diff --git a/app/controllers/schools_controller.rb b/app/controllers/schools_controller.rb index b47a693..54697a3 100644 --- a/app/controllers/schools_controller.rb +++ b/app/controllers/schools_controller.rb @@ -1,6 +1,7 @@ class SchoolsController < ApplicationController before_action :set_school, only: [:show, :edit, :update, :destroy] - before_filter :check_access, only: [:new,:create,:update,:destroy,:edit] + before_filter :check_access_director, only: [:new,:create,:destroy] + before_filter :check_access_delegate, only: [:update,:edit] # GET /schools/1 @@ -76,15 +77,21 @@ class SchoolsController < ApplicationController params.require(:school).permit(:name, :score, :tournament_id) end - def check_access + def check_access_director if params[:tournament] @tournament = Tournament.find(params[:tournament]) elsif params[:school] @tournament = Tournament.find(params[:school]["tournament_id"]) elsif @school @tournament = @school.tournament + elsif school_params + @tournament = Tournament.find(school_params[:tournament_id]) end authorize! :manage, @tournament end + + def check_access_delegate + authorize! :manage, @school + end end diff --git a/app/controllers/wrestlers_controller.rb b/app/controllers/wrestlers_controller.rb index a76783f..ae055f5 100644 --- a/app/controllers/wrestlers_controller.rb +++ b/app/controllers/wrestlers_controller.rb @@ -92,13 +92,16 @@ class WrestlersController < ApplicationController def check_access if params[:school] @school = School.find(params[:school]) - @tournament = Tournament.find(@school.tournament.id) + #@tournament = Tournament.find(@school.tournament.id) elsif params[:wrestler] @school = School.find(params[:wrestler]["school_id"]) - @tournament = Tournament.find(@school.tournament.id) + #@tournament = Tournament.find(@school.tournament.id) elsif @wrestler - @tournament = @wrestler.tournament + @school = @wrestler.school + #@tournament = @wrestler.tournament + elsif wrestler_params + @school = School.find(wrestler_params[:school_id]) end - authorize! :manage, @tournament + authorize! :manage, @school end end diff --git a/app/models/ability.rb b/app/models/ability.rb index a6a5983..57e7a74 100644 --- a/app/models/ability.rb +++ b/app/models/ability.rb @@ -40,7 +40,7 @@ class Ability end #Can manage school if tournament owner can :manage, School do |school| - school.tournament.map(&:user_id).include? user.id + school.tournament.user.id == user.id end #Can manage school if tournament delegate can :manage, School do |school| diff --git a/app/views/schools/show.html.erb b/app/views/schools/show.html.erb index a1fc7c3..5fff49f 100644 --- a/app/views/schools/show.html.erb +++ b/app/views/schools/show.html.erb @@ -1,7 +1,7 @@
<%= notice %>
<%= link_to "Back to #{@tournament.name}", "/tournaments/#{@tournament.id}",:class=>"btn btn-default" %> - <% if can? :manage, @tournament %> + <% if can? :manage, @school %> | <%= link_to "Edit #{@school.name}", edit_school_path(@school),:class=>"btn btn-primary" %> <% end %> @@ -27,7 +27,7 @@<%= notice %>
<%= link_to "Back to #{@school.name}", "/schools/#{@school.id}", :class=>"btn btn-default" %> - <% if can? :manage, @tournament %> + <% if can? :manage, @school %> | <%= link_to "Edit #{@wrestler.name}", edit_wrestler_path(@wrestler), :class=>"btn btn-primary" %> <% end %> <% cache ["wrestlers", @wrestler] do %> diff --git a/test/controllers/schools_controller_test.rb b/test/controllers/schools_controller_test.rb index 8421c6a..f788822 100644 --- a/test/controllers/schools_controller_test.rb +++ b/test/controllers/schools_controller_test.rb @@ -40,6 +40,10 @@ class SchoolsControllerTest < ActionController::TestCase def sign_in_tournament_delegate sign_in users(:three) end + + def sign_in_school_delegate + sign_in users(:four) + end def success assert_response :success @@ -60,6 +64,12 @@ class SchoolsControllerTest < ActionController::TestCase get_edit success end + + test "logged in school delegate should get edit school page" do + sign_in_school_delegate + get_edit + success + end test "logged in user should not get edit school page if not owner" do sign_in_non_owner @@ -94,6 +104,12 @@ class SchoolsControllerTest < ActionController::TestCase post_update assert_redirected_to tournament_path(@school.tournament_id) end + + test "logged in school delegate should post update school" do + sign_in_school_delegate + post_update + assert_redirected_to tournament_path(@school.tournament_id) + end test "logged in tournament owner can create a new school" do sign_in_owner @@ -110,6 +126,14 @@ class SchoolsControllerTest < ActionController::TestCase create assert_redirected_to tournament_path(@school.tournament_id) end + + test "logged in school delegate cannot create a new school" do + sign_in_school_delegate + new + redirect + create + redirect + end test "logged in user not tournament owner cannot create a school" do sign_in_non_owner @@ -130,6 +154,12 @@ class SchoolsControllerTest < ActionController::TestCase destroy assert_redirected_to tournament_path(@tournament.id) end + + test "logged in school delegate can destroy a school" do + sign_in_school_delegate + destroy + redirect + end test "logged in user not tournament owner cannot destroy school" do sign_in_non_owner diff --git a/test/controllers/wrestlers_controller_test.rb b/test/controllers/wrestlers_controller_test.rb index c3c3fa9..9ef496f 100644 --- a/test/controllers/wrestlers_controller_test.rb +++ b/test/controllers/wrestlers_controller_test.rb @@ -41,6 +41,10 @@ class WrestlersControllerTest < ActionController::TestCase def sign_in_tournament_delegate sign_in users(:three) end + + def sign_in_school_delegate + sign_in users(:four) + end def success assert_response :success @@ -61,6 +65,12 @@ class WrestlersControllerTest < ActionController::TestCase get_edit success end + + test "logged in school delegate should get edit wrestler page" do + sign_in_school_delegate + get_edit + success + end test "logged in user should not get edit wrestler page if not owner" do sign_in_non_owner @@ -95,6 +105,12 @@ class WrestlersControllerTest < ActionController::TestCase post_update assert_redirected_to school_path(@school.id) end + + test "logged in school delegate should post update wrestler" do + sign_in_school_delegate + post_update + assert_redirected_to school_path(@school.id) + end test "logged in tournament owner can create a new wrestler" do sign_in_owner @@ -111,6 +127,14 @@ class WrestlersControllerTest < ActionController::TestCase create assert_redirected_to school_path(@school.id) end + + test "logged in school delegate can create a new wrestler" do + sign_in_school_delegate + new + success + create + assert_redirected_to school_path(@school.id) + end test "logged in user not tournament owner cannot create a wrestler" do sign_in_non_owner @@ -131,6 +155,12 @@ class WrestlersControllerTest < ActionController::TestCase destroy assert_redirected_to school_path(@school.id) end + + test "logged in school delegate can destroy a wrestler" do + sign_in_school_delegate + destroy + assert_redirected_to school_path(@school.id) + end test "logged in user not tournament owner cannot destroy wrestler" do sign_in_non_owner diff --git a/test/fixtures/school_delegates.yml b/test/fixtures/school_delegates.yml index 143b056..9b2dc94 100644 --- a/test/fixtures/school_delegates.yml +++ b/test/fixtures/school_delegates.yml @@ -7,3 +7,7 @@ # two: # user_id: 1 # school_id: 1 + +one: + user_id: 4 + school_id: 1 \ No newline at end of file diff --git a/test/fixtures/users.yml b/test/fixtures/users.yml index 6d8325a..da16999 100644 --- a/test/fixtures/users.yml +++ b/test/fixtures/users.yml @@ -19,3 +19,7 @@ two: three: email: test3@test.com id: 3 + +four: + email: test4@test.com + id: 4