cst1/openstreetmap-website
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Use CanCanCan for nodes, ways, relations, old and api controllers

Browse source
This commit is contained in:
Andy Allan 2019-01-09 18:28:27 +01:00
parent fbbabeff1e
commit e7f943c715
7 changed files with 45 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

15
app/abilities/ability.rb
View file

@ -4,6 +4,7 @@ class Ability
include CanCan::Ability
def initialize(user)
can [:trackpoints, :map, :changes, :capabilities, :permissions], :api
can [:relation, :relation_history, :way, :way_history, :node, :node_history,
:changeset, :note, :new_note, :query], :browse
can [:index, :feed, :read, :download, :query], Changeset
@ -21,6 +22,12 @@ class Ability
can [:index, :show, :data, :georss, :picture, :icon], Trace
can [:terms, :api_users, :login, :logout, :new, :create, :save, :confirm, :confirm_resend, :confirm_email, :lost_password, :reset_password, :show, :api_read, :auth_success, :auth_failure], User
can [:index, :show, :blocks_on, :blocks_by], UserBlock
can [:read, :nodes], Node
can [:read, :full, :ways, :ways_for_node], Way
can [:read, :full, :relations, :relations_for_node, :relations_for_way, :relations_for_relation], Relation
can [:history, :version], OldNode
can [:history, :version], OldWay
can [:history, :version], OldRelation
if user
can :welcome, :site
@ -36,6 +43,9 @@ class Ability
if user.terms_agreed? || !REQUIRE_TERMS_AGREED
can [:create, :update, :upload, :close, :subscribe, :unsubscribe, :expand_bbox], Changeset
can :create, ChangesetComment
can [:create, :update, :delete], Node
can [:create, :update, :delete], Way
can [:create, :update, :delete], Relation
end
if user.moderator?
@ -45,6 +55,11 @@ class Ability
can :destroy, Note
can [:new, :create, :edit, :update, :destroy], Redaction
can [:new, :edit, :create, :update, :revoke], UserBlock
if user.terms_agreed? || !REQUIRE_TERMS_AGREED
can :redact, OldNode
can :redact, OldWay
can :redact, OldRelation
end
end
if user.administrator?

8
app/abilities/capability.rb
View file

@ -15,11 +15,19 @@ class Capability
if token&.user&.terms_agreed? || !REQUIRE_TERMS_AGREED
can [:create, :update, :upload, :close, :subscribe, :unsubscribe, :expand_bbox], Changeset if capability?(token, :allow_write_api)
can :create, ChangesetComment if capability?(token, :allow_write_api)
can [:create, :update, :delete], Node if capability?(token, :allow_write_api)
can [:create, :update, :delete], Way if capability?(token, :allow_write_api)
can [:create, :update, :delete], Relation if capability?(token, :allow_write_api)
end
if token&.user&.moderator?
can [:destroy, :restore], ChangesetComment if capability?(token, :allow_write_api)
can :destroy, Note if capability?(token, :allow_write_notes)
if token&.user&.terms_agreed? || !REQUIRE_TERMS_AGREED
can :redact, OldNode if capability?(token, :allow_write_api)
can :redact, OldWay if capability?(token, :allow_write_api)
can :redact, OldRelation if capability?(token, :allow_write_api)
end
end
end