diff --git a/app/controllers/users/settings/user_teams_controller.rb b/app/controllers/users/settings/user_teams_controller.rb index 36371e511..ce8d6d1c0 100644 --- a/app/controllers/users/settings/user_teams_controller.rb +++ b/app/controllers/users/settings/user_teams_controller.rb @@ -6,7 +6,8 @@ module Users include UserRolesHelper before_action :load_user_assignment, only: %i(update leave_html destroy_html destroy) - before_action :check_manage_permissions + before_action :check_manage_permissions, except: %i(leave_html destroy_html destroy) + before_action :check_destroy_permissions, only: %i(leave_html destroy_html destroy) def update respond_to do |format| @@ -164,6 +165,14 @@ module Users render_403 unless can_manage_team_users?(@user_assignment.assignable) end + def check_destroy_permissions + if params[:leave] + render_403 unless @user_assignment.user == current_user + else + render_403 unless can_manage_team_users?(@user_assignment.assignable) + end + end + def update_params params.require(:user_assignment).permit(:user_role_id) end diff --git a/app/datatables/teams_datatable.rb b/app/datatables/teams_datatable.rb index 312f8624e..6614b231a 100644 --- a/app/datatables/teams_datatable.rb +++ b/app/datatables/teams_datatable.rb @@ -15,7 +15,7 @@ class TeamsDatatable < CustomDatatable def sortable_columns @sortable_columns ||= [ 'Team.name', - 'UserTeam.role', + 'UserRole.name', MEMEBERS_SORT_COL ] end @@ -27,16 +27,16 @@ class TeamsDatatable < CustomDatatable records.map do |record| { 'DT_RowId': record.id, - '0': if record.admin? - link_to(escape_input(record.team.name), team_path(record.team)) + '0': if current_user_team_role(record)&.owner? + link_to(escape_input(record.name), team_path(record)) else - escape_input(record.team.name) + escape_input(record.name) end, - '1': escape_input(record.role_str), - '2': if record.guest? + '1': escape_input(current_user_team_role(record)&.name), + '2': if current_user_team_role(record)&.viewer? I18n.t('users.settings.teams.index.na') else - record.team.users.count + record.users.count end, '3': leave_team_button(record) } @@ -57,15 +57,16 @@ class TeamsDatatable < CustomDatatable # which is calculated in code and not present in DB def sort_records(records) if sort_column(order_params) == MEMEBERS_SORT_COL - records = records.sort_by(&proc { |ut| ut.team.users.count }) + records = records.sort_by(&proc { |team| team.users.count }) if order_params['dir'] == 'asc' - return records + records elsif order_params['dir'] == 'desc' - return records.reverse + records.reverse end - elsif sort_column(order_params) == 'user_teams.role' - records_with_role = records.where(user: @user).order(role: :asc) - records_with_no_role = records.where.not(user: @user) + elsif sort_column(order_params) == 'user_roles.name' + records_with_role = records.where(user_assignments: { user: @user }) + .sort_by(&proc { |team| current_user_team_role(team)&.name }) + records_with_no_role = records.where.not(user_assignments: { user: @user }) records = records_with_no_role + records_with_role if order_params['dir'] == 'asc' records @@ -79,20 +80,20 @@ class TeamsDatatable < CustomDatatable # If user is last admin of team, don't allow # him/her to leave team - def leave_team_button(user_team) + def leave_team_button(record) button = " #{I18n.t('users.settings.teams.index.leave')} " - team = user_team.team - if user_team.admin? && team.user_teams.where(role: 2).count <= 1 + owner_role = UserRole.find_by(name: UserRole.public_send('owner_role').name) + if current_user_team_role(record)&.owner? && record.user_assignments.where(user_role: owner_role).none? button.prepend('