diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 2b934011e..5f6b9c2dc 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -9,7 +9,6 @@ class ApplicationController < ActionController::Base append_before_filter :check_for_terms_acceptance!, unless: :devise_controller? before_filter :configure_permitted_parameters, if: :devise_controller? before_filter :set_locale - before_filter :set_current_organization after_filter :store_location rescue_from MissingTOSAcceptance, OutadedTOSAcceptance do @@ -18,7 +17,7 @@ class ApplicationController < ActionController::Base rescue_from Pundit::NotAuthorizedError, with: :user_not_authorized - helper_method :current_organization, :admin?, :superadmin? + helper_method :admin?, :superadmin? protected @@ -26,14 +25,6 @@ def configure_permitted_parameters devise_parameter_sanitizer.for(:sign_up) << :username end - def set_current_organization - if org_id = session[:current_organization_id] - @current_organization = Organization.find(org_id) - elsif current_user - @current_organization = current_user.organizations.first - end - end - def store_location # store last url - this is needed for post-login redirect to whatever the # user last visited. @@ -47,7 +38,7 @@ def store_location def after_sign_in_path_for(user) if user.members.present? - users_path + root_path else page_path("about") end @@ -66,20 +57,8 @@ def check_for_terms_acceptance! end end - def current_organization - @current_organization ||= current_user.try(:organizations).try(:first) - end - - def current_member - @current_member ||= current_user.as_member_of(current_organization) if current_user - end - - def pundit_user - current_member - end - def admin? - current_user.try :manages?, current_organization + current_user.try :manages?, @organization end def superadmin? diff --git a/app/controllers/home_controller.rb b/app/controllers/home_controller.rb index d257c39e4..c62f9fba8 100644 --- a/app/controllers/home_controller.rb +++ b/app/controllers/home_controller.rb @@ -1,5 +1,11 @@ class HomeController < ApplicationController + + # TODO: what happens when the user doesn't pertain to any organization? def index - redirect_to :users if current_user + return unless current_user + + organization_id = current_user.organization_ids.first + + redirect_to organization_path(id: organization_id) end end diff --git a/app/controllers/members_controller.rb b/app/controllers/members_controller.rb index c88ea52df..1b78d0b3d 100644 --- a/app/controllers/members_controller.rb +++ b/app/controllers/members_controller.rb @@ -1,5 +1,17 @@ class MembersController < ApplicationController before_filter :authenticate_user! + before_filter :load_organization + + # TODO: move to abstract controller for all nested resources + # TODO: check authorization + # + def load_organization + @organization = Organization.find_by_id(params[:id]) + + raise not_found unless @organization + + @organization + end def destroy find_member @@ -34,11 +46,11 @@ def toggle_active private def find_member - @member ||= current_organization.members.find(params[:id]) + @member ||= @organization.members.find(params[:id]) end def toggle_active_posts - current_organization.posts.where(user_id: @member.user_id). + @organization.posts.where(user_id: @member.user_id). each { |post| post.update_attributes(active: false) } end end diff --git a/app/controllers/offers_controller.rb b/app/controllers/offers_controller.rb index 6e455ae02..e8558fa86 100644 --- a/app/controllers/offers_controller.rb +++ b/app/controllers/offers_controller.rb @@ -1,21 +1,5 @@ -# Managems of offer-type posts -# class OffersController < PostsController def model Offer end - - def dashboard - initial_scope = - if current_organization - current_organization.offers.active.of_active_members - else - Offer.all.active.of_active_members - end - @offers = Category.all.sort_by { |a| a.name.downcase }. - each_with_object({}) do |category, offers| - list = initial_scope.merge(category.posts).limit(5) - offers[category] = list if list.present? - end - end end diff --git a/app/controllers/organizations_controller.rb b/app/controllers/organizations_controller.rb index 0e3ab87a7..b2cd87e62 100644 --- a/app/controllers/organizations_controller.rb +++ b/app/controllers/organizations_controller.rb @@ -1,20 +1,17 @@ class OrganizationsController < ApplicationController - before_filter :load_resource - - def load_resource - if params[:id] - @organization = Organization.find(params[:id]) - else - @organizations = Organization.all - end - end + before_filter :load_resource, only: [:show, :update, :destroy, :give_time] def new @organization = Organization.new end + # TODO: define which organizations we should display + # def index - @organizations = @organizations.matching(params[:q]) if params[:q].present? + context = Organization.all + context = context.matching(params[:q]) if params[:q].present? + + @organizations = context end def show @@ -27,7 +24,7 @@ def show end def create - @organization = @organizations.build organization_params + @organization = Organization.new(organization_params) if @organization.save redirect_to @organization, status: :created else @@ -48,6 +45,8 @@ def destroy redirect_to organizations_path, notice: "deleted" end + # Transfer time to the current organization + # def give_time @destination = @organization.account.id @source = find_transfer_source @@ -56,13 +55,6 @@ def give_time @sources = find_transfer_sources_for_admin end - def set_current - if current_user - session[:current_organization_id] = @organization.id - end - redirect_to root_path - end - private def organization_params @@ -71,8 +63,18 @@ def organization_params neighborhood city domain]) end + def load_resource + @organization = Organization.find_by_id(params[:id]) + + raise unless @organization + + # TODO: authorize + + @organization + end + def find_transfer_offer - current_organization.offers. + @organization.offers. find(params[:offer]) if params[:offer].present? end diff --git a/app/controllers/posts_controller.rb b/app/controllers/posts_controller.rb index 08c47942c..4bd9caaca 100644 --- a/app/controllers/posts_controller.rb +++ b/app/controllers/posts_controller.rb @@ -1,4 +1,6 @@ class PostsController < ApplicationController + before_filter :load_organization + has_scope :by_category, as: :cat has_scope :tagged_with, as: :tag has_scope :by_organization, as: :org @@ -11,9 +13,9 @@ def index type: "phrase_prefix", fields: ["title^2", "description", "tags^2"] } } ] - if current_organization.present? + if @organization.present? # filter by organization - must << { term: { organization_id: { value: current_organization.id } } } + must << { term: { organization_id: { value: @organization.id } } } end posts = model.__elasticsearch__.search( query: { @@ -24,8 +26,8 @@ def index ).page(params[:page]).per(25).records else posts = model.active.of_active_members - if current_organization.present? - posts = posts.merge(current_organization.posts) + if @organization.present? + posts = posts.merge(@organization.posts) end posts = apply_scopes(posts).page(params[:page]).per(25) end @@ -40,9 +42,9 @@ def new def create post = model.new(post_params) - post.organization = current_organization + post.organization = @organization if post.save - redirect_to send("#{resource}_path", post) + redirect_to polymorphic_url([@organization, post]) else instance_variable_set("@#{resource}", post) render action: :new @@ -50,13 +52,13 @@ def create end def edit - post = current_organization.posts.find params[:id] + post = @organization.posts.find params[:id] instance_variable_set("@#{resource}", post) end def show scope = if current_user.present? - current_organization.posts.active.of_active_members + @organization.posts.active.of_active_members else model.all.active.of_active_members end @@ -65,34 +67,36 @@ def show end def update - post = current_organization.posts.find params[:id] + post = @organization.posts.find params[:id] authorize post instance_variable_set("@#{resource}", post) if post.update_attributes(post_params) - redirect_to post + redirect_to polymorphic_url([@organization, post]) else render action: :edit, status: :unprocessable_entity end end def destroy - post = current_organization.posts.find params[:id] + post = @organization.posts.find params[:id] authorize post - redirect_to send("#{resources}_path") if post.update!(active: false) + redirect_to polymorphic_url([@organization, resources]) if post.update!(active: false) end private + # TODO: Investigate why we need this def resource controller_name.singularize end + # TODO: Investigate why we need this def resources controller_name end def set_user_id(p) - if current_user.manages?(current_organization) + if current_user.manages?(@organization) p.update publisher_id: current_user.id p.reverse_merge! user_id: current_user.id else @@ -109,4 +113,15 @@ def post_params set_user_id(p) end end + + # TODO: move to abstract controller for all nested resources + # TODO: check authorization + # + def load_organization + @organization = Organization.find_by_id(params[:organization_id]) + + raise not_found unless @organization + + @organization + end end diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb index 68f6fb828..3b6cea6b1 100644 --- a/app/controllers/users_controller.rb +++ b/app/controllers/users_controller.rb @@ -1,38 +1,62 @@ class UsersController < ApplicationController before_filter :authenticate_user! + before_filter :load_organization, only: [:index] + + # TODO: move to abstract controller for all nested resources + def load_organization + @organization = Organization.find_by_id(params[:organization_id]) + + raise not_found unless @organization + + @organization + end def scoped_users - current_organization.users + @organization.users end + # GET /organizations/:id/members + # def index + authorize @organization, :show? + @users = scoped_users - @memberships = current_organization.members. + @memberships = @organization.members. where(user_id: @users.map(&:id)). includes(:account).each_with_object({}) do |mem, ob| ob[mem.user_id] = mem end end + # GET /members/:user_id + # def show + authorize @organization, :show? + @user = find_user - @member = @user.as_member_of(current_organization) + authorize @user + + @member = @user.as_member_of(@organization) @movements = @member.movements.order("created_at DESC").page(params[:page]). per(10) end def new - authorize User + authorize @organization, :admin? + @user = scoped_users.build end def edit - @user = find_user + @user = User.find_by_id(params[:id]) + + # TODO: raise 404 + raise unless @user + + authorize @user end def create - authorize User - # New User email = user_params[:email] @user = User.find_or_initialize_by(email: email) do |u| @@ -42,7 +66,7 @@ def create @user.setup_and_save_user if @user.persisted? - @user.tune_after_persisted(current_organization) + @user.tune_after_persisted(@organization) redirect_to_after_create else @user.email = "" if empty_email @@ -64,7 +88,7 @@ def update def give_time @user = scoped_users.find(params[:id]) @destination = @user.members. - find_by(organization: current_organization).account.id + find_by(organization: @organization).account.id @source = find_transfer_source @offer = find_transfer_offer @transfer = Transfer.new(source: @source, @@ -86,19 +110,19 @@ def user_params end def find_transfer_offer - current_organization.offers. + @organization.offers. find(params[:offer]) if params[:offer].present? end def find_transfer_source current_user.members. - find_by(organization: current_organization).account.id + find_by(organization: @organization).account.id end def find_transfer_sources_for_admin return unless admin? - [current_organization.account] + - current_organization.member_accounts.where("members.active is true") + [@organization.account] + + @organization.member_accounts.where("members.active is true") end def find_user @@ -110,7 +134,7 @@ def find_user end def redirect_to_after_create - id = @user.member(current_organization).member_uid + id = @user.member(@organization).member_uid if params[:more] redirect_to new_user_path, notice: I18n.t("users.new.user_created_add", diff --git a/app/helpers/posts_helper.rb b/app/helpers/posts_helper.rb index 1737bf674..ea4721ed8 100644 --- a/app/helpers/posts_helper.rb +++ b/app/helpers/posts_helper.rb @@ -1,13 +1,16 @@ module PostsHelper # Returns the right path to index list depending on type of post + # + # TODO: doesn't Rails URL helpers already provide this? def get_index_path(post, hparams) klass = post.class + hparams[:organization_id] = @organization.id case when klass == String - post.eql?("offers") ? offers_path(hparams) : inquiries_path(hparams) + post.eql?("offers") ? organization_offers_path(hparams) : organization_inquiries_path(hparams) else - post.type.eql?("Offer") ? offers_path(hparams) : inquiries_path(hparams) + post.type.eql?("Offer") ? organization_offers_path(hparams) : organization_inquiries_path(hparams) end end end diff --git a/app/helpers/users_helper.rb b/app/helpers/users_helper.rb index 947b95fa0..9a03e7fc6 100644 --- a/app/helpers/users_helper.rb +++ b/app/helpers/users_helper.rb @@ -15,8 +15,8 @@ def users_as_json alt_phone: user.alt_phone, balance: membership.account_balance.to_i, - url: user_path(user), - edit_link: edit_user_path(user), + url: organization_user_path(organization_id: membership.organization_id, id: user.id), + edit_link: edit_link(membership), cancel_link: cancel_member_path(membership), toggle_manager_link: toggle_manager_member_path(membership), manager: !!membership.manager, @@ -29,8 +29,13 @@ def users_as_json private - def edit_user_path(user) - can_edit_user?(user) ? super : "" + def edit_link(membership) + return '' unless can_edit_user?(membership.user) + + edit_organization_user_path( + organization_id: membership.organization_id, + id: membership.user_id + ) end def can_edit_user?(user) diff --git a/app/policies/application_policy.rb b/app/policies/application_policy.rb index 795d32efc..17a979f74 100644 --- a/app/policies/application_policy.rb +++ b/app/policies/application_policy.rb @@ -1,10 +1,8 @@ class ApplicationPolicy - attr_reader :member, :user, :organization, :record + attr_reader :user, :record - def initialize(member, record) - @member = member - @user = member.user if member - @organization = member.organization if member + def initialize(user, record) + @user = user @record = record end @@ -13,7 +11,7 @@ def index? end def show? - scope.where(id: record.id).exists? + false end def create? @@ -35,23 +33,4 @@ def edit? def destroy? false end - - def scope - Pundit.policy_scope!(member, record.class) - end - - class Scope - attr_reader :member, :user, :organization, :scope - - def initialize(member, scope) - @member = member - @user = member.user if member - @organization = member.organization if member - @scope = scope - end - - def resolve - scope - end - end end diff --git a/app/policies/organization_policy.rb b/app/policies/organization_policy.rb new file mode 100644 index 000000000..7f1a8d7a8 --- /dev/null +++ b/app/policies/organization_policy.rb @@ -0,0 +1,9 @@ +class OrganizationPolicy < ApplicationPolicy + def show? + user.member(record).present? + end + + def admin? + user.admins?(record) + end +end diff --git a/app/policies/user_policy.rb b/app/policies/user_policy.rb index a0b6b3739..01d762a46 100644 --- a/app/policies/user_policy.rb +++ b/app/policies/user_policy.rb @@ -1,4 +1,8 @@ class UserPolicy < ApplicationPolicy + def show? + true + end + def new? user.admins?(organization) end @@ -14,19 +18,4 @@ def update? user.admins?(organization) ) end - - class Scope < ApplicationPolicy::Scope - attr_reader :member, :user, :organization, :scope - - def initialize(user, scope) - @member = member - @user = member.user if member - @organization = member.organization if member - @scope = scope - end - - def resolve - scope - end - end end diff --git a/app/views/application/_navbar.html.erb b/app/views/application/_navbar.html.erb index f6520881d..1094edc65 100644 --- a/app/views/application/_navbar.html.erb +++ b/app/views/application/_navbar.html.erb @@ -10,11 +10,7 @@ - <% if current_user && current_organization %> - TimeOverflow - <% else %> TimeOverflow - <% end %>
@@ -41,7 +37,7 @@
-<% if current_user && current_organization %> +<% if current_user && @organization %> -<% end %> \ No newline at end of file +<% end %> diff --git a/app/views/application/menus/_inquiries_list_link.html.erb b/app/views/application/menus/_inquiries_list_link.html.erb index 3076be0aa..bbcbd07a0 100644 --- a/app/views/application/menus/_inquiries_list_link.html.erb +++ b/app/views/application/menus/_inquiries_list_link.html.erb @@ -1,5 +1,5 @@ -
  • "> - <%= link_to inquiries_path do %> +
  • "> + <%= link_to organization_inquiries_path(organization_id: @organization.id) do %> <%= glyph :inquiry %> <%= Inquiry.model_name.human(count: :many) %> <% end %> diff --git a/app/views/application/menus/_offers_dashboard_link.html.erb b/app/views/application/menus/_offers_dashboard_link.html.erb deleted file mode 100644 index 54d38e037..000000000 --- a/app/views/application/menus/_offers_dashboard_link.html.erb +++ /dev/null @@ -1,6 +0,0 @@ -
  • "> - <%= link_to dashboard_offers_path do %> - <%= glyph :offer %> - <%= Offer.model_name.human(count: :many) %> - <% end %> -
  • diff --git a/app/views/application/menus/_offers_list_link.html.erb b/app/views/application/menus/_offers_list_link.html.erb new file mode 100644 index 000000000..666012577 --- /dev/null +++ b/app/views/application/menus/_offers_list_link.html.erb @@ -0,0 +1,6 @@ +
  • "> + <%= link_to organization_offers_path(organization_id: @organization.id) do %> + <%= glyph :offer %> + <%= Offer.model_name.human(count: :many) %> + <% end %> +
  • diff --git a/app/views/application/menus/_organization_listings_menu.html.erb b/app/views/application/menus/_organization_listings_menu.html.erb index 6ea4ba67e..92fd16e0b 100644 --- a/app/views/application/menus/_organization_listings_menu.html.erb +++ b/app/views/application/menus/_organization_listings_menu.html.erb @@ -12,14 +12,14 @@ <% end %>
  • - <%= link_to offers_path(org: current_organization) do %> + <%= link_to organization_offers_path(organization_id: @organization.id) do %> <%= glyph :link %> <%= glyph :eye_open %> <%= t "application.navbar.offer_public_link" %> <% end %>
  • - <%= link_to inquiries_path(org: current_organization) do %> + <%= link_to organization_inquiries_path(organization_id: @organization.id) do %> <%= glyph :link %> <%= glyph :eye_open %> <%= t "application.navbar.inquiry_public_link" %> diff --git a/app/views/application/menus/_organization_switcher.html.erb b/app/views/application/menus/_organization_switcher.html.erb index 10d3ca099..2fd3b383f 100644 --- a/app/views/application/menus/_organization_switcher.html.erb +++ b/app/views/application/menus/_organization_switcher.html.erb @@ -1,10 +1,6 @@ -
  • - <%= current_organization.name %> -
  • -<% (current_user.organizations - [current_organization]).each do |org| %> +<% current_user.organizations.each do |org| %>
  • - <%= link_to set_current_organization_path(org), method: :post do %> - <%= glyph(:retweet) %> + <%= link_to organization_path(org) do %> <%= org.name %> <% end %>
  • diff --git a/app/views/application/menus/_user_admin_menu.html.erb b/app/views/application/menus/_user_admin_menu.html.erb index 58f394025..aff7e5947 100644 --- a/app/views/application/menus/_user_admin_menu.html.erb +++ b/app/views/application/menus/_user_admin_menu.html.erb @@ -25,18 +25,10 @@ <% end %>
  • - <%= link_to current_user do %> + <%= link_to organization_user_path(organization_id: @organization.id, id: current_user.id) do %> <%= glyph :user %> <%= t "layouts.application.edit_profile" %> <% end %>
  • - <% current_user.members.where(manager: true).each do |m| %> -
  • - <%= link_to m.organization do %> - <%= glyph :pencil %> - <%= t "layouts.application.edit_org", organization: m.organization %> - <% end %> -
  • - <% end %> diff --git a/app/views/application/menus/_user_list_link.html.erb b/app/views/application/menus/_user_list_link.html.erb index e3bf2c45e..47a020da9 100644 --- a/app/views/application/menus/_user_list_link.html.erb +++ b/app/views/application/menus/_user_list_link.html.erb @@ -1,5 +1,5 @@ -
  • "> - <%= link_to users_path do %> +
  • "> + <%= link_to organization_users_path(organization_id: @organization.id) do %> <%= glyph :user %> <%= User.model_name.human(count: :many) %> <% end %> diff --git a/app/views/inquiries/index.html.erb b/app/views/inquiries/index.html.erb index 4475ff71b..f2e93d75a 100644 --- a/app/views/inquiries/index.html.erb +++ b/app/views/inquiries/index.html.erb @@ -5,7 +5,7 @@
  • - <% if current_user && current_organization && !params[:org] %> + <% if current_user && @organization %> - <% if current_user && current_organization && !params[:org] %> + <% if current_user && @organization %> -<% if current_user %> +<% if current_user && current_user.member(@organization) %> <%= render "shared/movements" %> <% end %> diff --git a/app/views/shared/_post.html.erb b/app/views/shared/_post.html.erb index d9681bab7..95192d1ea 100644 --- a/app/views/shared/_post.html.erb +++ b/app/views/shared/_post.html.erb @@ -27,7 +27,7 @@ <% end %> - <% if current_user && current_organization %> + <% if current_user && @organization %>

    diff --git a/app/views/shared/_post_form.html.erb b/app/views/shared/_post_form.html.erb index 7717e54c2..fec63fe06 100644 --- a/app/views/shared/_post_form.html.erb +++ b/app/views/shared/_post_form.html.erb @@ -1,5 +1,5 @@ <%= show_error_messages! post %> -<%= form_for post, html: { name: "form", novalidate: true } do |f| %> +<%= form_for [@organization, post], html: { name: "form", novalidate: true } do |f| %>
    <%= f.label :title, required: true %> <%= f.text_field :title, class: "form-control" %> @@ -34,12 +34,12 @@ id: "tags-js", class: "form-control" %>
    - <% if current_user.manages?(current_organization) %> + <% if current_user.manages?(@organization) %>
    <%= f.label :user, class: "control-label" %> <%# TODO: too complex %> <%= f.select :user_id, - options_for_select(current_organization.members.active + options_for_select(@organization.members.active .order("members.member_uid") .map { |mem| ["#{mem.member_uid} #{mem.user.to_s}", mem.user_id] }, selected: post.user.id || current_user.id), diff --git a/app/views/shared/_posts.html.erb b/app/views/shared/_posts.html.erb index 6c1633273..465f7fec5 100644 --- a/app/views/shared/_posts.html.erb +++ b/app/views/shared/_posts.html.erb @@ -1,7 +1,7 @@ <% posts.each do |post| %>

    - <%= link_to post.title, post %> + <%= link_to post.title, polymorphic_url([@organization, post]) %>

    <%= strip_tags(post.rendered_description.to_html) %> @@ -16,7 +16,7 @@ <% end %> <% (post.tags || []).each do |tag| %> <%= glyph :tag %> - <%= link_to tag, get_index_path(post,tag: tag) %> + <%= link_to tag, get_index_path(post, tag: tag) %> <% end %> <% if post.type == "Inquiry" %> diff --git a/app/views/users/_user_rows.html.erb b/app/views/users/_user_rows.html.erb index 0f7ada7b8..9f82aabfd 100644 --- a/app/views/users/_user_rows.html.erb +++ b/app/views/users/_user_rows.html.erb @@ -19,7 +19,7 @@ {{user.phone}} {{user.alt_phone}} {{user.balance | timeBalance}} - <% if current_user.manages?(current_organization) %> + <% if current_user.manages?(@organization) %> <%= glyph :pencil %> diff --git a/app/views/users/give_time.html.erb b/app/views/users/give_time.html.erb index 2b5b143df..c7825f083 100644 --- a/app/views/users/give_time.html.erb +++ b/app/views/users/give_time.html.erb @@ -2,7 +2,7 @@ <%= t ".give_time" %> - <%= link_to @user.member(current_organization).display_name_with_uid, user_path(@user) %> + <%= link_to @user.member(@organization).display_name_with_uid, user_path(@user) %>

    <% if @offer %>

    @@ -38,7 +38,7 @@ options_for_select( @sources.sort_by { |source| [source.accountable_type, source.accountable.try(:member_uid)] } .map { |a| ["#{a.accountable_type == "Member" ? a.accountable.member_uid : ""} #{a.accountable_type} #{a.accountable.to_s}", a.id] }, - selected: current_user.member(current_organization).account.id + selected: current_user.member(@organization).account.id ), {}, id: "select2-time", @@ -49,7 +49,7 @@ <%= f.input :post, readonly: true %> <%= f.input :post_id, as: :hidden %> <% else %> - <%= f.input :post_id, collection: @user.member(current_organization).offers.active %> + <%= f.input :post_id, collection: @user.member(@organization).offers.active %> <% end %>

    diff --git a/app/views/users/index.html.erb b/app/views/users/index.html.erb index 546e630fa..7ffa460d0 100644 --- a/app/views/users/index.html.erb +++ b/app/views/users/index.html.erb @@ -2,8 +2,8 @@

    <%= User.model_name.human.pluralize %> — - <%= link_to current_organization.name, - organization_path(current_organization) %> + <%= link_to @organization.name, + organization_path(@organization) %> <% if params[:q].present? %> <%= glyph :search %> @@ -21,7 +21,7 @@