diff --git a/app/models/user.rb b/app/models/user.rb index 015197f65bcf1e091123bb93ac0b8376decbaf67..1b717bf606a5f5e078737c7f7281ef8c466c335b 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -160,6 +160,13 @@ class User < ApplicationRecord false end + def is_publisher? + roles.each do |role| + return true if role.name == 'publisher' + end + false + end + def is_partner? roles.each do |role| return true if role.name == 'partner' diff --git a/app/policies/application_policy.rb b/app/policies/application_policy.rb index 3924bd854db6a0638ce3d4082db9e8d63591c7c4..62709b8f622701484ba0590822e9dd91673cd885 100644 --- a/app/policies/application_policy.rb +++ b/app/policies/application_policy.rb @@ -74,12 +74,20 @@ class ApplicationPolicy raise 'You must implement this method!' end + def user_can_create? + (user_exists? && user.is_submitter?) || (user_exists? && user.is_publisher?) + end + def user_can_edit? user.is_admin? || user.is_editor? end def user_can_update? - (owns? && user.is_submitter?) || (owns? && user.is_partner?) || user.is_admin? + (owns? && user.is_publisher?) || (owns? && user.is_submitter?) || (owns? && user.is_partner?) || user.is_admin? + end + + def user_can_publish? + (user_can_curate? && record.submitted?) || (owns? && user.is_publisher?) end def user_can_curate? diff --git a/app/policies/learning_object_policy.rb b/app/policies/learning_object_policy.rb index c37f238e19568ce58d8d08065457361cbf1934fb..a3a49e091ecc5c586abf7a9c48833470b0f12970 100644 --- a/app/policies/learning_object_policy.rb +++ b/app/policies/learning_object_policy.rb @@ -38,7 +38,7 @@ class LearningObjectPolicy < ApplicationPolicy end def create? - record if (user_exists? && user.is_submitter?) + record if user_can_create? end def update? @@ -46,7 +46,7 @@ class LearningObjectPolicy < ApplicationPolicy end def publish? - record if (user_can_curate? && record.submitted?) + record if user_can_publish? end def destroy? diff --git a/db/seeds.rb b/db/seeds.rb index 108a59c06e460185ea97f6937356391770c138b2..7b991bd611c001ac58647ac40922323703191f51 100644 --- a/db/seeds.rb +++ b/db/seeds.rb @@ -33,6 +33,7 @@ Role.create(name: 'supervisor', description: 'This role represents an user Super Role.create(name: 'editor', description: 'This role represents a content Supervisor in Portal MEC, with less privileges than admin.') Role.create(name: 'submitter', description: 'This role represents a content submitter in Portal MEC.') Role.create(name: 'partner', description: 'This role represents a partner Portal MEC.') +Role.create(name: 'publisher', description: 'This role represents a content publisher without supervision in Portal MEC.') # create the default admin User.create( diff --git a/spec/acceptance/learning_objects_spec.rb b/spec/acceptance/learning_objects_spec.rb index 44e7b5e57bf59cad3df21df09ff1667f4d82868a..6a1b16c8b1b5452f99110f242f9b0e2336ef2474 100644 --- a/spec/acceptance/learning_objects_spec.rb +++ b/spec/acceptance/learning_objects_spec.rb @@ -60,7 +60,7 @@ resource 'Learning Objects' do end post '/v1/learning_objects' do - include_context "authenticate_user_submitter" + include_context "authenticate_user_publisher" parameter :author, 'The author of a educational content', scope: :learning_object parameter :name, 'The name of the learning object', scope: :learning_object @@ -98,7 +98,7 @@ resource 'Learning Objects' do end put '/v1/learning_objects/:id' do - include_context "authenticate_user_submitter" + include_context "authenticate_user_publisher" parameter :author, 'The author of a educational content' parameter :name, 'The name of the learning object' @@ -178,7 +178,7 @@ resource 'Learning Objects' do end post '/v1/learning_objects/:id/publish' do - include_context "authenticate_user_curator" + include_context "authenticate_user_publisher" let(:id) { @learning_object.id } diff --git a/spec/shared/contexts.rb b/spec/shared/contexts.rb index 90ba69ca40ca86993b00c2e59a274f92e42f34e3..3d72a5ff205dbe901de7ac1698e32ac5f267e9d6 100644 --- a/spec/shared/contexts.rb +++ b/spec/shared/contexts.rb @@ -61,6 +61,19 @@ RSpec.shared_context "authenticate_user_submitter", shared_context: :metadata do end +RSpec.shared_context "authenticate_user_publisher", shared_context: :metadata do + let(:auth_client) { @auth_headers['client'] } + let(:uid) { @auth_headers['uid'] } + let(:access_token) { @auth_headers['access-token'] } + let(:role) { Role.all } + + before do + @user = create(:user, roles: [role.find_by(name: 'publisher')]) + @auth_headers = @user.create_new_auth_token + end + +end + RSpec.shared_context "authenticate_user_curator", shared_context: :metadata do let(:auth_client) { @auth_headers['client'] } let(:uid) { @auth_headers['uid'] }