scinote-eln/scinote-web
1
1
Fork 0
mirror of https://github.com/scinote-eln/scinote-web.git synced 2025-01-25 01:04:02 +08:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #3530 from artoscinote/ma_SCI_6041

Browse source 
Update project permission helpers [SCI-6041]
This commit is contained in:
Alex Kriuchykhin 2021-09-07 12:28:00 +02:00 committed by GitHub
commit 268b8d6bf1
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
17 changed files with 74 additions and 91 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
app/controllers/access_permissions/projects_controller.rb
View file

@ -94,7 +94,7 @@ module AccessPermissions
end
def check_manage_permissions
render_403 unless can_manage_project_access?(@project)
render_403 unless can_manage_project_users?(@project)
end
def check_read_permissions

2
app/controllers/api/v1/experiments_controller.rb
View file

@ -22,7 +22,7 @@ module Api
end
def create
raise PermissionError.new(Experiment, :create) unless can_create_experiments?(@project)
raise PermissionError.new(Experiment, :create) unless can_create_project_experiments?(@project)
experiment = @project.experiments.create!(experiment_params.merge!(created_by: current_user,
last_modified_by: current_user))

2
app/controllers/comments_controller.rb
View file

@ -89,7 +89,7 @@ class CommentsController < ApplicationController
def check_create_permissions
case @commentable
when Project
render_403 and return unless can_create_comments_in_project?(@commentable)
render_403 and return unless can_create_project_comments?(@commentable)
when MyModule
render_403 and return unless can_create_comments_in_module?(@commentable)
when Step

2
app/controllers/dashboard/quick_start_controller.rb
View file

@ -70,7 +70,7 @@ module Dashboard
end
unless @experiment
render_403 unless can_create_experiments?(current_user, @project)
render_403 unless can_create_project_experiments?(current_user, @project)
return
end

2
app/controllers/experiments_controller.rb
View file

@ -314,7 +314,7 @@ class ExperimentsController < ApplicationController
end
def check_create_permissions
render_403 unless can_create_experiments?(@project)
render_403 unless can_create_project_experiments?(@project)
end
def check_manage_permissions

2
app/controllers/project_comments_controller.rb
View file

@ -51,7 +51,7 @@ class ProjectCommentsController < ApplicationController
end
def check_create_permissions
render_403 unless can_create_comments_in_project?(@project)
render_403 unless can_create_project_comments?(@project)
end
def check_manage_permissions

2
app/controllers/tags_controller.rb
View file

@ -161,7 +161,7 @@ class TagsController < ApplicationController
end
def check_manage_permissions
render_403 unless can_manage_tags?(@project)
render_403 unless can_manage_project?(@project)
end
def tag_params

2
app/helpers/comment_helper.rb
View file

@ -63,7 +63,7 @@ module CommentHelper
when 'Step', 'Result'
can_create_comments_in_module?(object.my_module)
when 'Project'
can_create_comments_in_project?(object)
can_create_project_comments?(object)
else
false
end

6
app/models/user_role.rb
View file

@ -32,8 +32,8 @@ class UserRole < ApplicationRecord
permissions:
[
ProjectPermissions::READ,
ProjectPermissions::CREATE_EXPERIMENTS,
ProjectPermissions::CREATE_COMMENTS,
ProjectPermissions::EXPERIMENTS_CREATE,
ProjectPermissions::COMMENTS_CREATE,
ExperimentPermissions::READ,
ExperimentPermissions::MANAGE,
ExperimentPermissions::ARCHIVE,
@ -57,7 +57,7 @@ class UserRole < ApplicationRecord
permissions:
[
ProjectPermissions::READ,
ProjectPermissions::CREATE_COMMENTS,
ProjectPermissions::COMMENTS_CREATE,
ExperimentPermissions::READ,
MyModulePermissions::READ,
MyModulePermissions::CREATE_COMMENTS,

103
app/permissions/project.rb
View file

@ -6,10 +6,10 @@ Canaid::Permissions.register_for(Project) do
# Project must be active for all the specified permissions
%i(manage_project
archive_project
create_experiments
create_comments_in_project
manage_tags
manage_project_access)
create_project_experiments
create_project_comments
manage_project_tags
manage_project_users)
.each do |perm|
can perm do |_, project|
project.active?
@ -23,21 +23,7 @@ Canaid::Permissions.register_for(Project) do
user.is_admin_of_team?(project.team) || project.permission_granted?(user, ProjectPermissions::READ)
end
end
# project: read, read activities, read comments, read users, read archive,
# read notifications
# reports: read
can :read_project do |_, _|
# Already checked by the wrapper
true
end
# team: export projects
can :export_project do |_, _|
# Already checked by the wrapper
true
end
# project: update/delete, assign/reassign/unassign users
can :manage_project do |user, project|
project.permission_granted?(user, ProjectPermissions::MANAGE) &&
MyModule.joins(experiment: :project)
@ -52,64 +38,55 @@ Canaid::Permissions.register_for(Project) do
end
end
# project: manage access policies
can :manage_project_access do |user, project|
project.permission_granted?(user, ProjectPermissions::MANAGE_ACCESS)
can :read_project_folders do |user, project|
project.permission_granted?(user, ProjectPermissions::FOLDERS_READ)
end
can :manage_project_users do |user, project|
project.permission_granted?(user, ProjectPermissions::USERS_MANAGE)
end
# project: archive
can :archive_project do |user, project|
project.permission_granted?(user, ProjectPermissions::ARCHIVE)
project.permission_granted?(user, ProjectPermissions::MANAGE)
end
# NOTE: Must not be dependent on canaid parmision for which we check if it's
# active
# project: restore
can :restore_project do |user, project|
project.archived? && project.permission_granted?(user, ProjectPermissions::RESTORE)
project.archived? && project.permission_granted?(user, ProjectPermissions::MANAGE)
end
# experiment: create
can :create_experiments do |user, project|
project.permission_granted?(user, ProjectPermissions::CREATE_EXPERIMENTS)
can :create_project_experiments do |user, project|
project.permission_granted?(user, ProjectPermissions::EXPERIMENTS_CREATE)
end
can :manage_experiments do |user, project|
project.permission_granted?(user, ProjectPermissions::CREATE_EXPERIMENTS)
can :read_project_experiments do |user, project|
project.permission_granted?(user, ProjectPermissions::EXPERIMENTS_READ)
end
# project: create comment
can :create_comments_in_project do |user, project|
project.permission_granted?(user, ProjectPermissions::CREATE_COMMENTS)
can :read_archived_project_experiments do |user, project|
project.permission_granted?(user, ProjectPermissions::EXPERIMENTS_READ_ARCHIVED)
end
# project: create/update/delete tag
# module: assign/reassign/unassign tag
can :manage_tags do |user, project|
project.permission_granted?(user, ProjectPermissions::MANAGE_TAGS)
end
end
Canaid::Permissions.register_for(ProjectComment) do
# Project must be active for all the specified permissions
%i(manage_comment_in_project)
.each do |perm|
can perm do |_, project_comment|
project_comment.project.active?
end
end
# project: update/delete comment
can :manage_comment_in_project do |user, project_comment|
project_comment.project.present? && (project_comment.user == user ||
project.permission_granted?(user, ProjectPermissions::MANAGE_COMMENTS))
end
end
Canaid::Permissions.register_for(ProjectFolder) do
# ProjectFolder: delete
can :delete_project_folder do |_, project_folder|
!project_folder.projects.exists? && !project_folder.project_folders.exists?
can :read_canvas_of_project_experiments do |user, project|
project.permission_granted?(user, ProjectPermissions::EXPERIMENTS_READ_CANVAS)
end
can :read_activities_of_project_experiments do |user, project|
project.permission_granted?(user, ProjectPermissions::EXPERIMENTS_ACTIVITIES_READ)
end
can :read_users_of_project_experiments do |user, project|
project.permission_granted?(user, ProjectPermissions::EXPERIMENTS_USERS_READ)
end
can :create_project_comments do |user, project|
project.permission_granted?(user, ProjectPermissions::COMMENTS_CREATE)
end
can :manage_project_comments do |user, project|
project.permission_granted?(user, ProjectPermissions::COMMENTS_MANAGE)
end
can :manage_project_tags do |user, project|
project.permission_granted?(user, ProjectPermissions::MANAGE)
end
end

2
app/views/access_permissions/projects/show.json.jbuilder
View file

@ -5,7 +5,7 @@ json.modal controller.render_to_string(
formats: [:html],
locals: {
resource: @project,
can_manage_resource: can_manage_project_access?(@project)
can_manage_resource: can_manage_project_users?(@project)
},
layout: false
)

4
app/views/project_comments/_index.html.erb
View file

@ -2,8 +2,8 @@
<hr>
<%= render partial: 'shared/comments/comments.html.erb', locals: {
object: @project,
comments: comments,
can_create_comments: can_create_comments_in_project?(@project),
comments: comments,
can_create_comments: can_create_project_comments?(@project),
create_url: project_project_comments_path(@project, format: :json),
more_url: project_project_comments_path(@project, format: :json, from: comments.first&.id)
} %>

2
app/views/projects/index/_project_actions_dropdown.html.erb
View file

@ -51,7 +51,7 @@
<!-- Project members access -->
<% if can_read_project?(project) %>
<li class="form-dropdown-item">
<%= link_to can_manage_project_access?(project) ? edit_access_permissions_project_path(project) : access_permissions_project_path(project),
<%= link_to can_manage_project_users?(project) ? edit_access_permissions_project_path(project) : access_permissions_project_path(project),
class: 'btn btn-light',
data: { action: 'remote-modal'} do %>
<i class="fas fa-door-open"></i>

2
app/views/projects/index/_project_card.html.erb
View file

@ -50,7 +50,7 @@
<div class="data-row user-cell table-cell">
<span class="card-label"><%= t('projects.index.card.users') %></span>
<div class="value">
<% if can_manage_project_access?(project) %>
<% if can_manage_project_users?(project) %>
<%= link_to edit_access_permissions_project_path(project), class: 'project-users-link', data: { action: 'remote-modal' } do %>
<%= render partial: 'projects/index/users_list.html.erb', locals: { project: project } %>
<span class="new-user global-avatar-container">

2
app/views/projects/show/_toolbar.html.erb
View file

@ -1,6 +1,6 @@
<div id="projectShowToolbar" class="project-show-toolbar">
<!-- new experiment button -->
<% if can_create_experiments?(@project) %>
<% if can_create_project_experiments?(@project) %>
<%= button_to new_project_experiment_url(@project),
remote: true,
form_class: 'new-experiment-form',

22
config/initializers/extends/permission_extends.rb
View file

@ -4,15 +4,21 @@ module PermissionExtends
module ProjectPermissions
%w(
READ
EXPORT
READ_ARCHIVED
MANAGE
ARCHIVE
RESTORE
CREATE_EXPERIMENTS
CREATE_COMMENTS
MANAGE_COMMENTS
MANAGE_TAGS
MANAGE_ACCESS
FOLDERS_READ
ACTIVITIES_READ
USERS_READ
USERS_MANAGE
COMMENTS_READ
COMMENTS_CREATE
COMMENTS_MANAGE
EXPERIMENTS_READ
EXPERIMENTS_READ_ARCHIVED
EXPERIMENTS_CREATE
EXPERIMENTS_READ_CANVAS
EXPERIMENTS_ACTIVITIES_READ
EXPERIMENTS_USERS_READ
).each { |permission| const_set(permission, "project_#{permission.underscore}") }
end

6
spec/factories/user_roles.rb
View file

@ -13,8 +13,8 @@ FactoryBot.define do
permissions {
[
ProjectPermissions::READ,
ProjectPermissions::CREATE_EXPERIMENTS,
ProjectPermissions::CREATE_COMMENTS,
ProjectPermissions::EXPERIMENTS_CREATE,
ProjectPermissions::COMMENTS_CREATE,
ExperimentPermissions::READ,
ExperimentPermissions::MANAGE,
ExperimentPermissions::ARCHIVE,
@ -37,7 +37,7 @@ FactoryBot.define do
permissions {
[
ProjectPermissions::READ,
ProjectPermissions::CREATE_COMMENTS,
ProjectPermissions::COMMENTS_CREATE,
ExperimentPermissions::READ,
MyModulePermissions::READ,
MyModulePermissions::CREATE_COMMENTS,