53670602e0
When creating a budget investment with an unverified manager (for example, a manager who isn't part of the local census), there's a request to `Budgets::InvestmentsController#suggest`. Since the manager isn't verified, suggestions can't be obtained. There are serveral ways to fix this problem: * Add a `suggest` action to Management::Budgets::InvestmentsController, doing the same thing the main `suggest` action does. * Give unverified users permission to access investment suggestions * Give managers permission to access investment suggestions I've chosen the last one because I thought it was simple and only changed existing behaviour for managers, but any other solution would be as valid. I haven't added the `phase: "accepting"` condition to keep it simple, since a read-only action like this one in the management portal isn't gonna create security risks.
28 lines
712 B
Ruby
28 lines
712 B
Ruby
class Ability
|
|
include CanCan::Ability
|
|
|
|
def initialize(user)
|
|
# If someone can hide something, he can also hide it
|
|
# from the moderation screen
|
|
alias_action :hide_in_moderation_screen, to: :hide
|
|
|
|
if user # logged-in users
|
|
merge Abilities::Valuator.new(user) if user.valuator?
|
|
merge Abilities::Tracker.new(user) if user.tracker?
|
|
|
|
if user.administrator?
|
|
merge Abilities::Administrator.new(user)
|
|
elsif user.moderator?
|
|
merge Abilities::Moderator.new(user)
|
|
elsif user.manager?
|
|
merge Abilities::Manager.new(user)
|
|
else
|
|
merge Abilities::Common.new(user)
|
|
end
|
|
else
|
|
merge Abilities::Everyone.new(user)
|
|
end
|
|
end
|
|
|
|
end
|