diff --git a/app/controllers/client_api/teams/teams_controller.rb b/app/controllers/client_api/teams/teams_controller.rb index 0aca7212c..0542a8551 100644 --- a/app/controllers/client_api/teams/teams_controller.rb +++ b/app/controllers/client_api/teams/teams_controller.rb @@ -78,7 +78,7 @@ module ClientApi def check_update_team_permission @team = Team.find_by_id(params[:team_id]) - unless can_update_team?(@team) + unless can_manage_team?(@team) respond_422(t('client_api.teams.update_permission_error')) end end diff --git a/app/controllers/project_folders_controller.rb b/app/controllers/project_folders_controller.rb index a8712bb92..ae089f3b5 100644 --- a/app/controllers/project_folders_controller.rb +++ b/app/controllers/project_folders_controller.rb @@ -107,7 +107,7 @@ class ProjectFoldersController < ApplicationController project_folders = current_team.project_folders.where(id: params[:project_folders_ids]) counter = 0 project_folders.each do |folder| - next if folder.projects.exists? || folder.project_folders.exists? || !can_update_team?(current_team) + next if folder.projects.exists? || folder.project_folders.exists? || !can_manage_team?(current_team) folder.transaction do log_activity(:delete_project_folder, folder, project_folder: folder.id) @@ -158,7 +158,7 @@ class ProjectFoldersController < ApplicationController end def check_manage_permissions - render_403 unless can_update_team?(current_team) + render_403 unless can_manage_team?(current_team) end def move_projects(destination_folder) diff --git a/app/controllers/projects_controller.rb b/app/controllers/projects_controller.rb index 2e4030f39..c59d0de20 100644 --- a/app/controllers/projects_controller.rb +++ b/app/controllers/projects_controller.rb @@ -389,7 +389,7 @@ class ProjectsController < ApplicationController end def set_folder_inline_name_editing - return if !can_update_team?(current_team) || @current_folder.nil? + return if !can_manage_team?(current_team) || @current_folder.nil? @inline_editable_title_config = { name: 'title', diff --git a/app/controllers/users/settings/teams_controller.rb b/app/controllers/users/settings/teams_controller.rb index 32c7eee73..642d8fe18 100644 --- a/app/controllers/users/settings/teams_controller.rb +++ b/app/controllers/users/settings/teams_controller.rb @@ -143,7 +143,7 @@ module Users def load_team @team = Team.find_by_id(params[:id]) - render_403 unless can_update_team?(@team) + render_403 unless can_manage_team?(@team) end def create_params diff --git a/app/helpers/teams_helper.rb b/app/helpers/teams_helper.rb index c5e69bfb1..c1b1f3787 100644 --- a/app/helpers/teams_helper.rb +++ b/app/helpers/teams_helper.rb @@ -1,7 +1,7 @@ module TeamsHelper # resets the current team if needed def current_team_switch(team) - if team != current_team && current_user.is_member_of_team?(team) + if team != current_team && current_user.member_of_team?(team) current_user.current_team_id = team.id current_user.save update_current_team diff --git a/app/javascript/src/services/permissions/index.js b/app/javascript/src/services/permissions/index.js index bd41f96e0..62e81d973 100644 --- a/app/javascript/src/services/permissions/index.js +++ b/app/javascript/src/services/permissions/index.js @@ -10,7 +10,7 @@ If you need to specific model you have to specify it in the connect method like the example below: > - > Permissions.connect(MyComponent, ["can_update_team", "can_read_team"], "Team"); + > Permissions.connect(MyComponent, ["can_manage_team", "can_read_team"], "Team"); > In case your component is connected to Redux or some other HOC you can simply diff --git a/app/models/concerns/user/team_roles.rb b/app/models/concerns/user/team_roles.rb deleted file mode 100644 index 39782e99f..000000000 --- a/app/models/concerns/user/team_roles.rb +++ /dev/null @@ -1,44 +0,0 @@ -require 'aspector' - -module User::TeamRoles - extend ActiveSupport::Concern - - aspector do - # Check if user is member of team - around %i( - is_member_of_team? - is_admin_of_team? - is_normal_user_of_team? - is_normal_user_or_admin_of_team? - is_guest_of_team? - ) do |proxy, *args, &block| - if args[0] - @user_team = args[0]&.user_teams&.find { |ut| ut.user == self } - @user_team ? proxy.call(*args, &block) : false - else - false - end - end - end - - def is_member_of_team?(team) - # This is already checked by aspector, so just return true - true - end - - def is_admin_of_team?(team) - @user_team.admin? - end - - def is_normal_user_of_team?(team) - @user_team.normal_user? - end - - def is_normal_user_or_admin_of_team?(team) - @user_team.normal_user? or @user_team.admin? - end - - def is_guest_of_team?(team) - @user_team.guest? - end -end diff --git a/app/models/project.rb b/app/models/project.rb index cad254213..afe590a91 100644 --- a/app/models/project.rb +++ b/app/models/project.rb @@ -58,7 +58,7 @@ class Project < ApplicationRecord reject_if: :all_blank scope :visible_to, (lambda do |user, team| - unless user.is_admin_of_team?(team) + unless can_manage_team?(team) left_outer_joins(user_assignments: :user_role) .where(user_assignments: { user: user }) .where('? = ANY(user_roles.permissions)', ProjectPermissions::READ) diff --git a/app/models/user.rb b/app/models/user.rb index 2e3734391..a7d6d133d 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -4,7 +4,6 @@ class User < ApplicationRecord include SearchableModel include SettingsModel include VariablesModel - include User::TeamRoles include TeamBySubjectModel include InputSanitizeHelper include ActiveStorageConcerns @@ -389,6 +388,10 @@ class User < ApplicationRecord .take end + def member_of_team?(team) + team.user_assignments.exists?(user: self) + end + # Search all active users for username & email. Can # also specify which team to ignore. def self.search( diff --git a/app/permissions/project.rb b/app/permissions/project.rb index 307aca19c..ea296aa17 100644 --- a/app/permissions/project.rb +++ b/app/permissions/project.rb @@ -20,7 +20,7 @@ Canaid::Permissions.register_for(Project) do export_project) .each do |perm| can perm do |user, project| - user.is_admin_of_team?(project.team) || project.permission_granted?(user, ProjectPermissions::READ) + project.permission_granted?(user, ProjectPermissions::READ) end end @@ -46,7 +46,7 @@ Canaid::Permissions.register_for(Project) do end can :manage_project_users do |user, project| - user.is_admin_of_team?(project.team) || project.permission_granted?(user, ProjectPermissions::USERS_MANAGE) + project.permission_granted?(user, ProjectPermissions::USERS_MANAGE) end can :archive_project do |user, project| diff --git a/app/permissions/repository.rb b/app/permissions/repository.rb index 69cb9851b..5f490b853 100644 --- a/app/permissions/repository.rb +++ b/app/permissions/repository.rb @@ -16,7 +16,6 @@ Canaid::Permissions.register_for(Repository) do %i(manage_repository create_repository_rows manage_repository_rows - update_repository_rows delete_repository_rows create_repository_columns) .each do |perm| @@ -27,14 +26,14 @@ Canaid::Permissions.register_for(Repository) do # repository: update, delete can :manage_repository do |user, repository| - user.is_admin_of_team?(repository.team) unless repository.shared_with?(user.current_team) + !repository.shared_with?(user.current_team) && repository.permission_granted?(user, RepositoryPermissions::MANAGE) end # repository: archive, restore can :archive_repository do |user, repository| next false if repository.is_a?(BmtRepository) - !repository.shared_with?(user.current_team) && user.is_admin_of_team?(repository.team) + !repository.shared_with?(user.current_team) && repository.permission_granted?(user, RepositoryPermissions::MANAGE) end # repository: destroy @@ -44,17 +43,17 @@ Canaid::Permissions.register_for(Repository) do # repository: share can :share_repository do |user, repository| - user.is_admin_of_team?(repository.team) unless repository.shared_with?(user.current_team) + can_manage_repository?(user, repository) end # repository: make a snapshot with assigned rows can :create_repository_snapshot do |user, repository| - user.is_normal_user_or_admin_of_team?(repository.team) + can_read_repository?(user, repository) end # repository: delete a snapshot with assigned rows can :delete_repository_snapshot do |user, repository| - user.is_normal_user_or_admin_of_team?(repository.team) + can_manage_repository?(user, repository) end # repository: create/import record @@ -63,38 +62,36 @@ Canaid::Permissions.register_for(Repository) do next false if repository.archived? if repository.shared_with?(user.current_team) - repository.shared_with_write?(user.current_team) && user.is_normal_user_or_admin_of_team?(user.current_team) - elsif user.teams.include?(repository.team) - user.is_normal_user_or_admin_of_team?(repository.team) + repository.shared_with_write?(user.current_team) && + repository.permission_granted?(user, RepositoryPermissions::ROWS_CREATE) + else + repository.permission_granted?(user, RepositoryPermissions::ROWS_CREATE) end end can :manage_repository_assets do |user, repository| - can_create_repository_rows?(user, repository) + repository.permission_granted?(user, RepositoryPermissions::ROWS_UPDATE) end # repository: update/delete records can :manage_repository_rows do |user, repository| - can_create_repository_rows?(user, repository) - end - - can :update_repository_rows do |user, repository| - can_manage_repository_rows?(user, repository) + repository.permission_granted?(user, RepositoryPermissions::ROWS_UPDATE) end can :delete_repository_rows do |user, repository| - can_manage_repository_rows?(user, repository) + repository.permission_granted?(user, RepositoryPermissions::ROWS_DELETE) end # repository: create field can :create_repository_columns do |user, repository| - can_create_repository_rows?(user, repository) unless repository.shared_with?(user.current_team) + !repository.shared_with?(user.current_team) && + repository.permission_granted?(user, RepositoryPermissions::COLUMNS_CREATE) end # repository: create/update/delete filters can :manage_repository_filters do |user, repository| - ((repository.team == user.current_team) && user.is_normal_user_or_admin_of_team?(repository.team)) || - (repository.shared_with_write?(user.current_team) && user.is_normal_user_or_admin_of_team?(user.current_team)) + ((repository.team == user.current_team) && can_manage_team?(user, repository.team)) || + (repository.shared_with_write?(user.current_team) && can_manage_team?(user, user.current_team)) end can :manage_repository_stock do |user, repository| diff --git a/app/permissions/team.rb b/app/permissions/team.rb index a58184cae..ac306bec3 100644 --- a/app/permissions/team.rb +++ b/app/permissions/team.rb @@ -3,65 +3,64 @@ Canaid::Permissions.register_for(Team) do # read protocols # can :read_team do |user, team| - user.is_member_of_team?(team) + user.member_of_team?(team) end # team: update - can :update_team do |user, team| - user.is_admin_of_team?(team) + can :manage_team do |user, team| + team.permission_granted?(user, TeamPermissions::MANAGE) end # team: assign/unassing user, change user role can :manage_team_users do |user, team| - user.is_admin_of_team?(team) + team.permission_granted?(user, TeamPermissions::USERS_MANAGE) end # team: invite new users to the team - can :invite_team_users do - true + can :invite_team_users do |user, team| + can_manage_team_users?(user, team) end # project_folder: create can :create_project_folders do |user, team| - user.is_admin_of_team?(team) + can_manage_team?(user, team) end # project: create can :create_projects do |user, team| - user.is_normal_user_or_admin_of_team?(team) + team.permission_granted?(user, TeamPermissions::PROJECTS_CREATE) end # protocol in repository: create, import can :create_protocols_in_repository do |user, team| - user.is_normal_user_or_admin_of_team?(team) + team.permission_granted?(user, TeamPermissions::PROTOCOLS_CREATE) end can :manage_bmt_filters do |user, team| - user.is_normal_user_or_admin_of_team?(team) + can_manage_team?(user, team) end # repository: create, copy can :create_repositories do |user, team| within_limits = Repository.within_global_limits? within_limits = Repository.within_team_limits?(team) if within_limits - within_limits && user.is_admin_of_team?(team) + within_limits && team.permission_granted?(user, TeamPermissions::INVENTORIES_CREATE) end # this permission is scattered around the application # if you want to make changes here keep in mind to check/change the # SQL view that lists reports in index page: - # - db/views/datatables_reports_v01.sql # - check the model app/models/views/datatables/datatables_report.rb # - check visible_by method in Project model can :manage_reports do |user, team| - user.is_normal_user_or_admin_of_team?(team) + can_manage_team?(user, team) end end Canaid::Permissions.register_for(ProjectFolder) do # ProjectFolder: delete can :delete_project_folder do |user, project_folder| - user.is_admin_of_team?(project_folder.team) && + can_manage_team?(user, team) && project_folder.projects.none? && project_folder.project_folders.none? end @@ -70,7 +69,7 @@ end Canaid::Permissions.register_for(Protocol) do # protocol in repository: read, export, read step, read/download step asset can :read_protocol_in_repository do |user, protocol| - user.is_member_of_team?(protocol.team) && + user.member_of_team?(protocol.team) && (protocol.in_repository_public? || protocol.in_repository_private? && user == protocol.added_by) end @@ -78,21 +77,16 @@ Canaid::Permissions.register_for(Protocol) do # protocol in repository: update, create/update/delete/reorder step, # toggle private/public visibility, archive can :manage_protocol_in_repository do |user, protocol| - protocol.in_repository_active? && - user.is_normal_user_or_admin_of_team?(protocol.team) && - user == protocol.added_by + protocol.in_repository_active? && protocol.permission_granted?(user, ProtocolPermissions::MANAGE) end # protocol in repository: restore can :restore_protocol_in_repository do |user, protocol| - protocol.in_repository_archived? && - user.is_normal_user_or_admin_of_team?(protocol.team) && - user == protocol.added_by + protocol.in_repository_archived? && protocol.permission_granted?(user, ProtocolPermissions::MANAGE) end # protocol in repository: copy can :clone_protocol_in_repository do |user, protocol| - can_read_protocol_in_repository?(user, protocol) && - can_create_protocols_in_repository?(user, protocol.team) + can_read_protocol_in_repository?(user, protocol) && can_create_protocols_in_repository?(user, protocol.team) end end diff --git a/app/views/dashboards/_current_tasks.html.erb b/app/views/dashboards/_current_tasks.html.erb index 950829bb0..3b54870a0 100644 --- a/app/views/dashboards/_current_tasks.html.erb +++ b/app/views/dashboards/_current_tasks.html.erb @@ -83,9 +83,7 @@

<%= I18n.t('dashboard.current_tasks.no_tasks.team_tasks.title') %>

<%= I18n.t('dashboard.current_tasks.no_tasks.assigned_tasks.title') %>

- <% unless current_user.is_guest_of_team?(current_team) %> -

<%= I18n.t('dashboard.current_tasks.no_tasks.assigned_tasks.description') %>

- <% end %> +

<%= I18n.t('dashboard.current_tasks.no_tasks.assigned_tasks.description') %>

diff --git a/app/views/dashboards/_quick_start.html.erb b/app/views/dashboards/_quick_start.html.erb index eabe06fce..44516855e 100644 --- a/app/views/dashboards/_quick_start.html.erb +++ b/app/views/dashboards/_quick_start.html.erb @@ -1,12 +1,10 @@ -<% unless current_user.is_guest_of_team?(current_team) %> -
-
<%= t("dashboard.quick_start.new_task") %>
- <%= link_to protocols_path, {class: "new-protocol btn btn-secondary"} do %> - <%= t("dashboard.quick_start.new_protocol") %> - <% end %> - <%= link_to new_report_path, {class: "new-report btn btn-secondary"} do %> - <%= t("dashboard.quick_start.new_report") %> - <% end %> -
- <%= render "create_task_modal" %> -<% end %> +
+
<%= t("dashboard.quick_start.new_task") %>
+ <%= link_to protocols_path, {class: "new-protocol btn btn-secondary"} do %> + <%= t("dashboard.quick_start.new_protocol") %> + <% end %> + <%= link_to new_report_path, {class: "new-report btn btn-secondary"} do %> + <%= t("dashboard.quick_start.new_report") %> + <% end %> +
+<%= render "create_task_modal" %> diff --git a/app/views/dashboards/_recent_work.html.erb b/app/views/dashboards/_recent_work.html.erb index ddcbf325e..e40ceaa40 100644 --- a/app/views/dashboards/_recent_work.html.erb +++ b/app/views/dashboards/_recent_work.html.erb @@ -26,12 +26,7 @@ diff --git a/app/views/my_modules/modals/_manage_users_modal.html.erb b/app/views/my_modules/modals/_manage_users_modal.html.erb index da9e7b5c0..f337956b3 100644 --- a/app/views/my_modules/modals/_manage_users_modal.html.erb +++ b/app/views/my_modules/modals/_manage_users_modal.html.erb @@ -8,7 +8,7 @@