From 50d2bf53dc61b9f5d8e13f07d51d323a13684ff1 Mon Sep 17 00:00:00 2001 From: Andrej Date: Mon, 14 Oct 2024 13:56:55 +0200 Subject: [PATCH] Add restore asset permission [SCI-11169] --- app/controllers/assets_controller.rb | 7 ++++++- app/permissions/asset.rb | 4 ++++ app/serializers/asset_serializer.rb | 2 +- 3 files changed, 11 insertions(+), 2 deletions(-) diff --git a/app/controllers/assets_controller.rb b/app/controllers/assets_controller.rb index 4fe1988dc..47d92e5f7 100644 --- a/app/controllers/assets_controller.rb +++ b/app/controllers/assets_controller.rb @@ -18,7 +18,8 @@ class AssetsController < ApplicationController before_action :load_vars, except: :create_wopi_file before_action :check_read_permission, except: %i(edit destroy duplicate create_wopi_file toggle_view_mode) - before_action :check_manage_permission, only: %i(edit destroy duplicate rename toggle_view_mode restore_version) + before_action :check_manage_permission, only: %i(edit destroy duplicate rename toggle_view_mode) + before_action :check_restore_permission, only: :restore_version def file_preview editable = can_manage_asset?(@asset) && (@asset.repository_asset_value.blank? || @@ -475,6 +476,10 @@ class AssetsController < ApplicationController render_403 and return unless can_manage_asset?(@asset) end + def check_restore_permission + render_403 and return unless can_restore_asset?(@asset) + end + def append_wd_params(url) exclude_params = %w(wdPreviousSession wdPreviousCorrelation) wd_params = params.as_json.select { |key, _value| key[/^wd.*/] && !(exclude_params.include? key) }.to_query diff --git a/app/permissions/asset.rb b/app/permissions/asset.rb index bd6acb444..4349fdfe5 100644 --- a/app/permissions/asset.rb +++ b/app/permissions/asset.rb @@ -32,6 +32,10 @@ Canaid::Permissions.register_for(Asset) do end end + can :restore_asset do |user, asset| + VersionedAttachments.enabled? && can_manage_asset?(user, asset) + end + can :open_asset_locally do |_user, asset| ENV['ASSET_SYNC_URL'].present? end diff --git a/app/serializers/asset_serializer.rb b/app/serializers/asset_serializer.rb index 53c31236d..d3408bf93 100644 --- a/app/serializers/asset_serializer.rb +++ b/app/serializers/asset_serializer.rb @@ -156,7 +156,7 @@ class AssetSerializer < ActiveModel::Serializer ) end - urls[:restore_version] = asset_restore_version_path(object) if VersionedAttachments.enabled? + urls[:restore_version] = asset_restore_version_path(object) if can_restore_asset?(user, object) urls[:open_vector_editor_edit] = edit_gene_sequence_asset_path(object.id) if can_manage_asset?(user, object) if can_manage_asset?(user, object) && can_open_asset_locally?(user, object)