Allow managers to read investment suggestions
When creating a budget investment with an unverified manager (for example, a manager who isn't part of the local census), there's a request to `Budgets::InvestmentsController#suggest`. Since the manager isn't verified, suggestions can't be obtained. There are serveral ways to fix this problem: * Add a `suggest` action to Management::Budgets::InvestmentsController, doing the same thing the main `suggest` action does. * Give unverified users permission to access investment suggestions * Give managers permission to access investment suggestions I've chosen the last one because I thought it was simple and only changed existing behaviour for managers, but any other solution would be as valid. I haven't added the `phase: "accepting"` condition to keep it simple, since a read-only action like this one in the management portal isn't gonna create security risks.
This commit is contained in:
11
app/models/abilities/manager.rb
Normal file
11
app/models/abilities/manager.rb
Normal file
@@ -0,0 +1,11 @@
|
||||
module Abilities
|
||||
class Manager
|
||||
include CanCan::Ability
|
||||
|
||||
def initialize(user)
|
||||
merge Abilities::Common.new(user)
|
||||
|
||||
can :suggest, Budget::Investment
|
||||
end
|
||||
end
|
||||
end
|
||||
@@ -14,6 +14,8 @@ class Ability
|
||||
merge Abilities::Administrator.new(user)
|
||||
elsif user.moderator?
|
||||
merge Abilities::Moderator.new(user)
|
||||
elsif user.manager?
|
||||
merge Abilities::Manager.new(user)
|
||||
else
|
||||
merge Abilities::Common.new(user)
|
||||
end
|
||||
|
||||
Reference in New Issue
Block a user