roadmap/app/policies/template_policy.rb at 706f0f60e7e662e85840681055dd143bdca8159d · DMPRoadmap/roadmap · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
# frozen_string_literal: true

# Security rules for templates
# Note the method names here correspond with controller actions
class TemplatePolicy < ApplicationPolicy
  # NOTE: @user is the signed_in_user and @record is an instance of Template

  def index?
    @user.can_super_admin?
  end

  def organisational?
    @user.can_modify_templates?
  end

  def customisable?
    @user.can_modify_templates?
  end

  def new?
    @user.can_super_admin? || @user.can_modify_templates?
  end

  def create?
    @user.can_super_admin? || @user.can_modify_templates?
  end

  def show?
    @user.can_super_admin? || (@user.can_modify_templates? && @record.org_id == @user.org_id)
  end

  def edit?
    @user.can_super_admin? || (@user.can_modify_templates? && @record.org_id == @user.org_id)
  end

  def update?
    @user.can_super_admin? || (@user.can_modify_templates? && @record.org_id == @user.org_id)
  end

  def destroy?
    @user.can_super_admin? || (@user.can_modify_templates? && (@record.org_id == @user.org_id))
  end

  def history?
    @user.can_super_admin? || (@user.can_modify_templates? && @record.org_id == @user.org_id)
  end

  def customize?
    @user.can_super_admin? || @user.can_modify_templates?
  end

  def transfer_customization?
    @user.can_super_admin? || @user.can_modify_templates?
  end

  def template_export?
    @user.can_super_admin? || (@user.can_modify_templates?  &&  (@record.org_id == @user.org_id))
  end

  # AJAX Calls
  def copy?
    @user.can_super_admin? || (@user.can_modify_templates?  &&  (@record.org_id == @user.org_id))
  end

  def publish?
    @user.can_super_admin? || (@user.can_modify_templates?  &&  (@record.org_id == @user.org_id))
  end

  def unpublish?
    @user.can_super_admin? || (@user.can_modify_templates?  &&  (@record.org_id == @user.org_id))
  end

  ##
  # Users can modify templates if:
  #  - They can modify templates
  #  - The template which they are modifying belongs to their org
  ##

  # Anyone with an account should be able to get templates for the specified research_org + funder
  # This policy is applicable to the Create Plan page
  def template_options?
    @user.present?
  end
end