Commit b9989e68 authored by hellekin's avatar hellekin

Fix Map and Role policies

- Add policy scope to Maps controller
- Alias current_agent.current_agent_is_incommon? to
  current_agent.is_incommon?
- Fix RolePolicy:
  - Rename RolesPolicy to RolePolicy
  - Inherit from ApplicationScope
  - Set scope resolution to:
    - allow managing all roles to IN COMMON Agent leader
    - allow managing Agent roles to Agent leader
    - allow viewing self roles
parent 3d7d187f
...@@ -2,7 +2,7 @@ ...@@ -2,7 +2,7 @@
class Api::V0::MapsController < ApplicationController class Api::V0::MapsController < ApplicationController
def index def index
@maps = Map.includes(:collection).all @maps = policy_scope(Map).includes(:collection).all
render jsonapi: @maps, render jsonapi: @maps,
include: include_from_params include: include_from_params
end end
......
...@@ -44,6 +44,7 @@ module INCOMMON ...@@ -44,6 +44,7 @@ module INCOMMON
def current_agent_is_incommon? def current_agent_is_incommon?
id == Agent::INCOMMON_AGENT_ID id == Agent::INCOMMON_AGENT_ID
end end
alias is_incommon? current_agent_is_incommon?
# Only provide access to Agent users to the leaders, whose role is to manage # Only provide access to Agent users to the leaders, whose role is to manage
# them. Other Agent roles will see an empty array. # them. Other Agent roles will see an empty array.
......
# frozen_string_literal: true # frozen_string_literal: true
class RolesPolicy class RolePolicy < ApplicationPolicy
attr_reader :user, :record
def initialize(user, record)
@user = user
@record = record
end
def index? def index?
current_agent.leader? user&.leader?
end end
def show? def show?
current_agent.leader? || @record.user == current_user user&.leader? || @record.user == user&.user
end end
def create? def create?
false false
end end
def new?
create?
end
def update? def update?
false false
end end
def edit?
update?
end
def destroy? def destroy?
false false
end end
class Scope class Scope < Scope
attr_reader :user, :scope
def initialize(user, scope)
@user = user
@scope = scope
end
def resolve def resolve
scope.all if user&.leader? == true
if user&.is_incommon? == true
scope.all
else
scope.where(agent_id: user.uuid)
end
else
scope.where(user_id: user.user.uuid)
end
end end
end end
end end
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment