diff --git a/app/controllers/repositories_controller.rb b/app/controllers/repositories_controller.rb index 4d7895c0c..2f562a5ca 100644 --- a/app/controllers/repositories_controller.rb +++ b/app/controllers/repositories_controller.rb @@ -21,7 +21,6 @@ class RepositoriesController < ApplicationController before_action :check_manage_permissions, only: %i(rename_modal update) before_action :check_delete_permissions, only: %i(destroy destroy_modal) before_action :check_archive_permissions, only: %i(archive restore) - before_action :check_share_permissions, only: :share_modal before_action :check_create_permissions, only: %i(create_modal create) before_action :check_copy_permissions, only: %i(copy_modal copy) before_action :set_inline_name_editing, only: %i(show) @@ -111,15 +110,6 @@ class RepositoriesController < ApplicationController } end - def share_modal - render json: { html: render_to_string(partial: 'share_repository_modal', formats: :html) } - end - - def shareable_teams - teams = current_user.teams.order(:name) - [@repository.team] - render json: teams, each_serializer: ShareableTeamSerializer, repository: @repository - end - def hide_reminders # synchronously hide currently visible reminders if params[:visible_reminder_repository_row_ids].present? @@ -532,10 +522,6 @@ class RepositoriesController < ApplicationController render_403 unless can_delete_repository?(@repository) end - def check_share_permissions - render_403 unless can_share_repository?(@repository) - end - def repository_params params.require(:repository).permit(:name) end diff --git a/app/controllers/storage_location_repository_rows_controller.rb b/app/controllers/storage_location_repository_rows_controller.rb index ae9ed52fb..2907cd896 100644 --- a/app/controllers/storage_location_repository_rows_controller.rb +++ b/app/controllers/storage_location_repository_rows_controller.rb @@ -93,7 +93,7 @@ class StorageLocationRepositoryRowsController < ApplicationController end def load_storage_location - @storage_location = StorageLocation.where(team: current_team).find( + @storage_location = StorageLocation.viewable_by_user(current_user).find( storage_location_repository_row_params[:storage_location_id] ) render_404 unless @storage_location @@ -110,12 +110,10 @@ class StorageLocationRepositoryRowsController < ApplicationController end def check_read_permissions - render_403 unless can_read_storage_location_containers?(current_team) + render_403 unless can_read_storage_location?(@storage_location) end def check_manage_permissions - unless can_manage_storage_location_containers?(current_team) && can_read_repository?(@repository_row.repository) - render_403 - end + render_403 unless can_manage_storage_location?(@storage_location) end end diff --git a/app/controllers/storage_locations_controller.rb b/app/controllers/storage_locations_controller.rb index 49c0375a1..91e0bcd0b 100644 --- a/app/controllers/storage_locations_controller.rb +++ b/app/controllers/storage_locations_controller.rb @@ -12,7 +12,7 @@ class StorageLocationsController < ApplicationController respond_to do |format| format.html format.json do - storage_locations = Lists::StorageLocationsService.new(current_team, params).call + storage_locations = Lists::StorageLocationsService.new(current_user, current_team, params).call render json: storage_locations, each_serializer: Lists::StorageLocationSerializer, user: current_user, meta: pagination_dict(storage_locations) end @@ -35,9 +35,11 @@ class StorageLocationsController < ApplicationController def create @storage_location = StorageLocation.new( - storage_location_params.merge({ team: current_team, created_by: current_user }) + storage_location_params.merge({ created_by: current_user }) ) + @storage_location.team = @storage_location.root_storage_location.team + @storage_location.image.attach(params[:signed_blob_id]) if params[:signed_blob_id] if @storage_location.save @@ -101,7 +103,7 @@ class StorageLocationsController < ApplicationController actions: Toolbars::StorageLocationsService.new( current_user, - storage_location_ids: JSON.parse(params[:items]).map { |i| i['id'] } + storage_location_ids: JSON.parse(params[:items]).pluck('id') ).actions } end @@ -114,7 +116,7 @@ class StorageLocationsController < ApplicationController def storage_location_params params.permit(:id, :parent_id, :name, :container, :description, - metadata: [:display_type, dimensions: [], parent_coordinations: []]) + metadata: [:display_type, { dimensions: [], parent_coordinations: [] }]) end def move_params @@ -122,16 +124,12 @@ class StorageLocationsController < ApplicationController end def load_storage_location - @storage_location = current_team.storage_locations.find_by(id: storage_location_params[:id]) + @storage_location = StorageLocation.viewable_by_user(current_user).find_by(id: storage_location_params[:id]) render_404 unless @storage_location end def check_read_permissions - if @storage_location.container - render_403 unless can_read_storage_location_containers?(current_team) - else - render_403 unless can_read_storage_locations?(current_team) - end + render_403 unless can_read_storage_location?(@storage_location) end def check_create_permissions @@ -143,11 +141,7 @@ class StorageLocationsController < ApplicationController end def check_manage_permissions - if @storage_location.container - render_403 unless can_manage_storage_location_containers?(current_team) - else - render_403 unless can_manage_storage_locations?(current_team) - end + render_403 unless can_manage_storage_location?(@storage_location) end def set_breadcrumbs_items diff --git a/app/controllers/team_shared_objects_controller.rb b/app/controllers/team_shared_objects_controller.rb new file mode 100644 index 000000000..5ef3e50fa --- /dev/null +++ b/app/controllers/team_shared_objects_controller.rb @@ -0,0 +1,77 @@ +# frozen_string_literal: true + +class TeamSharedObjectsController < ApplicationController + before_action :load_vars + before_action :check_sharing_permissions + + def update + ActiveRecord::Base.transaction do + # Global share + if params[:select_all_teams] + @model.update!(permission_level: params[:select_all_write_permission] ? :shared_write : :shared_read) + @model.team_shared_objects.each(&:destroy!) + next + end + + # Share to specific teams + params[:team_share_params].each do |t| + @model.update!(permission_level: :not_shared) if @model.globally_shareable? + @model.team_shared_objects.find_or_initialize_by(team_id: t['id']).update!( + permission_level: t['private_shared_with_write'] ? :shared_write : :shared_read + ) + end + + # Unshare + @model.team_shared_objects.where.not( + team_id: params[:team_share_params].filter { |t| t['private_shared_with'] }.pluck('id') + ).each(&:destroy!) + end + end + + def shareable_teams + teams = current_user.teams.order(:name) - [@model.team] + render json: teams, each_serializer: ShareableTeamSerializer, model: @model + end + + private + + def load_vars + case params[:object_type] + when 'Repository' + @model = Repository.viewable_by_user(current_user).find_by(id: params[:object_id]) + when 'StorageLocation' + @model = StorageLocation.viewable_by_user(current_user).find_by(id: params[:object_id]) + end + + render_404 unless @model + end + + def create_params + params.permit(:team_id, :object_type, :object_id, :target_team_id, :permission_level) + end + + def destroy_params + params.permit(:team_id, :id) + end + + def update_params + params.permit(permission_changes: {}, share_team_ids: [], write_permissions: []) + end + + def check_sharing_permissions + object_name = @model.is_a?(RepositoryBase) ? 'repository' : @model.model_name.param_key + render_403 unless public_send("can_share_#{object_name}?", @model) + render_403 if !@model.shareable_write? && update_params[:write_permissions].present? + end + + def share_all_params + { + shared_with_all: params[:select_all_teams].present?, + shared_permissions_level: params[:select_all_write_permission].present? ? 'shared_write' : 'shared_read' + } + end + + def log_activity(type_of, team_shared_object) + # log activity logic + end +end diff --git a/app/javascript/vue/repositories/table.vue b/app/javascript/vue/repositories/table.vue index ade32b122..50e8f52d4 100644 --- a/app/javascript/vue/repositories/table.vue +++ b/app/javascript/vue/repositories/table.vue @@ -50,9 +50,10 @@ :repository="duplicateRepository" @close="duplicateRepository = null" @duplicate="updateTable" /> - @@ -66,7 +67,7 @@ import ExportRepositoryModal from './modals/export.vue'; import NewRepositoryModal from './modals/new.vue'; import EditRepositoryModal from './modals/edit.vue'; import DuplicateRepositoryModal from './modals/duplicate.vue'; -import ShareRepositoryModal from './modals/share.vue'; +import ShareObjectModal from '../shared/share_modal.vue'; import DataTable from '../shared/datatable/table.vue'; export default { @@ -78,7 +79,7 @@ export default { NewRepositoryModal, EditRepositoryModal, DuplicateRepositoryModal, - ShareRepositoryModal + ShareObjectModal }, props: { dataSource: { diff --git a/app/javascript/vue/repository_item_sidebar/locations.vue b/app/javascript/vue/repository_item_sidebar/locations.vue index 5e2a80635..7b3898797 100644 --- a/app/javascript/vue/repository_item_sidebar/locations.vue +++ b/app/javascript/vue/repository_item_sidebar/locations.vue @@ -12,7 +12,8 @@
{{ i18n.t('repositories.locations.container') }}: - {{ location.name }} + {{ location.name }} + {{ location.name }} ({{ location.positions.length }}) diff --git a/app/javascript/vue/repositories/modals/share.vue b/app/javascript/vue/shared/share_modal.vue similarity index 67% rename from app/javascript/vue/repositories/modals/share.vue rename to app/javascript/vue/shared/share_modal.vue index 457c49d77..802bcd207 100644 --- a/app/javascript/vue/repositories/modals/share.vue +++ b/app/javascript/vue/shared/share_modal.vue @@ -7,29 +7,29 @@