your_platform 0.0.1 → 0.0.2

data/app/controllers/corporations_controller.rb

@@ -0,0 +1,22 @@
+class CorporationsController < ApplicationController
+  respond_to :html, :json
+  
+  before_filter :find_corporations
+  authorize_resource
+
+  def index
+    respond_to do |format|
+      format.html { redirect_to Corporation.corporations_parent }
+      format.json { respond_with @corporations.pluck(:name) }
+    end
+  end
+  
+  
+  private
+  
+  def find_corporations
+    query = params[:term] || params[:query] || ""
+    @corporations = Corporation.where('name LIKE ?', "%#{query}%")
+  end
+  
+end

data/app/controllers/errors_controller.rb

@@ -0,0 +1,27 @@
+class ErrorsController < ApplicationController
+
+  skip_authorization_check
+  
+  # General Exception Handling: Show Message on Error Page
+  # -------------------------------------------------------------------------
+  #
+  # http://railscasts.com/episodes/53-handling-exceptions-revised
+  #
+  def show
+    @exception = env["action_dispatch.exception"]
+    respond_to do |format|
+      format.html #{ render action: request.path[1..-1] }
+      format.json { render json: {status: request.path[1..-1], error: (@exception.message || "Zeitüberschreitung (Timeout).")} }
+    end
+  end
+
+  # Unauthorized Error: Redirect to Login Page
+  # -------------------------------------------------------------------------
+
+  def unauthorized
+    if not current_user
+      redirect_to sign_in_path, flash: { error: I18n.t(:unauthorized_please_sign_in) }
+    end
+  end
+    
+end

data/app/controllers/events_controller.rb

@@ -0,0 +1,262 @@
+class EventsController < ApplicationController
+
+  rescue_from ActiveRecord::RecordNotFound, with: :wait_for_existance
+
+  load_and_authorize_resource
+  skip_authorize_resource only: [:index, :create, :join_via_get]
+
+  # GET /events
+  # GET /events.json
+  #
+  # ATTENTION: The index action has to handly authorization manually!
+  #
+  def index
+    
+    # Which events should be listed
+    @group = Group.find params[:group_id] if params[:group_id]
+    @user = Group.find params[:user_id] if params[:user_id]
+    @user ||= current_user
+    @user ||= UserAccount.find_by_auth_token(params[:token]).try(:user) if params[:token].present?
+    @all = params[:all]
+    @on_local_website = params[:published_on_local_website]
+    @on_global_website = params[:published_on_global_website]
+    @public = @on_local_website || @on_global_website
+    @limit = params[:limit].to_i
+    
+    # Check the permissions.
+    if @all and not @public
+      authorize! :index_events, :all
+    elsif @all and @public
+      authorize! :index_public_events, :all
+    elsif @group
+      @public ? authorize!(:index_public_events, :all) : authorize!(:index_events, @group)
+    elsif @user
+      authorize! :index_events, @user
+    end  
+    
+    # Collect the events to list.
+    if @all
+      @events = Event.where(true)
+    elsif @group
+      @events = Event.find_all_by_group(@group)
+      @navable = @group
+    elsif @user
+      @events = Event.find_all_by_user(@user)
+      @navable = @user
+    end
+    
+    # Filter if only published events are requested.
+    @events = @events.where publish_on_local_website: true if @on_local_website
+    @events = @events.where publish_on_global_website: true if @on_global_website
+    
+    # Order events
+    @events = @events.order 'events.start_at, events.created_at'
+    
+    # Limit the number of events.
+    # If a limit exists, make sure to return upcoming events.
+    @events = @events.upcoming.limit(@limit) if @limit && @limit > 0
+    
+    # Add the Cross-origin resource sharing header for public requests.
+    response.headers['Access-Control-Allow-Origin'] = '*' if @public
+
+    respond_to do |format|
+      format.html do
+        if @on_local_website or @on_global_website
+          render partial: 'events/public_index', locals: {events: @events}
+        else
+          if @group
+            current_user.try(:update_last_seen_activity, I18n.t(:is_looking_at_the_calendar_of, group_name: @group.name), @group)
+          else
+            current_user.try(:update_last_seen_activity, I18n.t(:is_looking_at_events))
+          end
+          # renders "index.html.haml"
+        end
+      end
+      format.json { render json: @events }
+      format.ics { send_data @events.to_ics, filename: "#{@group.try(:name)} #{Time.zone.now}".parameterize + ".ics" }
+    end
+  end
+
+  # GET /events/1
+  # GET /events/1.json
+  def show
+    @navable = @event
+    
+    respond_to do |format|
+      format.html do
+        current_user.try(:update_last_seen_activity, I18n.t(:is_looking_at_the_event, event_name: @event.name), @event)
+        # show.html.erb
+      end
+      format.json { render json: @event }
+      format.ics { render text: @event.to_ics }
+    end
+  end
+
+  # POST /events
+  # POST /events.json
+  #
+  # ATTENTION: The create action has to handly authorization manually!
+  #
+  def create
+    @group = Group.find(params[:group_id])
+    authorize! :create_event, @group
+    
+    @event = Event.new(params[:event])
+    @event.name ||= I18n.t(:enter_name_of_event_here)
+    @event.start_at ||= Time.zone.now.change(hour: 20, min: 15)
+    
+    respond_to do |format|
+      if @event.save
+        
+        # Attention: The save call will call some callbacks, which might cause
+        # one of the following calls to run into sql deadlock issues.
+        # ActiveRecord of Rails 3 does not resolve these issues.
+        # Therefore, we use the transaction_retry gem, which retries the
+        # call after running into locked records.
+        # 
+        # TODO: This needs to be carefully checked when we migrate to Rails 4,
+        # since the locking behaviour might have changed. The transaction_retry
+        # gem has been updated last in 2012!
+        #
+        @event.reload
+        @event.parent_groups << @group if @group
+        @event.create_attendees_group
+        @event.create_contact_people_group
+        @event.contact_people_group.assign_user current_user, at: 2.seconds.ago
+        
+        # To avoid `ActiveRecord::RecordNotFound` after the redirect, we have to
+        # make sure the record can be found.
+        #
+        # TODO: Check if this is really necessary in Rails 4 anymore.
+        #
+        @event.wait_for_me_to_exist
+        current_user.try(:update_last_seen_activity, I18n.t(:is_adding_an_event), @event)
+        
+        format.html { redirect_to event_path(@event) }
+        format.json { render json: @event.attributes.merge({path: event_path(@event)}), status: :created, location: @event }
+      else
+        format.html { redirect_to :back }
+        format.json { render json: @event.errors, status: :unprocessable_entity }
+      end
+    end
+  end
+
+  # PUT /events/1
+  # PUT /events/1.json
+  def update
+    respond_to do |format|
+      if @event.update_attributes!(params[:event])
+        format.html { redirect_to @event, notice: 'Event was successfully updated.' }
+        format.json { respond_with_bip(@event) }
+      else
+        format.html { render action: "edit" }
+        format.json { respond_with_bip(@event) }
+      end
+    end
+  end
+
+  # DELETE /events/1
+  # DELETE /events/1.json
+  def destroy
+    @event.destroy
+
+    respond_to do |format|
+      format.html { redirect_to root_path }
+      format.json { head :no_content }
+    end
+  end
+  
+  
+  # POST /events/1/join
+  def join
+    change_attendance(true)
+  end
+  def leave
+    change_attendance(false)
+  end
+  def join_via_get
+    @event = Event.find params[:event_id]
+    if params[:email_confirm] == 'true'  # Only allow GET from email links.
+      authorize! :join, @event
+      join
+    else
+      authorize! :read, @event
+      redirect_to Event.find(params[:event_id])
+    end
+  end
+  
+  def change_attendance(join = true)
+    @event = Event.find params[:event_id]
+    authorize! :join, @event
+
+    if join
+      current_user.join @event
+    else
+      current_user.leave @event
+    end
+
+    respond_to do |format|
+      format.html { redirect_to event_url(@event) }
+      format.json do
+        render json: {
+          attendees_avatars: render_to_string(
+            partial: 'groups/member_avatars', 
+            layout: false,
+            formats: [:json, :html],
+            handlers: [:haml],
+            locals: {group: @event.attendees_group}
+          )
+        }
+      end
+    end
+  end
+  private :change_attendance
+  
+  
+  # POST /events/:event_id/invite/:recipient
+  # params:
+  #   - recipient
+  #   - text
+  #   - event_id
+  def invite
+    @event = Event.find params[:event_id]
+    authorize! :update, @event
+    
+    @text = params[:text]
+    @recipients = []
+    
+    if params['recipient'] == 'me'
+      @recipients = [current_user]
+    elsif params['recipient'].to_i > 0
+      group = Group.find params['recipient'].to_i
+      @recipients = group.members
+    end
+    
+    for recipient in @recipients
+      EventMailer.invitation_email(@text, [recipient], @event, current_user).deliver
+    end
+    
+    respond_to do |format|
+      format.html { redirect_to event_url(@event) }
+      format.json { head :no_content }
+    end
+  end
+  
+private
+  
+  # For some strange reason, some ajax calls fail since the object is not yet
+  # available to the other server instance. So, try a few times before giving up.
+  #
+  def wait_for_existance
+    raise 'No id given.' unless params[:id]
+    counter = 20
+    begin
+      sleep 0.5
+      Event.find params[:id]
+    rescue ActiveRecord::RecordNotFound => e
+      counter -= 1
+      retry until counter <= 0
+    end
+  end
+  
+end

data/app/controllers/groups_controller.rb

@@ -0,0 +1,257 @@
+class GroupsController < ApplicationController
+  respond_to :html, :json, :csv, :ics
+  load_and_authorize_resource
+  
+  def index
+    point_navigation_to Page.intranet_root
+    respond_with @groups
+  end
+
+  def index_mine
+    point_navigation_to current_user
+    @groups = current_user.groups
+    respond_with @groups
+  end
+
+  def show
+    if @group
+
+      if request.format.html? || request.format.xls? || request.format.csv? || request.format.json?
+        Rack::MiniProfiler.step('groups#show controller: fetch memberships') do 
+          # If this is a collection group, e.g. the corporations_parent group, 
+          # do not list the single members.
+          #
+          if @group.group_of_groups?
+            @memberships = []
+            @child_groups = @group.child_groups - [@group.find_officers_parent_group]
+
+          # This is a regular group.
+          #
+          else
+            @memberships = @group.memberships_for_member_list
+          end
+        end
+        
+        # The user might provide a `valid_from` option as constraint on the validity range.
+        # 
+        if params[:valid_from].present?
+          @memberships = @memberships.started_after(params[:valid_from].to_datetime)
+        end
+        
+        Rack::MiniProfiler.step('groups#show controller: cancan') do
+          # Make sure only members that are allowed to be seen are in this array!
+          #
+          allowed_members = @group.members.accessible_by(current_ability)
+          allowed_memberships = @group.memberships.where(descendant_id: allowed_members.map(&:id))
+          @memberships = @memberships & allowed_memberships
+        end
+        
+        Rack::MiniProfiler.step('groups#show controller: fetch members') do
+          # Fill also the members into a separate variable.
+          #
+          @members = @group.members.includes(:links_as_child).where(dag_links: {id: @memberships.map(&:id)})
+          
+          # For some special groups, the first method of retreiving the members does not work.
+          # Fallback to these slower methods:
+          @members = User.includes(:links_as_child).where(dag_links: {id: @memberships.map(&:id)}) if @members.empty?
+          @members = @memberships.collect { |membership| membership.user } if @members.empty?
+        end
+        
+        # for performance reasons deactivated for the moment.
+        # fill_map_address_fields
+        @large_map_address_fields = []
+        
+        # @posts = @group.posts.order("sent_at DESC").limit(10)
+        
+        @new_user_group_membership = @group.build_membership
+      end
+    end
+    
+    if request.format.csv? || request.format.xls?
+      list_preset = params[:list]
+      list_preset_i18n = I18n.translate(list_preset) if list_preset.present?
+      @file_title = "#{@group.name} #{list_preset_i18n} #{Time.zone.now}".parameterize
+
+      if list_preset.in? ['member_development', 'join_statistics']
+        @list_export = ListExport.new(@group, list_preset)
+      else
+        @list_export = ListExport.new(@members, list_preset)
+      end
+    end
+    
+    respond_to do |format|
+      format.html do
+        authorize! :read, @group
+        point_navigation_to @group
+        current_user.try(:update_last_seen_activity, "sieht sich Mitgliederlisten an: #{@group.title}", @group)
+      end
+      format.json do
+        authorize! :read, @group
+        render json: @group.serializable_hash.merge({member_count: @memberships.count})
+      end
+      format.csv do
+        authorize! :read, @group
+        authorize! :export_member_list, @group
+        
+        # See: http://railscasts.com/episodes/362-exporting-csv-and-excel
+        #bom = "\377\376".force_encoding('utf-16le')
+        bom = "\xEF\xBB\xBF".force_encoding('utf-8') # UTF-8
+        
+        csv_data = bom + @list_export.to_csv
+        send_data csv_data, filename: "#{@file_title}.csv"
+      end
+      format.xls do
+        authorize! :read, @group
+        authorize! :export_member_list, @group
+
+        send_data(@list_export.to_xls, type: 'application/xls; charset=utf-8; header=present', filename: "#{@file_title}.xls")
+      end  
+      format.pdf do
+        authorize! :read, @group
+        authorize! :export_member_list, @group
+        
+        if params[:sender].present?
+          # TODO: This should not be inside a GET request; but I wasn't sure how to do it properly.
+          session[:address_labels_pdf_sender] = params[:sender]
+        end
+        options = {sender: params[:sender], book_rate: params[:book_rate]}
+        file_title = "#{I18n.t(:address_labels)} #{@group.name} #{Time.zone.now}".parameterize
+        
+        # Possible dispositions: attachment, inline.
+        # Windows users with the Adobe Reader browser plugin can't print with 100% scale from the browser plugin.
+        # They would need to download and open the file in Adobe Reader standalone to print at 100% scale.
+        # Therefore, we use 'attachment' here in order to prevent the use of the browser plugin.
+        #
+        send_data(@group.members_to_pdf(options), filename: "#{file_title}.pdf", type: 'application/pdf', disposition: 'attachment')
+      end
+    end
+    
+    metric_logger.log_event @group.try(:attributes), type: :show_group
+  end
+
+  def update
+    @group.update_attributes(group_params)
+    respond_to do |format|
+      format.json { respond_with_bip @group.reload }
+    end
+  end
+
+  def create
+    if secure_parent_type.present? && params[:parent_id].present?
+      @parent = secure_parent_type.constantize.find(params[:parent_id]).child_groups
+    else
+      @parent = Group
+    end
+    if can? :manage, @parent
+      @new_group = @parent.create(name: I18n.t(:new_group))
+    end
+    respond_with @new_group
+  end
+  
+  def destroy
+    @group.destroy
+    respond_to do |format|
+      format.json { head :no_content }
+    end
+  end
+  
+  private
+  
+  # This method returns the request parameters and their values as long as the user
+  # is permitted to change them. 
+  # 
+  # This mechanism protects from mass assignment hacking and replaces the old
+  # attr_accessible mechanism. 
+  # 
+  # For more information, have a look at these resources:
+  #   https://github.com/rails/strong_parameters/
+  #   http://railscasts.com/episodes/371-strong-parameters
+  # 
+  def group_params
+    # STI override:
+    params[:group] ||= params[:corporation] # for Corporation objects
+    
+    permitted_keys = []
+    permitted_keys += [:name, :extensive_name] if can? :rename, @group
+    permitted_keys += [:token] if can? :change_token, @group
+    permitted_keys += [:internal_token] if can? :change_internal_token, @group
+    permitted_keys += [:direct_members_titles_string] if can? :update_memberships, @group
+    permitted_keys += [:body] if can? :update, @group
+    params.require(:group).permit(*permitted_keys)
+  end
+  
+  def fill_map_address_fields
+    fill_small_map_address_fields
+    fill_large_map_address_fields
+  end
+  
+  def fill_small_map_address_fields
+    # On collection groups, e.g. the corporations_parent group, only the
+    # groups should be shown on the map. These groups have a lot of
+    # child groups with address profile fields.
+    #
+    if child_groups_map_profile_fields.count > 0
+      @users_map_profile_fields = []
+      @groups_map_profile_fields = child_groups_map_profile_fields
+    elsif child_groups_map_profile_fields.count == 0
+      
+      # To prevent long loading times, users map profile fields should only
+      # be loaded when there are not too many.
+      #
+      # TODO: Remove this when the map addresses are cached.
+      # TODO: Cache map address fields.
+      #
+      if @group.member_ids.count < 100  # arbitrary limit.
+        @users_map_profile_fields = users_map_profile_fields
+      else
+        @users_map_profile_fields = []
+      end
+      
+      # Only if there are descendant group address fields, fill the variable
+      # for the large map. If there is only the own address, the view
+      # will render a small map instead of the large one.
+      #
+      if descendant_groups_map_profile_fields.count > 0
+        @groups_map_profile_fields = own_map_profile_fields + descendant_groups_map_profile_fields
+      else
+        @groups_map_profile_fields = []
+      end
+    end
+  end
+  
+  def fill_large_map_address_fields
+    # TODO: Make this more efficient.
+    # This can be done by using @user_map_profile_fields and @group_map_profile_fields
+    # separately when creating the map, because then, there is no need to check the
+    # type of the profileable. 
+    # But, this makes no sense at the moment, since the profileable objects have
+    # to be loaded anyway, since we need the title of the profileables.
+    #
+    @large_map_address_fields = @users_map_profile_fields + @groups_map_profile_fields
+  end
+  
+  
+  # These methods collect the address fields for displaying the large map
+  # on group pages.
+  #
+  # https://github.com/apneadiving/Google-Maps-for-Rails/wiki/Controller
+  #
+  def descendant_groups_map_profile_fields
+    @descendant_groups_map_profile_fields ||= ProfileField.where( type: "ProfileFieldTypes::Address", profileable_type: "Group", profileable_id: @group.descendant_group_ids )
+  end
+  def child_groups_map_profile_fields
+    @child_groups_map_profile_fields ||= ProfileField.where( type: "ProfileFieldTypes::Address", profileable_type: "Group", profileable_id: @group.child_group_ids )
+  end
+  def own_map_profile_fields
+    @own_map_profile_fields ||= ProfileField.where( type: "ProfileFieldTypes::Address", profileable_type: "Group", profileable_id: @group.id )
+  end
+  def users_map_profile_fields
+    @users_map_profile_fields ||= ProfileField.where( type: "ProfileFieldTypes::Address", profileable_type: "User", profileable_id: @members.collect { |member| member.id } ).includes(:profileable)
+  end
+    
+  
+  def secure_parent_type
+    params[:parent_type] if params[:parent_type].in? ['Group', 'Page']
+  end
+
+end