Implement role authorization

spec/models/ability_spec.rb

@@ -1,39 +1,163 @@
 require 'spec_helper'
-require "cancan/matchers"
+require 'cancan/matchers'
 
-describe "User" do
-  describe "abilities" do
+describe 'User' do
+  describe 'Abilities' do
     subject(:ability){ Ability.new(user) }
+    let!(:first_user) { create(:user) } # automatically becomes admin
     let(:user){ nil }
+    let(:conference_not_public) { create(:conference, make_conference_public: false) }
+    let(:conference_public) { create(:conference, make_conference_public: true)}
+    let(:event_confirmed) { create(:event, state: 'confirmed') }
+    let(:someevent) { create(:event) }
 
-    context "when is an admin" do
-      let!(:user) { create(:admin) }
+    context 'when user is a guest' do  # Test abilities for guest users
 
-      it{ should be_able_to(:manage, Event.new) }
+      it{ should be_able_to(:show, conference_public)}
+      it{ should_not be_able_to(:show, conference_not_public)}
+
+      it{ should be_able_to(:show, event_confirmed)}
+      it{ should_not be_able_to(:show, someevent)}
+
+      it{ should be_able_to(:index, :schedule)}
+
+      it{ should_not be_able_to(:create, Event)}
+      it{ should_not be_able_to(:manage, Event)}
+      it{ should_not be_able_to(:manage, Conference)}
+      it{ should_not be_able_to(:manage, :any)}
     end
 
-    context "when is an participant" do
-      let(:user) { build(:participant) }
+    context 'when user is a Signed In User' do # Test abilities for signed in users (without any role)
+      let(:user) { create(:participant) }
+      let(:registration1) { create(:registration, conference: conference_public, user: user) }
+      let(:registration2) { create(:registration, conference: conference_not_public, user: user) }
 
+      it{ should be_able_to(:create, Event) }
+      it{ should be_able_to(:index, Event) }
       it{ should_not be_able_to(:manage, Event.new) }
-      it{ should be_able_to(:create, Event.new) }
-      it{ should be_able_to(:read, Event.new) }
+      it{ should be_able_to(:show, event_confirmed) }
+
+      it{ should be_able_to(:manage, registration1) }
+      it{ should be_able_to(:manage, registration2) }
+
+      it{ should be_able_to(:show, conference_public)}
+      it{ should_not be_able_to(:show, conference_not_public)}
+      it{ should_not be_able_to(:manage, Conference) }
     end
 
-    context "when is an event owner" do
+    context 'user #is_admin?' do
+      let(:user) { create(:admin) }
+      it{ should be_able_to(:manage, User) }
+      it{ should be_able_to(:create, Conference) }
+    end
+
+    context 'signed in users can manage their events' do
       let(:user) { create(:participant) }
       let(:user2) { create(:participant) }
       let(:myevent) { create(:event, users: [user]) }
       let(:someevent) { create(:event, users: [user2]) }
+      let(:commercial_myevent) { create(:commercial, commercialable: myevent) }
+      let(:commercial_someevent) { create(:commercial, commercialable: someevent) }
 
       # Users are able to update and destroy their own events
       it{ should be_able_to(:update, myevent) }
       it{ should be_able_to(:destroy, myevent) }
+      it{ should be_able_to(:manage, myevent) }
+      it{ should be_able_to(:create, myevent.commercials.new) }
+      it{ should be_able_to(:manage, commercial_myevent) }
 
       # Users are not able to update and destroy other users events
       it{ should_not be_able_to(:update, someevent) }
       it{ should_not be_able_to(:destroy, someevent) }
+      it{ should_not be_able_to(:manage, someevent) }
+      it{ should_not be_able_to(:manage, commercial_someevent) }
     end
 
+    context 'when user is an organizer' do
+      let!(:conference1) { create(:conference) }
+      let!(:conference2) { create(:conference) }
+      let(:role) { create(:organizer_role, resource: conference1) }
+      let(:user) { create(:user, role_ids: [role.id]) }
+      let(:someuser) { create(:user) }
+      let(:registration1) { create(:registration, user: someuser, conference_id: conference1.id) }
+
+      it{ should be_able_to(:manage, conference1) }
+      it{ should_not be_able_to(:manage, conference2) }
+      it{ should be_able_to(:manage, registration1) }
+      it{ should be_able_to(:create, Registration) }
+    end
+
+    context 'when user is part of cfp' do
+      let!(:conference1) { create(:conference) }
+      let!(:conference2) { create(:conference) }
+      let(:role) { create(:role, name: 'cfp', resource: conference1) }
+      let(:user) { create(:user, role_ids: role.id) }
+      let(:event) { create(:event, conference_id: conference1.id) }
+      let(:someevent) { create(:event, conference_id: conference2.id) }
+      let(:cfp) { create(:call_for_papers, conference: conference1) }
+
+      it{ should_not be_able_to(:manage, conference1) }
+      it{ should_not be_able_to(:manage, conference2) }
+      it{ should be_able_to(:index, conference1) }
+      it{ should be_able_to(:show, conference1) }
+
+      it{ should be_able_to(:manage, event) }
+      it{ should_not be_able_to(:manage, someevent) }
+
+      it{ should be_able_to(:manage, cfp) }
+      it{ should be_able_to(:manage, create(:event_type, conference: conference1)) }
+    end
+
+    context 'when user has multiple roles' do
+      let!(:conference1) { create(:conference) } # user is organizer
+      let!(:conference2) { create(:conference) } # user is cfp
+      let!(:conference3) { create(:conference) } # user is info_desk
+      let!(:conference4) { create(:conference) } # user is volunteer coordinator
+      let!(:conference5) { create(:conference, make_conference_public: true) } # user has no role
+      let!(:conference6) { create(:conference, make_conference_public: false) } # user has no role
+      let(:role_organizer) { create(:role, name: 'organizer', resource: conference1) }
+      let(:role_cfp) { create(:role, name: 'cfp', resource: conference2) }
+      let(:role_info_desk) { create(:role, name: 'info_desk', resource: conference3) }
+      let(:role_volunteer_coordinator) { create(:role, name: 'volunteer_coordinator', resource: conference4) }
+      let(:user) { create(:user, role_ids: [role_cfp.id, role_organizer.id, role_cfp.id, role_info_desk.id, role_volunteer_coordinator.id]) }
+      let(:admin) { create(:admin) }
+
+      it{ should be_able_to(:manage, conference1) }
+      it{ should_not be_able_to(:update, conference2) }
+      it{ should_not be_able_to(:update, conference3) }
+      it{ should_not be_able_to(:update, conference4) }
+      it{ should_not be_able_to(:update, conference5) }
+
+      it{ should be_able_to(:show, conference1) }
+      it{ should be_able_to(:show, conference2) }
+      it{ should be_able_to(:show, conference3) }
+      it{ should be_able_to(:show, conference4) }
+      it{ should be_able_to(:show, conference5) }
+      it{ should be_able_to(:show, conference6) }
+
+      it{ should be_able_to(:manage, conference1.venue) }
+      it{ should_not be_able_to(:manage, conference2.venue) }
+      it{ should_not be_able_to(:manage, conference3.venue) }
+      it{ should_not be_able_to(:manage, conference4.venue) }
+      it{ should_not be_able_to(:manage, conference5.venue) }
+
+      it{ should be_able_to(:manage, conference1.registrations.new) }
+      it{ should_not be_able_to(:manage, conference2.registrations.new) }
+      it{ should be_able_to(:manage, conference3.registrations.new) }
+      it{ should_not be_able_to(:manage, conference4.registrations.new) }
+      it{ should_not be_able_to(:manage, conference5.registrations.new) }
+
+      it{ should be_able_to(:manage, conference1.events.new) }
+      it{ should be_able_to(:manage, conference2.events.new) }
+      it{ should_not be_able_to(:manage, conference3.events.new) }
+      it{ should_not be_able_to(:manage, conference4.events.new) }
+      it{ should_not be_able_to(:manage, conference5.events.new) }
+
+      it{ should be_able_to(:manage, Question.new(conference_id: conference1.id)) }
+      it{ should_not be_able_to(:manage, Question.new(conference_id: conference2.id)) }
+      it{ should be_able_to(:manage, Question.new(conference_id: conference3.id)) }
+      it{ should_not be_able_to(:manage, Question.new(conference_id: conference4.id)) }
+      it{ should_not be_able_to(:manage, Question.new(conference_id: conference5.id)) }
+    end
   end
 end

spec/models/conference_spec.rb

@@ -274,9 +274,8 @@ describe Conference do
 
   describe '#get_top_submitter' do
     # It is necessary to use bang version of let to build roles before user
-    let!(:organizer_role) { create(:organizer_role) }
     let!(:participant_role) { create(:participant_role) }
-    let!(:admin_role) { create(:admin_role) }
+    let!(:organizer_conference_1_role) { create(:organizer_conference_1_role) }
 
     it 'calculates correct hash with top submitters' do
       event = create(:event, conference: subject)
@@ -307,7 +306,7 @@ describe Conference do
       target = build(:target, target_count: 10, unit: Target.units[:registrations])
       subject.targets = [target]
       result = {
-          "10 Registrations by #{target.due_date}" => '0'
+        "10 Registrations by #{target.due_date}" => '0'
       }
       expect(subject.get_targets(Target.units[:registrations])).to eq(result)
     end
@@ -317,7 +316,7 @@ describe Conference do
       subject.targets = [target]
       subject.registrations = [create(:registration)]
       result = {
-          "10 Registrations by #{target.due_date}" => '10'
+        "10 Registrations by #{target.due_date}" => '10'
       }
       expect(subject.get_targets(Target.units[:registrations])).to eq(result)
     end
@@ -330,7 +329,7 @@ describe Conference do
       target = build(:target, target_count: 10, unit: Target.units[:submissions])
       subject.targets = [target]
       result = {
-          "10 Submissions by #{target.due_date}" => '0'
+        "10 Submissions by #{target.due_date}" => '0'
       }
       expect(subject.get_targets(Target.units[:submissions])).to eq(result)
     end
@@ -340,7 +339,7 @@ describe Conference do
       subject.targets = [target]
       subject.events = [create(:event)]
       result = {
-          "10 Submissions by #{target.due_date}" => '10'
+        "10 Submissions by #{target.due_date}" => '10'
       }
       expect(subject.get_targets(Target.units[:submissions])).to eq(result)
     end
@@ -349,7 +348,7 @@ describe Conference do
       target = build(:target, target_count: 300, unit: Target.units[:program_minutes])
       subject.targets = [target]
       result = {
-          "300 Program minutes by #{target.due_date}" => '0'
+        "300 Program minutes by #{target.due_date}" => '0'
       }
       expect(subject.get_targets(Target.units[:program_minutes])).to eq(result)
     end
@@ -359,7 +358,7 @@ describe Conference do
       subject.targets = [target]
       subject.events = [create(:event)]
       result = {
-          "300 Program minutes by #{target.due_date}" => '10'
+        "300 Program minutes by #{target.due_date}" => '10'
       }
       expect(subject.get_targets(Target.units[:program_minutes])).to eq(result)
     end
@@ -897,9 +896,8 @@ describe Conference do
 
   describe 'self#event_distribution' do
     # It is necessary to use bang version of let to build roles before user
-    let!(:organizer_role) { create(:organizer_role) }
     let!(:participant_role) { create(:participant_role) }
-    let!(:admin_role) { create(:admin_role) }
+    let!(:organizer_conference_1_role) { create(:organizer_conference_1_role) }
 
     it 'self#event_distribution calculates correct values with user' do
       create(:user, last_sign_in_at: Date.today - 3.months) # active
@@ -1426,9 +1424,8 @@ describe Conference do
   describe '#user_registered?' do
 
     # It is necessary to use bang version of let to build roles before user
-    let!(:organizer_role) { create(:organizer_role) }
     let!(:participant_role) { create(:participant_role) }
-    let!(:admin_role) { create(:admin_role) }
+    let!(:organizer_conference_1_role) { create(:organizer_conference_1_role) }
 
     let(:user) { create(:user) }
 

spec/models/user_spec.rb

@@ -3,66 +3,55 @@ require 'spec_helper'
 describe User do
 
   # It is necessary to use bang version of let to build roles before user
-  let!(:organizer_role) { create(:organizer_role) }
-  let!(:participant_role) { create(:participant_role) }
-  let!(:admin_role) { create(:admin_role) }
-  let!(:admin) { create(:user) }
+  let!(:admin) { create(:admin) }
+  let!(:participant) { create(:participant) }
+  let!(:organizer_conference_1) { create(:organizer_conference_1 ) }
+  let!(:organizer_conference_1_role) { Role.where(resource_type: 'Conference', resource_id: 1).first }
 
   it 'returns the correct role' do
-    participant = create(:user, email: 'participant@example.de')
-    expect(admin.roles.first).to eq(admin_role)
-    expect(participant.roles.first).to eq(participant_role)
+    expect(organizer_conference_1.roles.first).to eq(organizer_conference_1_role)
   end
 
   it 'returns the correct roles' do
-    roles = [organizer_role.id, participant_role.id, admin_role.id]
+    participant_role = create(:participant_role)
+    roles = [participant_role.id, organizer_conference_1_role.id]
     user_with_all_roles = create(:user, email: 'participant@example.de')
     user_with_all_roles.role_ids = roles
     user_with_all_roles.save
 
-    expect(user_with_all_roles.roles.length).to eq(3)
+    expect(user_with_all_roles.roles.length).to eq(2)
     expect(user_with_all_roles.roles[0]).to eq(participant_role)
-    expect(user_with_all_roles.roles[1]).to eq(organizer_role)
-    expect(user_with_all_roles.roles[2]).to eq(admin_role)
+    expect(user_with_all_roles.roles[1]).to eq(organizer_conference_1_role )
   end
 
-  describe '#role?' do
+  describe '#has_role?' do
     shared_examples '#role?' do |user, role, expected|
       it "returns #{expected} for #{role}" do
         user_obj = create(user, email: 'e@example.com')
-        expect(user_obj.role?(role)).to be expected
-        expect(user_obj.role?(role.downcase)).to be expected
-        expect(user_obj.role?(role.upcase)).to be expected
-        expect(user_obj.role?(role.downcase.capitalize)).to be expected
-      end
-    end
-
-    context 'admin' do
-      it_behaves_like '#role?', :admin, 'orgAnizer', false
-      it_behaves_like '#role?', :admin, 'adMin', true
-      it_behaves_like '#role?', :admin, 'partiCipant', false
-
-      it 'assigns first user admin role' do
-        expect(admin.role?('Admin')).to be true
-        expect(admin.role_ids).to match_array([admin_role.id])
-      end
-    end
-
-    context 'participant' do
-      it_behaves_like '#role?', :participant, 'orgAnizer', false
-      it_behaves_like '#role?', :participant, 'adMin', false
-      it_behaves_like '#role?', :participant, 'partiCipant', true
-
-      it 'assigns second user participant role' do
-        participant = create(:user, email: 'participant@example.de')
-        expect(participant.role_ids).to match_array([participant_role.id])
+        expect(user_obj.has_role?(role.downcase, :any)).to be expected
       end
     end
 
     context 'organizer' do
-      it_behaves_like '#role?', :organizer, 'orgAnizer', true
-      it_behaves_like '#role?', :organizer, 'adMin', false
-      it_behaves_like '#role?', :organizer, 'partiCipant', false
+      it_behaves_like '#role?', :organizer_conference_1, 'organizer', true
+      it_behaves_like '#role?', :organizer_conference_1, 'participant', false
+    end
+
+    context 'admin' do
+      it 'assigns first user admin role' do
+        expect(User.first.is_admin).to be true
+        expect(admin.is_admin).to eq(true)
+      end
+    end
+
+    context 'participant' do
+      it_behaves_like '#role?', :participant, 'adMin', false
+      it_behaves_like '#role?', :participant, 'participant', true
+
+#       it 'assigns second user participant role' do
+#         participant = create(:user, email: 'participant@example.de')
+#         expect(participant.role_ids).to match_array([participant_role.id])
+#       end
     end
   end
 end