diff --git a/app/controllers/repositories_controller.rb b/app/controllers/repositories_controller.rb
index 4d7895c0c..2f562a5ca 100644
--- a/app/controllers/repositories_controller.rb
+++ b/app/controllers/repositories_controller.rb
@@ -21,7 +21,6 @@ class RepositoriesController < ApplicationController
before_action :check_manage_permissions, only: %i(rename_modal update)
before_action :check_delete_permissions, only: %i(destroy destroy_modal)
before_action :check_archive_permissions, only: %i(archive restore)
- before_action :check_share_permissions, only: :share_modal
before_action :check_create_permissions, only: %i(create_modal create)
before_action :check_copy_permissions, only: %i(copy_modal copy)
before_action :set_inline_name_editing, only: %i(show)
@@ -111,15 +110,6 @@ class RepositoriesController < ApplicationController
}
end
- def share_modal
- render json: { html: render_to_string(partial: 'share_repository_modal', formats: :html) }
- end
-
- def shareable_teams
- teams = current_user.teams.order(:name) - [@repository.team]
- render json: teams, each_serializer: ShareableTeamSerializer, repository: @repository
- end
-
def hide_reminders
# synchronously hide currently visible reminders
if params[:visible_reminder_repository_row_ids].present?
@@ -532,10 +522,6 @@ class RepositoriesController < ApplicationController
render_403 unless can_delete_repository?(@repository)
end
- def check_share_permissions
- render_403 unless can_share_repository?(@repository)
- end
-
def repository_params
params.require(:repository).permit(:name)
end
diff --git a/app/controllers/storage_location_repository_rows_controller.rb b/app/controllers/storage_location_repository_rows_controller.rb
index ae9ed52fb..2907cd896 100644
--- a/app/controllers/storage_location_repository_rows_controller.rb
+++ b/app/controllers/storage_location_repository_rows_controller.rb
@@ -93,7 +93,7 @@ class StorageLocationRepositoryRowsController < ApplicationController
end
def load_storage_location
- @storage_location = StorageLocation.where(team: current_team).find(
+ @storage_location = StorageLocation.viewable_by_user(current_user).find(
storage_location_repository_row_params[:storage_location_id]
)
render_404 unless @storage_location
@@ -110,12 +110,10 @@ class StorageLocationRepositoryRowsController < ApplicationController
end
def check_read_permissions
- render_403 unless can_read_storage_location_containers?(current_team)
+ render_403 unless can_read_storage_location?(@storage_location)
end
def check_manage_permissions
- unless can_manage_storage_location_containers?(current_team) && can_read_repository?(@repository_row.repository)
- render_403
- end
+ render_403 unless can_manage_storage_location?(@storage_location)
end
end
diff --git a/app/controllers/storage_locations_controller.rb b/app/controllers/storage_locations_controller.rb
index 49c0375a1..91e0bcd0b 100644
--- a/app/controllers/storage_locations_controller.rb
+++ b/app/controllers/storage_locations_controller.rb
@@ -12,7 +12,7 @@ class StorageLocationsController < ApplicationController
respond_to do |format|
format.html
format.json do
- storage_locations = Lists::StorageLocationsService.new(current_team, params).call
+ storage_locations = Lists::StorageLocationsService.new(current_user, current_team, params).call
render json: storage_locations, each_serializer: Lists::StorageLocationSerializer,
user: current_user, meta: pagination_dict(storage_locations)
end
@@ -35,9 +35,11 @@ class StorageLocationsController < ApplicationController
def create
@storage_location = StorageLocation.new(
- storage_location_params.merge({ team: current_team, created_by: current_user })
+ storage_location_params.merge({ created_by: current_user })
)
+ @storage_location.team = @storage_location.root_storage_location.team
+
@storage_location.image.attach(params[:signed_blob_id]) if params[:signed_blob_id]
if @storage_location.save
@@ -101,7 +103,7 @@ class StorageLocationsController < ApplicationController
actions:
Toolbars::StorageLocationsService.new(
current_user,
- storage_location_ids: JSON.parse(params[:items]).map { |i| i['id'] }
+ storage_location_ids: JSON.parse(params[:items]).pluck('id')
).actions
}
end
@@ -114,7 +116,7 @@ class StorageLocationsController < ApplicationController
def storage_location_params
params.permit(:id, :parent_id, :name, :container, :description,
- metadata: [:display_type, dimensions: [], parent_coordinations: []])
+ metadata: [:display_type, { dimensions: [], parent_coordinations: [] }])
end
def move_params
@@ -122,16 +124,12 @@ class StorageLocationsController < ApplicationController
end
def load_storage_location
- @storage_location = current_team.storage_locations.find_by(id: storage_location_params[:id])
+ @storage_location = StorageLocation.viewable_by_user(current_user).find_by(id: storage_location_params[:id])
render_404 unless @storage_location
end
def check_read_permissions
- if @storage_location.container
- render_403 unless can_read_storage_location_containers?(current_team)
- else
- render_403 unless can_read_storage_locations?(current_team)
- end
+ render_403 unless can_read_storage_location?(@storage_location)
end
def check_create_permissions
@@ -143,11 +141,7 @@ class StorageLocationsController < ApplicationController
end
def check_manage_permissions
- if @storage_location.container
- render_403 unless can_manage_storage_location_containers?(current_team)
- else
- render_403 unless can_manage_storage_locations?(current_team)
- end
+ render_403 unless can_manage_storage_location?(@storage_location)
end
def set_breadcrumbs_items
diff --git a/app/controllers/team_shared_objects_controller.rb b/app/controllers/team_shared_objects_controller.rb
new file mode 100644
index 000000000..5ef3e50fa
--- /dev/null
+++ b/app/controllers/team_shared_objects_controller.rb
@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+class TeamSharedObjectsController < ApplicationController
+ before_action :load_vars
+ before_action :check_sharing_permissions
+
+ def update
+ ActiveRecord::Base.transaction do
+ # Global share
+ if params[:select_all_teams]
+ @model.update!(permission_level: params[:select_all_write_permission] ? :shared_write : :shared_read)
+ @model.team_shared_objects.each(&:destroy!)
+ next
+ end
+
+ # Share to specific teams
+ params[:team_share_params].each do |t|
+ @model.update!(permission_level: :not_shared) if @model.globally_shareable?
+ @model.team_shared_objects.find_or_initialize_by(team_id: t['id']).update!(
+ permission_level: t['private_shared_with_write'] ? :shared_write : :shared_read
+ )
+ end
+
+ # Unshare
+ @model.team_shared_objects.where.not(
+ team_id: params[:team_share_params].filter { |t| t['private_shared_with'] }.pluck('id')
+ ).each(&:destroy!)
+ end
+ end
+
+ def shareable_teams
+ teams = current_user.teams.order(:name) - [@model.team]
+ render json: teams, each_serializer: ShareableTeamSerializer, model: @model
+ end
+
+ private
+
+ def load_vars
+ case params[:object_type]
+ when 'Repository'
+ @model = Repository.viewable_by_user(current_user).find_by(id: params[:object_id])
+ when 'StorageLocation'
+ @model = StorageLocation.viewable_by_user(current_user).find_by(id: params[:object_id])
+ end
+
+ render_404 unless @model
+ end
+
+ def create_params
+ params.permit(:team_id, :object_type, :object_id, :target_team_id, :permission_level)
+ end
+
+ def destroy_params
+ params.permit(:team_id, :id)
+ end
+
+ def update_params
+ params.permit(permission_changes: {}, share_team_ids: [], write_permissions: [])
+ end
+
+ def check_sharing_permissions
+ object_name = @model.is_a?(RepositoryBase) ? 'repository' : @model.model_name.param_key
+ render_403 unless public_send("can_share_#{object_name}?", @model)
+ render_403 if !@model.shareable_write? && update_params[:write_permissions].present?
+ end
+
+ def share_all_params
+ {
+ shared_with_all: params[:select_all_teams].present?,
+ shared_permissions_level: params[:select_all_write_permission].present? ? 'shared_write' : 'shared_read'
+ }
+ end
+
+ def log_activity(type_of, team_shared_object)
+ # log activity logic
+ end
+end
diff --git a/app/javascript/vue/repositories/table.vue b/app/javascript/vue/repositories/table.vue
index ade32b122..50e8f52d4 100644
--- a/app/javascript/vue/repositories/table.vue
+++ b/app/javascript/vue/repositories/table.vue
@@ -50,9 +50,10 @@
:repository="duplicateRepository"
@close="duplicateRepository = null"
@duplicate="updateTable" />
-