d1d71f0044
We were adding the condition to show the form in the view. However, that doesn't prevent users from sending a POST/PUT request to the controller action. We could add the condition to the controller as well, but since the `valuate` permission is only used in one place, it's easier to restrict that permission to valuators who can edit the dossier.
23 lines
640 B
Ruby
23 lines
640 B
Ruby
module Abilities
|
|
class Valuator
|
|
include CanCan::Ability
|
|
|
|
def initialize(user)
|
|
valuator = user.valuator
|
|
assigned_investment_ids = valuator.assigned_investment_ids
|
|
|
|
can [:read], Budget::Investment, id: assigned_investment_ids
|
|
|
|
if valuator.can_edit_dossier?
|
|
can [:valuate], Budget::Investment, { id: assigned_investment_ids, valuation_finished: false }
|
|
end
|
|
|
|
if valuator.can_comment?
|
|
can [:comment_valuation], Budget::Investment, id: assigned_investment_ids
|
|
end
|
|
|
|
cannot [:valuate, :comment_valuation], Budget::Investment, budget: { phase: "finished" }
|
|
end
|
|
end
|
|
end
|