decidim-admin 0.11.2 → 0.12.0.pre

data/app/permissions/decidim/admin/user_manager_permissions.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+module Decidim
+  module Admin
+    class UserManagerPermissions < Decidim::DefaultPermissions
+      def permissions
+        return permission_action unless user_manager? || user.admin?
+        allow! if read_admin_dashboard_action?
+
+        allow! if managed_user_action?
+        allow! if user_action?
+
+        permission_action
+      end
+
+      private
+
+      def user_manager?
+        user && !user.admin? && user.role?("user_manager")
+      end
+
+      def read_admin_dashboard_action?
+        permission_action.subject == :admin_dashboard &&
+          permission_action.action == :read
+      end
+
+      def managed_user_action?
+        return unless permission_action.subject == :managed_user
+
+        case permission_action.action
+        when :create
+          !organization.available_authorizations.empty?
+        else
+          true
+        end
+      end
+
+      def user_action?
+        return unless [:user, :impersonatable_user].include?(permission_action.subject)
+        subject_user = context.fetch(:user, nil)
+
+        case permission_action.action
+        when :promote
+          subject_user.managed? && Decidim::ImpersonationLog.active.where(admin: user).empty?
+        when :impersonate
+          available_authorization_handlers? &&
+            !subject_user.admin? &&
+            subject_user.roles.empty? &&
+            Decidim::ImpersonationLog.active.where(admin: user).empty?
+        when :destroy
+          subject_user != user
+        else
+          true
+        end
+      end
+
+      def organization
+        @organization ||= context.fetch(:organization, nil) || context.fetch(:current_organization, nil)
+      end
+
+      def available_authorization_handlers?
+        user.organization.available_authorization_handlers.any?
+      end
+    end
+  end
+end

data/app/views/decidim/admin/area_types/index.html.erb

@@ -1,6 +1,11 @@
 <div class="card" id="area-types">
   <div class="card-divider">
-    <h2 class="card-title"><%= t "decidim.admin.titles.area_types" %> <%= link_to t("actions.add", scope: "decidim.admin"), ["new", "area_type"], class: "button tiny button--title new" %></h2>
+    <h2 class="card-title">
+      <%= t "decidim.admin.titles.area_types" %>
+      <% if allowed_to? :create, :area_type %>
+        <%= link_to t("actions.add", scope: "decidim.admin"), ["new", "area_type"], class: "button tiny button--title new" %>
+      <% end %>
+    </h2>
   </div>
   <div class="card-section">
     <div class="table-scroll">
@@ -22,12 +27,11 @@
                 <%= translated_attribute(area_type.plural) %>
               </td>
               <td class="table-list__actions">
-
-                <% if can? :update, area_type %>
+                <% if allowed_to? :update, :area_type, area_type: area_type %>
                   <%= icon_link_to "pencil", ["edit", area_type], t("actions.edit", scope: "decidim.admin"), class: "action-icon--edit", method: :get, data: {} %>
                 <% end %>
 
-                <% if can? :destroy, area_type %>
+                <% if allowed_to? :destroy, :area_type, area_type: area_type %>
                   <%= icon_link_to "circle-x", area_type, t("actions.destroy", scope: "decidim.admin"), class: "action-icon--remove", method: :delete, data: { confirm: t("actions.confirm_destroy", scope: "decidim.admin") } %>
                 <% end %>
               </td>

data/app/views/decidim/admin/areas/index.html.erb

@@ -1,7 +1,10 @@
 <div class="card" id="areas">
   <div class="card-divider">
     <h2 class="card-title">
-      <%= t "decidim.admin.titles.areas" %> <%= link_to t("actions.add", scope: "decidim.admin"), new_area_path, class: "button tiny button--title new" %>
+      <%= t "decidim.admin.titles.areas" %>
+      <% if allowed_to? :create, :area %>
+        <%= link_to t("actions.add", scope: "decidim.admin"), new_area_path, class: "button tiny button--title new" %>
+      <% end %>
     </h2>
   </div>
   <div class="card-section">
@@ -25,11 +28,11 @@
                 <%= area.area_type ? translated_attribute(area.area_type.name) : "-" %>
               </td>
               <td class="table-list__actions">
-                <% if can? :update, area %>
+                <% if allowed_to? :update, :area, area: area %>
                   <%= icon_link_to "pencil", ["edit", area], t("actions.edit", scope: "decidim.admin"), class: "action-icon--edit", method: :get, data: {} %>
                 <% end %>
 
-                <% if can? :destroy, area %>
+                <% if allowed_to? :destroy, :area, area: area %>
                   <%= icon_link_to "circle-x", area, t("actions.destroy", scope: "decidim.admin"), class: "action-icon--remove", method: :delete, data: { confirm: t("actions.confirm_destroy", scope: "decidim.admin") } %>
                 <% end %>
               </td>

data/app/views/decidim/admin/attachment_collections/index.html.erb

@@ -2,7 +2,7 @@
   <div class="card-divider">
     <h2 class='card-title'>
       <%= t("attachment_collections.index.attachment_collections_title", scope: "decidim.admin") %>
-      <% if can? :create, Decidim::AttachmentCollection %>
+      <% if allowed_to? :create, :attachment_collection %>
         <%= link_to t("actions.new", scope: "decidim.admin", name: t("models.attachment_collection.name", scope: "decidim.admin")), url_for(action: :new), class: "button tiny button--title new" %>
       <% end %>
     </h2>
@@ -25,11 +25,11 @@
                   <%= link_to translated_attribute(attachment_collection.name), edit_polymorphic_path([collection_for, attachment_collection]) %><br />
                 </td>
                 <td class="table-list__actions">
-                  <% if can? :update, attachment_collection %>
+                  <% if allowed_to? :update, :attachment_collection, attachment_collection: attachment_collection %>
                     <%= icon_link_to "pencil", edit_polymorphic_path([collection_for, attachment_collection]), t("actions.edit", scope: "decidim.admin"), class: "action-icon--edit" %>
                   <% end %>
 
-                  <% if can? :destroy, attachment_collection %>
+                  <% if allowed_to? :destroy, :attachment_collection, attachment_collection: attachment_collection %>
                     <% if attachment_collection.unused? %>
                       <%= icon_link_to "circle-x", polymorphic_path([collection_for, attachment_collection]), t("actions.destroy", scope: "decidim.admin"), class: "action-icon--remove", method: :delete, data: { confirm: t("actions.confirm_destroy", scope: "decidim.admin") } %>
                     <% else %>

data/app/views/decidim/admin/attachment_collections/show.html.erb

@@ -2,8 +2,8 @@
 
 <div class="actions">
   <hr />
-  <%= link_to t("decidim.admin.actions.edit"), ["edit", @attachment_collection.collection_for, @attachment_collection], class: "button" if can? :update, @attachment_collection %>
-  <%= link_to t("decidim.admin.actions.destroy"), [@attachment_collection.collection_for, @attachment_collection], method: :delete, class: "alert button", data: { confirm: t("decidim.admin.actions.confirm_destroy") } if can? :destroy, @attachment_collection %>
+  <%= link_to t("decidim.admin.actions.edit"), ["edit", @attachment_collection.collection_for, @attachment_collection], class: "button" if allowed_to? :update, :attachment_collection, attachment_collection: @attachment_collection %>
+  <%= link_to t("decidim.admin.actions.destroy"), [@attachment_collection.collection_for, @attachment_collection], method: :delete, class: "alert button", data: { confirm: t("decidim.admin.actions.confirm_destroy") } if allowed_to? :destroy, :attachment_collection, attachment_collection: @attachment_collection %>
 </div>
 
 <dl>

data/app/views/decidim/admin/attachments/index.html.erb

@@ -2,7 +2,7 @@
   <div class="card-divider">
     <h2 class="card-title">
       <%= t(".attachments_title") %>
-      <% if can? :create, authorization_object %>
+      <% if allowed_to? :create, :attachment %>
         <%= link_to t("actions.new", scope: "decidim.admin", name: t("models.attachment.name", scope: "decidim.admin")), url_for(action: :new), class: "button tiny button--title new" %>
       <% end %>
     </h2>
@@ -37,11 +37,11 @@
                   <%= number_to_human_size(attachment.file_size) %>
                 </td>
                 <td class="table-list__actions">
-                  <% if can? :update, authorization_object %>
+                  <% if allowed_to? :update, :attachment, attachment: attachment %>
                     <%= icon_link_to "pencil", edit_polymorphic_path([attached_to, attachment]), t("actions.edit", scope: "decidim.admin"), class: "action-icon--edit" %>
                   <% end %>
 
-                  <% if can? :destroy, authorization_object %>
+                  <% if allowed_to? :destroy, :attachment, attachment: attachment %>
                     <%= icon_link_to "circle-x", polymorphic_path([attached_to, attachment]), t("actions.destroy", scope: "decidim.admin"), class: "action-icon--remove", method: :delete, data: { confirm: t("actions.confirm_destroy", scope: "decidim.admin") } %>
                   <% end %>
                 </td>

data/app/views/decidim/admin/attachments/show.html.erb

@@ -2,8 +2,8 @@
 
 <div class="actions">
   <hr />
-  <%= link_to t("decidim.admin.actions.edit"), ["edit", @attachment.attached_to, @attachment] if can? :update, @attachment %>
-  <%= link_to t("decidim.admin.actions.destroy"), [@attachment.attached_to, @attachment], method: :delete, class: "alert button", data: { confirm: t("decidim.admin.actions.confirm_destroy") } if can? :destroy, @attachment %>
+  <%= link_to t("decidim.admin.actions.edit"), ["edit", @attachment.attached_to, @attachment] if allowed_to? :update, :attachment, attachment: @attachment %>
+  <%= link_to t("decidim.admin.actions.destroy"), [@attachment.attached_to, @attachment], method: :delete, class: "alert button", data: { confirm: t("decidim.admin.actions.confirm_destroy") } if allowed_to? :destroy, :attachment, attachment: @attachment %>
 </div>
 
 <dl>

data/app/views/decidim/admin/categories/index.html.erb

@@ -2,7 +2,7 @@
   <div class="card-divider">
     <h2 class='card-title'>
       <%= t("categories.index.categories_title", scope: "decidim.admin") %>
-      <% if can? :create, Decidim::Category %>
+      <% if allowed_to? :create, :category %>
         <%= link_to t("actions.new", scope: "decidim.admin", name: t("models.category.name", scope: "decidim.admin")), new_category_path(current_participatory_space), class: "button tiny button--title new" %>
       <% end %>
     </h2>
@@ -25,11 +25,11 @@
                   <%= link_to translated_attribute(category.name), edit_category_path(current_participatory_space, category) %><br />
                 </td>
                 <td class="table-list__actions">
-                  <% if can? :update, category %>
+                  <% if allowed_to? :update, :category, category: category %>
                     <%= icon_link_to "pencil", edit_category_path(current_participatory_space, category), t("actions.edit", scope: "decidim.admin"), class: "action-icon--edit" %>
                   <% end %>
 
-                  <% if can? :destroy, category %>
+                  <% if allowed_to? :destroy, :category, category: category %>
                     <% if category.unused? %>
                       <%= icon_link_to "circle-x", category_path(current_participatory_space, category), t("actions.destroy", scope: "decidim.admin"), class: "action-icon--remove", method: :delete, data: { confirm: t("actions.confirm_destroy", scope: "decidim.admin") } %>
                     <% else %>
@@ -46,11 +46,11 @@
                     <%= link_to translated_attribute(subcategory.name), edit_category_path(current_participatory_space, subcategory) %><br />
                   </td>
                   <td class="table-list__actions">
-                  <% if can? :update, subcategory %>
+                  <% if allowed_to? :update, :category, category: subcategory %>
                     <%= icon_link_to "pencil", edit_category_path(current_participatory_space, subcategory), t("actions.edit", scope: "decidim.admin"), class: "action-icon--edit" %>
                   <% end %>
 
-                  <% if can? :destroy, subcategory %>
+                  <% if allowed_to? :destroy, :category, category: subcategory %>
                     <%= icon_link_to "circle-x", category_path(current_participatory_space, subcategory), t("actions.destroy", scope: "decidim.admin"), class: "action-icon--remove", method: :delete, data: { confirm: t("actions.confirm_destroy", scope: "decidim.admin") } %>
                   <% end %>
                   </td>

data/app/views/decidim/admin/categories/show.html.erb

@@ -2,8 +2,8 @@
 
 <div class="actions">
   <hr />
-  <%= link_to t("decidim.admin.actions.edit"), ["edit", participatory_space, @category] if can? :update, @category %>
-  <%= link_to t("decidim.admin.actions.destroy"), [participatory_space, @category], method: :delete, class: "alert button", data: { confirm: t("decidim.admin.actions.confirm_destroy") } if can? :destroy, @category %>
+  <%= link_to t("decidim.admin.actions.edit"), ["edit", participatory_space, @category] if allowed_to? :update, :category, category: @category %>
+  <%= link_to t("decidim.admin.actions.destroy"), [participatory_space, @category], method: :delete, class: "alert button", data: { confirm: t("decidim.admin.actions.confirm_destroy") } if allowed_to? :destroy, :category, category: @category %>
 </div>
 
 <dl>

data/app/views/decidim/admin/component_permissions/_options_form.html.erb

@@ -0,0 +1,14 @@
+<%
+  schema = form.object.options_schema
+  attributes = form.object.options_attributes
+%>
+
+<%= form.fields_for(:options, schema) do |options_form| %>
+  <% attributes.each do |name, attribute| %>
+    <%= options_form.send(
+          form_method_for_attribute(attribute),
+          name,
+          label: t("authorization_handlers.#{form.object.authorization_handler_name}.fields.#{name}", scope: "decidim")
+        ) %>
+  <% end %>
+<% end %>

data/app/views/decidim/admin/component_permissions/edit.html.erb

@@ -5,23 +5,44 @@
     </div>
   </div>
 
-  <%= form_for @permissions_form, url: url_for(action: :update), method: "put" do |form| %>
-    <%= form.fields_for :permissions, form.object do |form| %>
-      <% form.object.permissions.each do |action, permission| %>
-        <%= form.fields_for(action, permission) do |form| %>
-          <fieldset class="card <%= action %>-permission">
-            <div class="card-divider"><%= t("#{component.manifest.name}.actions.#{action}", scope: "decidim.components") %></div>
-            <div class="card-section">
-              <%= form.select :authorization_handler_name,
-                authorizations.map { |authorization|
-                  [authorization.description, authorization.key]
-                }, include_blank: t(".everyone") %>
-              <%= form.text_field :options %>
-            </div>
-          </fieldset>
-        <% end %>
+  <%= form_for @permissions_form, url: url_for(action: :update), method: "put" do |permissions_form| %>
+    <%= permissions_form.fields_for :permissions, permissions_form.object do |action_permission_form| %>
+      <% action_permission_form.object.permissions.each do |action, permission| %>
+        <fieldset class="card <%= action %>-permission">
+          <div class="card-divider"><%= t("#{component.manifest.name}.actions.#{action}", scope: "decidim.components") %></div>
+
+          <div class="card-section">
+            <%= action_permission_form.fields_for(action, permission) do |permission_form| %>
+              <%= permission_form.collection_select :authorization_handler_name,
+                                                    authorizations,
+                                                    :name,
+                                                    :description,
+                                                    { include_blank: t(".everyone") } %>
+              <% if permission.authorization_handler_name %>
+                <div id="authorization-handler-<%= permission.authorization_handler_name %>"
+                     class="authorization-handler">
+                  <%= render "options_form", form: permission_form %>
+                </div>
+              <% end %>
+            <% end %>
+
+            <% other_authorizations_for(action).each do |authorization| %>
+              <% permission = Decidim::Admin::PermissionForm.new(authorization_handler_name: authorization.name) %>
+
+              <%= action_permission_form.fields_for(action, permission) do |permission_form| %>
+                <div id="authorization-handler-<%= authorization.name %>"
+                     class="authorization-handler"
+                     style="display:none">
+                  <%= render "options_form", form: permission_form %>
+                </div>
+              <% end %>
+            <% end %>
+          </div>
+        </fieldset>
       <% end %>
     <% end %>
-    <%= form.submit t(".submit") %>
+    <%= permissions_form.submit t(".submit") %>
   <% end %>
 </section>
+
+<%= javascript_include_tag "decidim/admin/component_permissions" %>

data/app/views/decidim/admin/components/_component.html.erb

@@ -12,7 +12,7 @@
       <%= icon_link_to "pencil", manage_component_path(component), t("actions.manage", scope: "decidim.admin"), class: "action-icon--manage" %>
     <% end %>
 
-    <% if can?(:update, component) %>
+    <% if allowed_to?(:update, :component, component: component) %>
       <% if component.published? %>
         <%= icon_link_to "x", url_for(action: :unpublish, id: component, controller: "components"), t("actions.unpublish", scope: "decidim.admin"), class: "action-icon--unpublish", method: :put %>
       <% else %>
@@ -20,11 +20,11 @@
       <% end %>
     <% end %>
 
-    <% if can? :update, component %>
+    <% if allowed_to? :update, :component, component: component %>
       <%= icon_link_to "cog", url_for(action: :edit, id: component, controller: "components"), t("actions.configure", scope: "decidim.admin"), class: "action-icon--configure" %>
     <% end %>
 
-    <% if can? :update, component %>
+    <% if allowed_to? :update, :component, component: component %>
       <% if component.manifest.actions.empty? %>
         <%= icon "key", class: "action-icon action-icon--disabled" %>
       <% else %>
@@ -32,6 +32,8 @@
       <% end %>
     <% end %>
 
-    <%= icon_link_to "circle-x", url_for(action: :destroy, id: component, controller: "components"), t("actions.destroy", scope: "decidim.admin"), class: "action-icon--remove", method: :delete %>
+    <% if allowed_to? :destroy, :component, component: component %>
+      <%= icon_link_to "circle-x", url_for(action: :destroy, id: component, controller: "components"), t("actions.destroy", scope: "decidim.admin"), class: "action-icon--remove", method: :delete %>
+    <% end %>
   </td>
 </tr>

data/app/views/decidim/admin/components/_form.html.erb

@@ -17,12 +17,12 @@
             <div class="card-section">
               <%= form.fields_for :settings, form.object.settings do |settings_fields| %>
                 <%= render partial: "decidim/admin/components/settings_fields",
-                          locals: {
-                            form: settings_fields,
-                            component: @component,
-                            settings_name: "global",
-                            tabs_prefix: "global-settings"
-                          } %>
+                           locals: {
+                             form: settings_fields,
+                             component: @component,
+                             settings_name: "global",
+                             tabs_prefix: "global-settings"
+                           } %>
               <% end %>
             </div>
           </div>

data/app/views/decidim/admin/dashboard/show.html.erb

@@ -3,7 +3,7 @@
 </h2>
 <div class="content">
   <p><%= t ".welcome" %></p>
-  <% if can? :read, :admin_log %>
+  <% if allowed_to? :read, :admin_log %>
     <div class="row">
       <h3 class="card-title">
       </h3>

data/app/views/decidim/admin/impersonatable_users/index.html.erb

@@ -47,7 +47,9 @@
   <div class="card-divider">
     <h2 class="card-title">
       <%= t "decidim.admin.titles.impersonatable_users" %>
-      <%= link_to t(".impersonate_new_managed_user"), new_impersonatable_user_impersonation_path(:new_managed_user), class: "button tiny button--title #{'disabled' if current_organization.available_authorizations.empty?}" %>
+      <% if allowed_to? :impersonate, :impersonatable_user, user: new_managed_user %>
+        <%= link_to t(".impersonate_new_managed_user"), new_impersonatable_user_impersonation_path(:new_managed_user), class: "button tiny button--title #{'disabled' if current_organization.available_authorizations.empty?}" %>
+      <% end %>
     </h2>
   </div>
   <div class="card-section">
@@ -66,11 +68,11 @@
               <td><%= user.name %></td>
               <td><%= user.managed? ? t(".managed") : t(".not_managed") %></td>
               <td class="table-list__actions">
-                <% if can? :impersonate, user %>
+                <% if allowed_to? :impersonate, :impersonatable_user, user: user %>
                   <%= icon_link_to "account-login", new_impersonatable_user_impersonation_path(user), t(".impersonate"), class: "action-icon--impersonate" %>
                 <% end %>
                 <%= icon_link_to "clock", impersonatable_user_impersonation_logs_path(user), t(".view_logs"), class: "action-icon--view-logs" %>
-                <% if can? :promote, user %>
+                <% if allowed_to? :promote, :impersonatable_user, user: user %>
                   <%= icon_link_to "badge", new_impersonatable_user_promotion_path(user), t(".promote"), class: "action-icon--promote" %>
                 <% end %>
               </td>

data/app/views/decidim/admin/moderations/index.html.erb

@@ -51,14 +51,14 @@
               <% end %>
               <td class="actions">
 
-                <% if can? :unreport, moderation %>
+                <% if allowed_to?(:unreport, :moderation) %>
                   <%= icon_link_to "action-undo",
                                    unreport_moderation_path(id: moderation),
                                    t("actions.unreport", scope: "decidim.moderations"),
                                    class: "action-icon--unreport",
                                    method: :put %>
                 <% end %>
-                <% if !moderation.reportable.hidden? && can?(:hide, moderation) %>
+                <% if !moderation.reportable.hidden? && allowed_to?(:hide, :moderation) %>
                   <%= icon_link_to "eye",
                                    hide_moderation_path(id: moderation),
                                    t("actions.hide", scope: "decidim.moderations"),

data/app/views/decidim/admin/newsletters/index.html.erb

@@ -2,7 +2,9 @@
   <div class="card-divider">
     <h2 class="card-title">
       <%= t ".title" %>
-      <%= link_to t("actions.new", scope: "decidim.admin", name: t("models.newsletter.name", scope: "decidim.admin").downcase), ["new", "newsletter"], class: "button tiny button--title new" %>
+      <% if allowed_to? :create, :newsletter %>
+        <%= link_to t("actions.new", scope: "decidim.admin", name: t("models.newsletter.name", scope: "decidim.admin").downcase), ["new", "newsletter"], class: "button tiny button--title new" %>
+      <% end %>
     </h2>
   </div>
   <div class="card-section">
@@ -29,13 +31,13 @@
                 <% end %>
               </td>
               <td class="table-list__actions">
-                <% if can?(:update, newsletter) && !newsletter.sent? %>
+                <% if allowed_to?(:update, :newsletter, newsletter: newsletter) && !newsletter.sent? %>
                   <%= icon_link_to "pencil", decidim_admin.edit_newsletter_path(newsletter), t("actions.edit", scope: "decidim.admin"), class: "edit" %>
                 <% end %>
 
                 <%= icon_link_to "eye", decidim_admin.newsletter_path(newsletter), t("actions.preview", scope: "decidim.admin"), class: "preview" %>
 
-                <% if can?(:destroy, newsletter) && !newsletter.sent? %>
+                <% if allowed_to?(:destroy, :newsletter, newsletter: newsletter) && !newsletter.sent? %>
                   <%= icon_link_to "circle-x", decidim_admin.newsletter_path(newsletter), t("actions.destroy", scope: "decidim.admin"), method: :delete, data: { confirm: t(".confirm_delete") }, class: "action-icon--remove" %>
                 <% end %>
               </td>