Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

AO3-6141 Disable user role checkboxes based on admin permissions #4355

Merged
merged 6 commits into from
Jun 19, 2023
Merged

AO3-6141 Disable user role checkboxes based on admin permissions #4355

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
b097ee7
AO3 6141 disable user role checkboxes
Cesium-Ice Sep 28, 2022
e80ca40
please hound
Cesium-Ice Sep 28, 2022
257d5b9
move logic to userpolicy class
Cesium-Ice Dec 7, 2022
5d40fbc
please hound
Cesium-Ice Dec 7, 2022
878f520
use hash for checking that admin role can edit user role
Cesium-Ice Dec 13, 2022
d4860b2
please hound
Cesium-Ice Dec 13, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions app/policies/user_policy.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,14 @@ class UserPolicy < ApplicationPolicy
"tag_wrangling" => [roles: []]
}.freeze

# Define which admin roles can edit which user roles.
ALLOWED_USER_ROLES_BY_ADMIN_ROLES = {
"open_doors" => %w[archivist opendoors],
"policy_and_abuse" => %w[no_resets protected_user],
"superadmin" => %w[archivist no_resets official opendoors protected_user tag_wrangler],
"tag_wrangling" => %w[tag_wrangler]
}.freeze

def can_manage_users?
user_has_roles?(MANAGE_ROLES)
end
Expand All @@ -33,6 +41,10 @@ def permitted_attributes
ALLOWED_ATTRIBUTES_BY_ROLES.values_at(*user.roles).compact.flatten
end

def can_edit_user_role?(role)
ALLOWED_USER_ROLES_BY_ADMIN_ROLES.values_at(*user.roles).compact.flatten.include?(role.name)
end

alias index? can_manage_users?
alias bulk_search? can_manage_users?
alias show? can_manage_users?
Expand Down
2 changes: 1 addition & 1 deletion app/views/admin/admin_users/_user_form.html.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@
<td><%= text_field_tag "user[email]", user.email, title: ts("Email"), disabled: !admin_can_update_user_email? %></td>
<% for role in @roles %>
<td>
<%= check_box_tag "user[roles][]", role.id, user.roles.include?(role), title: role.name, id: "user_roles_#{role.id}", disabled: !admin_can_update_user_roles? %>
<%= check_box_tag "user[roles][]", role.id, user.roles.include?(role), title: role.name, id: "user_roles_#{role.id}", disabled: !policy(User).can_edit_user_role?(role) %>
</td>
<% end %>
<td>
Expand Down