml

@@ -1,6 +1,6 @@
 .row
   .col-md-12
-    = simple_format(@conference.call_for_papers.description)
+    = simple_format(@conference.call_for_papers.description) if @conference.call_for_papers
 .row
   .col-md-12
     = render 'proposal_form'

app/views/proposal/show.html.haml

@@ -7,7 +7,7 @@
         %small
           = @event.subtitle
       = link_to "Schedule", conference_schedule_path(@conference.short_title), :class =>"btn btn-success pull-right"
-      - if has_role?(current_user, "admin")
+      - if can? :edit, @event
         = link_to "Edit", edit_admin_conference_event_path(@conference.short_title, @event), :class => "btn btn-mini btn-primary pull-right"
 .row
   .col-md-3
@@ -37,7 +37,7 @@
           %span.label{:style =>"background-color: #{@event.difficulty_level.color};"}
             = @event.difficulty_level.title
     - if @event.require_registration
-      = link_to "Registration required!", register_conference_path(@conference.short_title), :class => "btn btn-xs btn-warning"
+      = link_to "Registration required!", conference_register_path(@conference.short_title), :class => "btn btn-xs btn-warning"
   .col-md-9
     .row
       .col-md-12