|
|
|
|
@ -7,6 +7,14 @@ class Ability
|
|
|
|
|
template_scope = Abilities::TemplateConditions.collection(user)
|
|
|
|
|
template_check = ->(template) { Abilities::TemplateConditions.entity(template, user: user, ability: 'manage') }
|
|
|
|
|
|
|
|
|
|
allow_viewer_permissions(user, template_scope, template_check)
|
|
|
|
|
allow_editor_permissions(user, template_scope, template_check) unless user.viewer?
|
|
|
|
|
allow_admin_permissions(user) if user.admin?
|
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
private
|
|
|
|
|
|
|
|
|
|
def allow_viewer_permissions(user, template_scope, template_check)
|
|
|
|
|
can :read, Template, template_scope, &template_check
|
|
|
|
|
can :read, TemplateFolder, account_id: user.account_id
|
|
|
|
|
can :read, Submission, account_id: user.account_id
|
|
|
|
|
@ -14,9 +22,9 @@ class Ability
|
|
|
|
|
can :manage, UserConfig, user_id: user.id
|
|
|
|
|
can :manage, EncryptedUserConfig, user_id: user.id
|
|
|
|
|
can :read, Account, id: user.account_id
|
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
return if user.viewer?
|
|
|
|
|
|
|
|
|
|
def allow_editor_permissions(user, template_scope, template_check)
|
|
|
|
|
can %i[create update], Template, template_scope, &template_check
|
|
|
|
|
can :destroy, Template, account_id: user.account_id
|
|
|
|
|
can :manage, TemplateFolder, account_id: user.account_id
|
|
|
|
|
@ -24,9 +32,9 @@ class Ability
|
|
|
|
|
can :manage, Submission, account_id: user.account_id
|
|
|
|
|
can :manage, Submitter, account_id: user.account_id
|
|
|
|
|
can :manage, AccessToken, user_id: user.id
|
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
return unless user.admin?
|
|
|
|
|
|
|
|
|
|
def allow_admin_permissions(user)
|
|
|
|
|
can :manage, User, account_id: user.account_id
|
|
|
|
|
can :manage, EncryptedConfig, account_id: user.account_id
|
|
|
|
|
can :manage, AccountConfig, account_id: user.account_id
|
|
|
|
|
|