fix(auth): allow event commercial management

Non-admin proposal flow uses Ability, not AdminAbility, so organizers and CFP users could edit proposals but could not create event commercials.

Closes #3143.

Signed-off-by: Mridankan Mandal <xerontitan90@gmail.com>

app/models/ability.rb

@@ -152,6 +152,8 @@ class Ability
       can :manage, Registration, conference_id: conf_ids_for_organizer
       # To access conference/proposals
       can :manage, Event, program: { conference_id: conf_ids_for_organizer }
+      can :manage, Commercial, commercialable_type: 'Event',
+                               commercialable_id:   Event.where(program_id: Program.where(conference_id: conf_ids_for_organizer).pluck(:id)).pluck(:id)
       # To access comment link in menu bar
       can :index, Comment, commentable_type: 'Event',
                            commentable_id:   Event.where(program_id: Program.where(conference_id: conf_ids_for_organizer).pluck(:id)).pluck(:id)
@@ -163,6 +165,8 @@ class Ability
                            commentable_id:   Event.where(program_id: Program.where(conference_id: conf_ids_for_cfp).pluck(:id)).pluck(:id)
       # To access conference/proposals
       can :manage, Event, program: { conference_id: conf_ids_for_cfp }
+      can :manage, Commercial, commercialable_type: 'Event',
+                               commercialable_id:   Event.where(program_id: Program.where(conference_id: conf_ids_for_cfp).pluck(:id)).pluck(:id)
     end
 
     if conf_ids_for_info_desk

spec/ability/ability_spec.rb

@@ -264,5 +264,31 @@ describe 'User' do
       it{ should_not be_able_to(:edit, other_self_organized_track) }
       it{ should_not be_able_to(:update, other_self_organized_track) }
     end
+
+    context 'when user is organizer of conference' do
+      let(:conference) { create(:conference) }
+      let(:user) { create(:organizer, resource: conference) }
+      let(:event_in_conference) { create(:event, program: conference.program) }
+      let(:event_in_other_conference) { create(:event) }
+      let(:commercial_in_conference) { create(:commercial, commercialable: event_in_conference) }
+      let(:commercial_in_other_conference) { create(:commercial, commercialable: event_in_other_conference) }
+
+      it{ should be_able_to(:create, event_in_conference.commercials.new) }
+      it{ should be_able_to(:manage, commercial_in_conference) }
+      it{ should_not be_able_to(:manage, commercial_in_other_conference) }
+    end
+
+    context 'when user is on cfp team of conference' do
+      let(:conference) { create(:conference) }
+      let(:user) { create(:cfp_user, resource: conference) }
+      let(:event_in_conference) { create(:event, program: conference.program) }
+      let(:event_in_other_conference) { create(:event) }
+      let(:commercial_in_conference) { create(:commercial, commercialable: event_in_conference) }
+      let(:commercial_in_other_conference) { create(:commercial, commercialable: event_in_other_conference) }
+
+      it{ should be_able_to(:create, event_in_conference.commercials.new) }
+      it{ should be_able_to(:manage, commercial_in_conference) }
+      it{ should_not be_able_to(:manage, commercial_in_other_conference) }
+    end
   end
 end

spec/controllers/commercials_controller_spec.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe CommercialsController do
+  let(:conference) { create(:conference) }
+  let(:event) { create(:event, program: conference.program) }
+  let(:commercial_params) do
+    {
+      conference_id: conference.short_title,
+      proposal_id:   event.id,
+      commercial:    { url: 'https://www.youtube.com/watch?v=M9bq_alk-sw' }
+    }
+  end
+
+  describe 'POST #create' do
+    context 'when user is organizer of conference' do
+      let(:user) { create(:organizer, resource: conference) }
+
+      before do
+        sign_in user
+      end
+
+      it 'creates a commercial for the event' do
+        expect do
+          post :create, params: commercial_params
+        end.to change(Commercial, :count).by(1)
+      end
+
+      it 'redirects to proposal edit page' do
+        post :create, params: commercial_params
+
+        expect(response).to redirect_to(edit_conference_program_proposal_path(conference.short_title, event.id, anchor: 'commercials-content'))
+        expect(flash[:notice]).to eq('Commercial was successfully created.')
+      end
+    end
+
+    context 'when user is on cfp team of conference' do
+      let(:user) { create(:cfp_user, resource: conference) }
+
+      before do
+        sign_in user
+      end
+
+      it 'creates a commercial for the event' do
+        expect do
+          post :create, params: commercial_params
+        end.to change(Commercial, :count).by(1)
+      end
+
+      it 'redirects to proposal edit page' do
+        post :create, params: commercial_params
+
+        expect(response).to redirect_to(edit_conference_program_proposal_path(conference.short_title, event.id, anchor: 'commercials-content'))
+        expect(flash[:notice]).to eq('Commercial was successfully created.')
+      end
+    end
+  end
+end