diff --git a/app/controllers/results_controller.rb b/app/controllers/results_controller.rb index 40274e1cf..c231786fd 100644 --- a/app/controllers/results_controller.rb +++ b/app/controllers/results_controller.rb @@ -34,6 +34,6 @@ class ResultsController < ApplicationController end def check_destroy_permissions - render_403 unless can_manage_result?(@result) + render_403 unless can_delete_result?(@result) end end diff --git a/app/permissions/result.rb b/app/permissions/result.rb index 4d8d189c8..e175a52ae 100644 --- a/app/permissions/result.rb +++ b/app/permissions/result.rb @@ -8,4 +8,8 @@ Canaid::Permissions.register_for(Result) do can :manage_result do |user, result| can_manage_module?(user, result.my_module) && result.active? && result.unlocked?(result) end + + can :delete_result do |user, result| + can_manage_module?(user, result.my_module) && result.archived? && result.unlocked?(result) + end end diff --git a/app/views/my_modules/archive/_result.html.erb b/app/views/my_modules/archive/_result.html.erb index 3920e8ba5..955785fa5 100644 --- a/app/views/my_modules/archive/_result.html.erb +++ b/app/views/my_modules/archive/_result.html.erb @@ -18,7 +18,7 @@ <%= link_to option_text, result_table_download_path(result.result_table_id), data: { turbolinks: false } %> <% end %> - <% if can_manage_result?(result) %> + <% if can_delete_result?(result) %>