Merge pull request #116 from AyuntamientoMadrid/admin-77

Administrator and Moderator basic interface

app/controllers/account_controller.rb

@@ -2,6 +2,7 @@ class AccountController < ApplicationController
 
   before_action :authenticate_user!
   before_action :set_account
+  load_and_authorize_resource class: "User"
 
   def show
   end

app/controllers/admin/base_controller.rb

@@ -0,0 +1,13 @@
+class Admin::BaseController < ApplicationController
+  before_action :authenticate_user!
+
+  skip_authorization_check
+  before_action :verify_administrator
+
+  private
+
+    def verify_administrator
+      raise CanCan::AccessDenied unless current_user.try(:administrator?)
+    end
+
+end

app/controllers/admin/dashboard_controller.rb

@@ -0,0 +1,6 @@
+class Admin::DashboardController < Admin::BaseController
+
+  def index
+  end
+
+end

app/controllers/application_controller.rb

@@ -1,6 +1,9 @@
 require "application_responder"
 
 class ApplicationController < ActionController::Base
+
+  check_authorization unless: :devise_controller?
+
   self.responder = ApplicationResponder
   respond_to :html
 
@@ -11,6 +14,10 @@ class ApplicationController < ActionController::Base
   # For APIs, you may want to use :null_session instead.
   protect_from_forgery with: :exception
 
+  rescue_from CanCan::AccessDenied do |exception|
+    redirect_to main_app.root_url, alert: exception.message
+  end
+
   private
 
   def set_locale

app/controllers/comments_controller.rb

@@ -1,12 +1,12 @@
 class CommentsController < ApplicationController
   before_action :authenticate_user!
-  before_action :set_debate, :set_parent, only: :create
+  before_action :build_comment, only: :create
+  load_and_authorize_resource
   respond_to :html, :js
 
   def create
-    @comment = Comment.build(@debate, current_user, params[:comment][:body])
     @comment.save!
-    @comment.move_to_child_of(@parent) if reply?
+    @comment.move_to_child_of(parent) if reply?
 
     Mailer.comment(@comment).deliver_now if email_on_debate_comment?
     Mailer.reply(@comment).deliver_now if email_on_comment_reply?
@@ -15,7 +15,6 @@ class CommentsController < ApplicationController
   end
 
   def vote
-    @comment = Comment.find(params[:id])
     @comment.vote_by(voter: current_user, vote: params[:value])
     respond_with @comment
   end
@@ -25,16 +24,20 @@ class CommentsController < ApplicationController
       params.require(:comments).permit(:commentable_type, :commentable_id, :body)
     end
 
-    def set_debate
-      @debate = Debate.find(params[:debate_id])
+    def build_comment
+      @comment = Comment.build(debate, current_user, params[:comment][:body])
     end
 
-    def set_parent
-      @parent = Comment.find_parent(params[:comment])
+    def debate
+      @debate ||= Debate.find(params[:debate_id])
+    end
+
+    def parent
+      @parent ||= Comment.find_parent(params[:comment])
     end
 
     def reply?
-      @parent.class == Comment
+      parent.class == Comment
     end
 
     def email_on_debate_comment?
@@ -42,6 +45,6 @@ class CommentsController < ApplicationController
     end
 
     def email_on_comment_reply?
-      reply? && @parent.author.email_on_comment_reply?
+      reply? && parent.author.email_on_comment_reply?
     end
-end
+end

app/controllers/debates_controller.rb

@@ -1,8 +1,7 @@
 class DebatesController < ApplicationController
   include RecaptchaHelper
-  before_action :set_debate, only: [:show, :edit, :update, :vote]
   before_action :authenticate_user!, except: [:index, :show]
-  before_action :validate_ownership, only: [:edit, :update]
+  load_and_authorize_resource
 
   def index
     if params[:tag]
@@ -56,10 +55,6 @@ class DebatesController < ApplicationController
       params.require(:debate).permit(:title, :description, :tag_list, :terms_of_service)
     end
 
-    def validate_ownership
-      raise ActiveRecord::RecordNotFound unless @debate.editable_by?(current_user)
-    end
-
     def set_voted_values(debates_ids)
       @voted_values = current_user ? current_user.votes_on_debates(debates_ids) : {}
     end

app/controllers/moderation/base_controller.rb

@@ -0,0 +1,13 @@
+class Moderation::BaseController < ApplicationController
+  before_action :authenticate_user!
+
+  skip_authorization_check
+  before_action :verify_moderator
+
+  private
+
+    def verify_moderator
+      raise CanCan::AccessDenied unless current_user.try(:moderator?) || current_user.try(:administrator?)
+    end
+
+end

app/controllers/moderation/dashboard_controller.rb

@@ -0,0 +1,6 @@
+class Moderation::DashboardController < Moderation::BaseController
+
+  def index
+  end
+
+end