Fix error messages when users should not be able to do things

[rails.git] / app / models / ability.rb

diff --git a/app/models/ability.rb b/app/models/ability.rb
index d33430fb4fbc285148d216863f7e242c2c955a9e..f55f19e4ea7e2d918e81ee4a95f66990dea9b530 100644 (file)
--- a/app/models/ability.rb
+++ b/app/models/ability.rb
@@ -3,27 +3,30 @@
 class Ability
   include CanCan::Ability
 
-  def initialize(user, token)
-    can :index, :site
-    can [:permalink, :edit, :help, :fixthemap, :offline, :export, :about, :preview, :copyright, :key, :id, :welcome], :site
-
-    can [:list, :rss, :view, :comments], DiaryEntry
-
+  def initialize(user)
+    can [:index, :permalink, :edit, :help, :fixthemap, :offline, :export, :about, :preview, :copyright, :key, :id], :site
+    can [:index, :rss, :show, :comments], DiaryEntry
     can [:search, :search_latlon, :search_ca_postcode, :search_osm_nominatim,
          :search_geonames, :search_osm_nominatim_reverse, :search_geonames_reverse], :geocoder
 
     if user
-      can :weclome, :site
-
+      can :welcome, :site
       can [:create, :edit, :comment, :subscribe, :unsubscribe], DiaryEntry
+      can [:new, :create], Report
+      can [:read, :read_one, :update, :update_one, :delete_one], UserPreference
 
-      can [:read, :read_one], UserPreference if has_capability?(token, :allow_read_prefs)
-      can [:update, :update_one, :delete_one], UserPreference if has_capability?(token, :allow_write_prefs)
+      if user.moderator?
+        can [:index, :show, :resolve, :ignore, :reopen], Issue
+        can :create, IssueComment
+      end
 
       if user.administrator?
         can [:hide, :hidecomment], [DiaryEntry, DiaryComment]
+        can [:index, :show, :resolve, :ignore, :reopen], Issue
+        can :create, IssueComment
       end
     end
+
     # Define abilities for the passed in user here. For example:
     #
     #   user ||= User.new # guest user (not logged in)
@@ -51,10 +54,4 @@ class Ability
     # See the wiki for details:
     # https://github.com/CanCanCommunity/cancancan/wiki/Defining-Abilities
   end
-
-  # If a user provides no tokens, they've authenticated via a non-oauth method
-  # and permission to access to all capabilities is assumed.
-  def has_capability?(token, cap)
-    token.nil? || token.read_attribute(cap)
-  end
 end