your_platform 0.0.1 → 0.0.2

data/app/controllers/sessions_controller.rb

@@ -0,0 +1,21 @@
+class SessionsController < Devise::SessionsController
+
+  # In order to automatically remember users in devise, i.e. without having to check the
+  # "remember me" checkbox, we override the setting here.
+  # 
+  # http://stackoverflow.com/questions/14417201/how-to-automatically-keep-user-remembered-in-devise
+  #
+  # Furthermore, this registers the session with the metric service in order to 
+  # track the users' activities.
+  #
+  def create
+    super
+    metric_logger.register_session
+  end
+  
+  def destroy
+    current_user.update_last_seen_activity(nil) if current_user
+    super
+  end
+
+end

data/app/controllers/setup_controller.rb

@@ -0,0 +1,80 @@
+class SetupController < ApplicationController
+  
+  # This setup page is only for the initial setup and must
+  # not be shown later on.
+  #
+  skip_authorization_check  # suppress the regular handling by cancan
+  before_filter :handle_authorization
+  
+  # Initialize basic database entities such as a start page.
+  #
+  before_filter :bootstrap
+  
+  def index
+  end
+  
+  def create
+    
+    raise 'name not given' if params[:first_name].blank? or params[:last_name].blank?
+    raise 'email not given' if params[:email].blank?
+    raise 'no password' if params[:password].blank?
+    raise 'password too short' if params[:password].length < 9
+    raise 'password confirmation did not match' if params[:password] != params[:password_confirmation]
+    
+    user = User.new first_name: params[:first_name], last_name: params[:last_name]
+    user.email = params[:email]
+    user.generate_alias
+    user.save!
+    
+    account = user.build_account 
+    account.password = params[:password]
+    account.save!
+    
+    user.global_admin = true
+    
+    if params[:application_name].present?
+      Setting.app_name = params[:application_name]
+    end
+    
+    if params[:sub_organizations].present?
+      params[:sub_organizations].split("\n").each do |organization_name|
+        if organization_name.present?
+          corporation = Corporation.create name: organization_name
+          full_members = corporation.child_groups.create name: 'full_members'
+          full_members.add_flag :full_members
+        end
+      end
+      Corporation.all.first.status_groups.first.assign_user user
+    end
+    
+    sign_in :user_account, account
+    
+    flash[:notice] = I18n.t(:setup_complete)
+    redirect_to root_path
+    
+  end
+  
+private
+
+  def handle_authorization
+    raise 'Setup already done. To start over, wipe your database.' if User.count > 0
+  end
+  
+  def bootstrap
+    if Page.count == 0
+      
+      Group.everyone
+      Group.corporations_parent
+
+      Page.create_root title: 'example.com', redirect_to: 'http://example.com'
+      Page.create_intranet_root
+      Page.create_help_page
+      Page.create_imprint
+      
+      Page.intranet_root << Group.corporations_parent
+      
+      Workflow.find_or_create_mark_as_deceased_workflow
+    end
+  end
+  
+end

data/app/controllers/statistics_controller.rb

@@ -0,0 +1,38 @@
+class StatisticsController < ApplicationController
+  
+  skip_authorization_check only: [:index, :show]
+  
+  def index
+    authorize! :index, :statistics
+    
+    @list_presets = [
+      'corporation_joining_statistics', 'aktivitates_join_and_persist_statistics'
+    ]
+  end
+  
+  def show
+    authorize! :read, :statistics
+    
+    @list_preset = params[:list] || raise('no list preset given. use parameter "list".')
+    
+    case @list_preset
+    when 'corporation_joining_statistics'
+      @list_export = ListExport.new(Group.corporations_parent, 'join_statistics')
+    when 'aktivitates_join_and_persist_statistics'
+      @list_export = ListExport.new(Group.alle_aktiven, 'join_and_persist_statistics')
+    else
+      raise "statistics preset unknown: #{@list_preset}."
+    end
+
+    respond_to do |format|
+      format.html  # render view
+      format.csv do
+        authorize! :export, :statistics
+        
+        bom = "\xEF\xBB\xBF".force_encoding('utf-8') # UTF-8
+        send_data (bom + @list_export.to_csv), filename: ("#{t @list_preset} #{Time.zone.now}".parameterize + ".csv")
+      end
+    end
+  end
+  
+end

data/app/controllers/status_group_memberships_controller.rb

@@ -0,0 +1,28 @@
+
+class StatusGroupMembershipsController < ApplicationController
+
+  before_filter :find_membership
+  load_and_authorize_resource
+
+  respond_to :json
+
+  def update
+    attributes = params[ :status_group_membership ]
+    if @status_group_membership.update_attributes( attributes )
+      respond_with @status_group_membership
+    else
+      raise "updating attributes of user_group_membership has failed: " + @status_group_membership.errors.full_messages.first
+    end
+  end
+
+  def destroy
+    @status_group_membership.destroy if @status_group_membership
+  end
+
+  private
+
+  def find_membership
+    @status_group_membership = StatusGroupMembership.with_invalid.find( params[ :id ] ) if params[ :id ].present?
+  end
+  
+end

data/app/controllers/terms_of_use_controller.rb

@@ -0,0 +1,35 @@
+class TermsOfUseController < ApplicationController
+  
+  skip_authorize_resource only: 'index'
+  
+  def index
+    authorize! :read, :terms_of_use
+    @current_terms_stamp = current_terms_stamp
+  end
+  
+  def accept
+    authorize! :accept, :terms_of_use
+    
+    if params[:accept] == 'agreed'
+      flash[:notice] = I18n.t(:terms_of_use_accepted)
+      current_user.accept_terms current_terms_stamp
+      redirect_to (params[:redirect_after] || root_path), method: 'get'
+    else
+      flash[:error] = I18n.t(:you_have_to_accept_these_terms)
+      redirect_to action: 'index', redirect_after: params[:redirect_after]
+    end
+  end
+  
+  def self.accepted?(current_user)
+    current_user.accepted_terms?(current_terms_stamp)
+  end
+  
+  def self.current_terms_stamp
+    self.new.current_terms_stamp
+  end
+  
+  def current_terms_stamp
+    render_to_string('_terms', layout: false).lines.first
+  end
+  
+end

data/app/controllers/user_accounts_controller.rb

@@ -0,0 +1,55 @@
+class UserAccountsController < ApplicationController
+
+  load_and_authorize_resource
+  layout               false
+
+  def show
+    @user_account = UserAccount.find(params[:id])
+
+    respond_to do |format|
+      format.html # show.html.erb
+      format.json { render json: @user_account }
+    end
+  end
+
+  def new
+    @user_account = UserAccount.new
+
+    respond_to do |format|
+      format.html # new.html.erb
+      format.json { render json: @user_account }
+    end
+  end
+
+  def edit
+    @user_account = UserAccount.find(params[:id])
+  end
+
+  def create
+    @user = User.find_by_id(params[:user_id])
+    @user_account = @user.build_account
+
+    respond_to do |format|
+      if @user_account.save
+
+        @user.send_welcome_email
+        
+        format.html { redirect_to :back, notice: t(:user_account_created) }
+        format.json { render json: @user_account, status: :created, location: @user_account }
+      else
+        format.html { render action: "new" }
+        format.json { render json: @user_account.errors, status: :unprocessable_entity }
+      end
+    end
+  end
+
+  def destroy
+    @user_account = UserAccount.find(params[:id])
+    @user_account.destroy
+
+    respond_to do |format|
+      format.html { redirect_to :back, notice: t(:user_account_deleted)  }
+      format.json { head :no_content }
+    end
+  end
+end

data/app/controllers/user_group_memberships_controller.rb

@@ -0,0 +1,75 @@
+class UserGroupMembershipsController < ApplicationController
+
+  before_filter :find_membership
+  authorize_resource
+
+  respond_to :json, :html
+  
+  def index
+    authorize! :manage, @user
+    
+    @user = User.find(params[:user_id])
+    @memberships = UserGroupMembership.now_and_in_the_past.find_all_by_user(@user)
+    @navable = @user
+  end
+  
+  def create
+    if membership_params[:user_title].present?
+      @user_id = User.find_by_title(membership_params[:user_title]).id
+      @user_group_membership = UserGroupMembership.create(membership_params.merge({user_id: @user_id}))
+    else
+      head :no_content
+    end
+  end
+
+  def show
+    # update  # 2013-02-03 SF: This seems wrong, does it not?
+  end
+
+  def update
+    if @user_group_membership.update_attributes!( membership_params )
+      respond_to do |format|
+        format.json do
+          #head :ok
+          #respond_with_bip @user_group_membership
+          respond_with @user_group_membership
+        end
+      end
+    end
+  end
+
+  def destroy
+    if @user_group_membership
+      @user_group_membership.destroy
+      head :no_content
+    end
+  end
+
+  private
+
+  def membership_params
+    unrestricted_params = [:valid_to, :valid_from, :user_title, :user_id, :group_id, :id,
+                    :valid_from_localized_date, :valid_to_localized_date]
+    unfiltered_params = params.require(:user_group_membership) || params.require(:status_group_membership)
+    if can? :manage, @user_group_membership
+      restricted_params = unrestricted_params + [:needs_review, :ancestor_id, :ancestor_type, :descendant_id,
+                                                     :descendant_type]
+      unfiltered_params.permit(*restricted_params)
+    elsif can? :update, @user_group_membership
+      unfiltered_params.permit(*unrestricted_params)
+    end
+  end
+
+  def find_membership
+    if params[ :id ].present?
+      @user_group_membership = UserGroupMembership.with_invalid.find( params[ :id ] )
+    else
+      user = User.find params[ :user_id ] if params[ :user_id ]
+      group = Group.find params[ :group_id ] if params[ :group_id ]
+      if user && group
+        @user_group_membership = UserGroupMembership.with_invalid.find_by_user_and_group user, group
+      end
+    end
+  end
+  
+end

data/app/controllers/user_settings_controller.rb

@@ -0,0 +1,57 @@
+class UserSettingsController < ApplicationController
+  
+  skip_authorization_check only: [:index, :show, :update]
+
+  # /settings  
+  def index
+    authorize! :update, user
+    
+    @user = user
+    @navable = @user
+    
+    @user.update_last_seen_activity "nimmt Benutzereinstellungen vor"
+    
+    render action: 'show'
+  end
+
+  # /users/123/settings
+  def show
+    @user = user
+    authorize! :update, user
+    
+    @navable = @user
+    current_user.update_last_seen_activity "nimmt Benutzereinstellungen vor"
+  end
+  
+  def update
+    @user = user
+    authorize! :update, @user
+    
+    if not user_params[:incognito].nil?
+      if user_params[:incognito] == true
+        current_user.update_last_seen_activity nil
+      end
+      
+      if user_params[:incognito] == 'true'
+        @user.incognito = true
+      elsif user_params[:incognito] == 'false'
+        @user.incognito = false
+      end
+      @user.save
+    end
+
+    render nothing: true
+  end
+  
+
+private
+
+  def user
+    params[:user_id] ? User.find(params[:user_id]) : current_user
+  end
+    
+  def user_params
+    params.require(:user).permit(:incognito)
+  end
+  
+end

data/app/controllers/users_controller.rb

@@ -0,0 +1,125 @@
+# -*- coding: utf-8 -*-
+class UsersController < ApplicationController
+
+  respond_to :html, :json, :js
+
+  before_filter :find_user, only: [:show, :update, :forgot_password]
+  authorize_resource except: [:forgot_password]
+
+  def index
+    begin
+      redirect_to group_path(Group.everyone)
+    rescue
+      raise "No basic groups are present, yet. Try `rake bootstrap:all`."
+    end
+  end
+
+  def show
+    if current_user == @user
+      current_user.update_last_seen_activity("sieht sich sein eigenes Profil an", @user)
+    else
+      current_user.try(:update_last_seen_activity, "sieht sich das Profil von #{@user.title} an", @user)
+    end
+    
+    respond_to do |format|
+      format.html # show.html.erb
+                  #format.json { render json: @profile.sections }  # TODO
+    end
+    metric_logger.log_event @user.attributes.merge({name: @user.name, title: @user.title}), type: :show_user
+  end
+
+  def new
+    @user = User.new
+    
+    @parent_group = Group.find(params[:parent_id]) if params[:parent_type] == 'Group'
+    @user.add_to_group = @parent_group.try(:id)
+    @user.female = false
+    @user.alias = params[:alias]
+  end
+
+  def create
+    @user_params = user_params
+    @basic_user_params = @user_params.select { |key, value| key.to_s.in? ['first_name', 'last_name', 'email', 'female', 'create_account'] }
+    @basic_user_params[:first_name] ||= I18n.t(:first_name)
+    @basic_user_params[:last_name] ||= I18n.t(:last_name)
+    @user = User.create(@basic_user_params)
+    if @user_params[:add_to_group]
+      Group.find(@user_params[:add_to_group]).assign_user @user
+      @user_params.except! :add_to_group
+    end
+    @user.update_attributes(@user_params)
+    @user.fill_in_template_profile_information
+    @user.send_welcome_email if @user.account
+    redirect_to @user
+  end
+
+  def update
+    @user.update_attributes(user_params)
+    respond_with @user
+  end
+
+  def autocomplete_title
+    query = params[:term] if params[ :term ]
+    query ||= params[ :query ] if params[ :query ]
+    query ||= ""
+    
+    @users = User.where("CONCAT(first_name, ' ', last_name) LIKE ?", "%#{query}%")
+
+    # render json: json_for_autocomplete(@users, :title)
+    # render json: @users.to_json( :methods => [ :title ] )
+    render json: @users.map(&:title)
+  end
+
+  def forgot_password
+    authorize! :update, @user.account
+    @user.account.send_new_password
+    flash[:notice] = I18n.t(:new_password_has_been_sent_to, user_name: @user.title)
+    redirect_to :back
+  end
+
+  private
+  
+  # This method returns the request parameters and their values as long as the user
+  # is permitted to change them. 
+  # 
+  # This mechanism protects from mass assignment hacking and replaces the old
+  # attr_accessible mechanism. 
+  # 
+  # For more information, have a look at these resources:
+  #   https://github.com/rails/strong_parameters/
+  #   http://railscasts.com/episodes/371-strong-parameters
+  # 
+  def user_params
+    permitted_keys = []
+    if @user
+      permitted_keys += [:first_name] if can? :change_first_name, @user
+      permitted_keys += [:alias] if can? :change_alias, @user
+      permitted_keys += [:email, :date_of_birth, :localized_date_of_birth] if can? :update, @user
+      permitted_keys += [:avatar, :remove_avatar] if can? :update, @user
+      permitted_keys += [:last_name, :name] if can? :change_last_name, @user
+      permitted_keys += [:corporation_name] if can? :manage, @user
+      permitted_keys += [:create_account, :female, :add_to_group, :add_to_corporation, :hidden, :wingolfsblaetter_abo] if can? :manage, @user
+    else  # user creation
+      permitted_keys += [:first_name, :last_name, :female, :date_of_birth, :add_to_group, :add_to_corporation, :aktivmeldungsdatum, :study_address, :home_address, :work_address, :email, :phone, :mobile, :create_account] if can? :create, :aktivmeldung
+    end
+    params.require(:user).permit(*permitted_keys)
+  end
+
+  def find_user
+    if not handle_mystery_user
+      @user = User.find(params[:id]) if params[:id].present?
+      @user ||= User.find_by_alias(params[:alias]) if params[:alias].present?
+      @user ||= User.new
+      @title = @user.title
+      @navable = @user
+    end
+  end
+  
+  def handle_mystery_user
+    if (params[:id].to_i == 1) and (not User.where(id: 1).present?)
+      redirect_to group_path(Group.everyone), :notice => "I bring order to chaos. I am the beginning, the end, the one who is many."
+      return true
+    end
+  end
+
+end