Commit b9989e68 authored by hellekin's avatar hellekin

Fix Map and Role policies

- Add policy scope to Maps controller
- Alias current_agent.current_agent_is_incommon? to
  current_agent.is_incommon?
- Fix RolePolicy:
  - Rename RolesPolicy to RolePolicy
  - Inherit from ApplicationScope
  - Set scope resolution to:
    - allow managing all roles to IN COMMON Agent leader
    - allow managing Agent roles to Agent leader
    - allow viewing self roles
parent 3d7d187f
......@@ -2,7 +2,7 @@
class Api::V0::MapsController < ApplicationController
def index
@maps = Map.includes(:collection).all
@maps = policy_scope(Map).includes(:collection).all
render jsonapi: @maps,
include: include_from_params
end
......
......@@ -44,6 +44,7 @@ module INCOMMON
def current_agent_is_incommon?
id == Agent::INCOMMON_AGENT_ID
end
alias is_incommon? current_agent_is_incommon?
# Only provide access to Agent users to the leaders, whose role is to manage
# them. Other Agent roles will see an empty array.
......
# frozen_string_literal: true
class RolesPolicy
attr_reader :user, :record
def initialize(user, record)
@user = user
@record = record
end
class RolePolicy < ApplicationPolicy
def index?
current_agent.leader?
user&.leader?
end
def show?
current_agent.leader? || @record.user == current_user
user&.leader? || @record.user == user&.user
end
def create?
false
end
def new?
create?
end
def update?
false
end
def edit?
update?
end
def destroy?
false
end
class Scope
attr_reader :user, :scope
def initialize(user, scope)
@user = user
@scope = scope
end
class Scope < Scope
def resolve
scope.all
if user&.leader? == true
if user&.is_incommon? == true
scope.all
else
scope.where(agent_id: user.uuid)
end
else
scope.where(user_id: user.user.uuid)
end
end
end
end
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment