Add a new write_notes permission needed for OAuth access to notes

diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 4ac3297c6d532237a05f405bbd71b1e473e2dd5f..3c7dba9844fbbbcd90fa164356b581804edc5839 100644 (file)
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -116,6 +116,9 @@ class ApplicationController < ActionController::Base
   def require_allow_write_gpx
     require_capability(:allow_write_gpx)
   end
+  def require_allow_write_notes
+    require_capability(:allow_write_notes)
+  end
 
   ##
   # require that the user is a moderator, or fill out a helpful error message

diff --git a/app/controllers/notes_controller.rb b/app/controllers/notes_controller.rb
index b25dc9a9ed777e18e0c2f5bc13cb2efec8320211..b7d6631ae87853a41491123637d20b1b1c46f5d9 100644 (file)
--- a/app/controllers/notes_controller.rb
+++ b/app/controllers/notes_controller.rb
@@ -7,6 +7,7 @@ class NotesController < ApplicationController
   before_filter :setup_user_auth, :only => [:create, :comment]
   before_filter :authorize, :only => [:close, :destroy]
   before_filter :check_api_writable, :only => [:create, :comment, :close, :destroy]
+  before_filter :require_allow_write_notes, :only => [:create, :comment, :close, :destroy]
   before_filter :set_locale, :only => [:mine]
   after_filter :compress_output
   around_filter :api_call_handle_error, :api_call_timeout

diff --git a/app/models/client_application.rb b/app/models/client_application.rb
index 9a074fb30b21ed0421026a963f46fe6247a3d2ab..0619e75a3695696ee3c04ed5ee3fee61cb88a5a8 100644 (file)
--- a/app/models/client_application.rb
+++ b/app/models/client_application.rb
@@ -16,7 +16,8 @@ class ClientApplication < ActiveRecord::Base
   attr_accessible :name, :url, :support_url, :callback_url,
                   :allow_read_prefs, :allow_write_prefs,
                   :allow_write_diary, :allow_write_api,
-                  :allow_read_gpx, :allow_write_gpx
+                  :allow_read_gpx, :allow_write_gpx,
+                  :allow_write_notes
 
   before_validation :generate_keys, :on => :create
 
@@ -87,7 +88,8 @@ protected
   # have to say up-front what permissions they want and when users sign up they
   # can agree or not agree to each of them.
   PERMISSIONS = [:allow_read_prefs, :allow_write_prefs, :allow_write_diary,
-                 :allow_write_api, :allow_read_gpx, :allow_write_gpx ]
+                 :allow_write_api, :allow_read_gpx, :allow_write_gpx,
+                 :allow_write_notes]
 
   def generate_keys
     self.key = OAuth::Helper.generate_key(40)[0,40]

diff --git a/db/migrate/20130328184137_add_write_notes_permission.rb b/db/migrate/20130328184137_add_write_notes_permission.rb
new file mode 100644 (file)
index 0000000..c7da174
--- /dev/null
+++ b/db/migrate/20130328184137_add_write_notes_permission.rb
@@ -0,0 +1,11 @@
+class AddWriteNotesPermission < ActiveRecord::Migration
+  def up
+    add_column :oauth_tokens, :allow_write_notes, :boolean, :null => false, :default => false
+    add_column :client_applications, :allow_write_notes, :boolean, :null => false, :default => false
+  end
+
+  def down
+    remove_column :client_applications, :allow_write_notes
+    remove_column :oauth_tokens, :allow_write_notes
+  end
+end

diff --git a/db/structure.sql b/db/structure.sql
index b76995b6879c511532a9c5aa1a1e091b3a6f5475..4ed87362865295d86174ab18b4ccc6124ed895d2 100644 (file)
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -249,7 +249,8 @@ CREATE TABLE client_applications (
     allow_write_diary boolean DEFAULT false NOT NULL,
     allow_write_api boolean DEFAULT false NOT NULL,
     allow_read_gpx boolean DEFAULT false NOT NULL,
-    allow_write_gpx boolean DEFAULT false NOT NULL
+    allow_write_gpx boolean DEFAULT false NOT NULL,
+    allow_write_notes boolean DEFAULT false NOT NULL
 );
 
 
@@ -850,7 +851,8 @@ CREATE TABLE oauth_tokens (
     callback_url character varying(255),
     verifier character varying(20),
     scope character varying(255),
-    valid_to timestamp without time zone
+    valid_to timestamp without time zone,
+    allow_write_notes boolean DEFAULT false NOT NULL
 );
 
 
@@ -2451,6 +2453,8 @@ INSERT INTO schema_migrations (version) VALUES ('20121202155309');
 
 INSERT INTO schema_migrations (version) VALUES ('20121203124841');
 
+INSERT INTO schema_migrations (version) VALUES ('20130328184137');
+
 INSERT INTO schema_migrations (version) VALUES ('21');
 
 INSERT INTO schema_migrations (version) VALUES ('22');