cody/wrestlingdev.com
1
0
Fork 0
mirror of https://github.com/jcwimer/wrestlingApp synced 2026-03-25 01:14:43 +00:00
Code Issues Releases Wiki Activity

Fixed a bug where logged in users could not access a school with a school permission key

Browse Source
This commit is contained in:
Jacob Cody Wimer
2026-01-06 17:24:45 -05:00
parent 9ca6572d9b
commit 6b5308360e
2 changed files with 31 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
app/models/ability.rb
View File

@@ -1,6 +1,20 @@
class Ability class Ability
include CanCan::Ability include CanCan::Ability
def school_permission_key_check(school_permission_key)
# Can read school if tournament is public or a valid school permission key is provided
can :read, School do |school|
school.tournament.is_public ||
(school_permission_key.present? && school.permission_key == school_permission_key)
end
# Can manage school if a valid school permission key is provided
# school_permission_key comes from app/controllers/application_controller.rb
can :manage, School do |school|
(school_permission_key.present? && school.permission_key == school_permission_key)
end
end
def initialize(user, school_permission_key = nil) def initialize(user, school_permission_key = nil)
if user if user
# LOGGED IN USER PERMISSIONS # LOGGED IN USER PERMISSIONS
@@ -46,6 +60,8 @@ class Ability
school.tournament.delegates.map(&:user_id).include?(user.id) || school.tournament.delegates.map(&:user_id).include?(user.id) ||
school.tournament.user_id == user.id school.tournament.user_id == user.id
end end
school_permission_key_check(school_permission_key)
else else
# NON LOGGED IN USER PERMISSIONS # NON LOGGED IN USER PERMISSIONS
@@ -58,18 +74,7 @@ class Ability
# SCHOOL PERMISSIONS # SCHOOL PERMISSIONS
# wrestler permissions are included with school permissions # wrestler permissions are included with school permissions
school_permission_key_check(school_permission_key)
# Can read school if tournament is public or a valid school permission key is provided
can :read, School do |school|
school.tournament.is_public ||
(school_permission_key.present? && school.permission_key == school_permission_key)
end
# Can read school if a valid school permission key is provided
# school_permission_key comes from app/controllers/application_controller.rb
can :manage, School do |school|
(school_permission_key.present? && school.permission_key == school_permission_key)
end
end end
end end
end end

14
test/controllers/schools_controller_test.rb
View File

@@ -373,12 +373,26 @@ Some Guy
success success
end end
test "logged in user without delegation can get show page when using valid school_permission_key" do
sign_in_non_owner
@tournament.update(is_public: false)
get_show(school_permission_key: @school_permission_key)
success
end
test "non logged in user cannot get show page when using invalid school_permission_key" do test "non logged in user cannot get show page when using invalid school_permission_key" do
@tournament.update(is_public: false) @tournament.update(is_public: false)
get_show(school_permission_key: "invalid-key") get_show(school_permission_key: "invalid-key")
redirect redirect
end end
test "logged in user without delegation can edit school with valid school_permission_key" do
sign_in_non_owner
@tournament.update(is_public: false)
get_edit(school_permission_key: @school_permission_key)
success
end
test "non logged in user can edit school with valid school_permission_key" do test "non logged in user can edit school with valid school_permission_key" do
@tournament.update(is_public: false) @tournament.update(is_public: false)
get_edit(school_permission_key: @school_permission_key) get_edit(school_permission_key: @school_permission_key)