diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb index cbc5a878c07baa6e6e5c1bb038c2a901a49d1839..b4f75c7d0bcc31ab5e0827cfe74cd06072b5250d 100644 --- a/app/controllers/users_controller.rb +++ b/app/controllers/users_controller.rb @@ -1,4 +1,7 @@ class UsersController < ApplicationController + + include Pundit + before_action :authenticate_user!, only: [:follow, :unfollow] before_action :check_current_user_page, only: :show before_action :set_user, only: [:show] @@ -9,7 +12,7 @@ class UsersController < ApplicationController def show @objects = @user.learning_objects @institutions = @user.institutions - @groups = [CollectionsGroup.new(title: 'Coleções Adicionadas', collections: [@user.collections.includes(:owner)])] + @groups = [CollectionsGroup.new(title: 'Coleções Adicionadas', collections: [ CollectionPolicy::Scope.new(current_user, @user.id, @user.collections).resolve.includes(:owner)])] if @user == current_user @publishers = @user.institutions diff --git a/app/helpers/collections_helper.rb b/app/helpers/collections_helper.rb index 3eaeea73c7a8287dc838114b844f16b3476801ee..9b81d73cbfe081a012a3b9c155af0eb9fe654d98 100644 --- a/app/helpers/collections_helper.rb +++ b/app/helpers/collections_helper.rb @@ -28,7 +28,7 @@ module CollectionsHelper end def no_collections(collections, user) - "Nenhuma coleção disponÃvel. Crie novas coleções na página do seu perfil ou #{link_to 'clique aqui', user_path(user)}" if collections.blank? + "Nenhuma coleção disponÃvel. Crie novas coleções na página do seu perfil ou #{link_to 'clique aqui', user_path(user)}".html_safe if collections.blank? end end diff --git a/app/models/collection.rb b/app/models/collection.rb index 08597902e1a14126efc9559135f4f2443787f8db..05dcce308892be8518cc8521827c330e37588a23 100644 --- a/app/models/collection.rb +++ b/app/models/collection.rb @@ -59,8 +59,9 @@ class Collection < ActiveRecord::Base end def user_own?(user) + return true if user.is_a? Institution and owner.users.include?(user) return false unless user.is_a? User - owner?(user) || owner.users.include?(user) + user.is_admin? || owner?(user) end def private? diff --git a/app/policies/collection_policy.rb b/app/policies/collection_policy.rb index c986524944e3f652bb26bfa706c7ddaf0218dcbd..06180e1cc928c266a6cff4fe237d3763780081f4 100644 --- a/app/policies/collection_policy.rb +++ b/app/policies/collection_policy.rb @@ -2,6 +2,26 @@ class CollectionPolicy < ApplicationPolicy include SociablePolicy include FollowablePolicy + class Scope < Scope + + + def initialize (user, user_id, scope) + @user = user + @user_id = user_id + @scope = scope + end + + def resolve + + if @user.try(:id) == @user_id || @user.try(:is_admin?) + scope.all + else + scope.where(privacy: 'public') + end + end + end + + def create? record if user_exists? end diff --git a/app/views/users/show.html.erb b/app/views/users/show.html.erb index 0144bee2bb5e85a37504949cac9e85ec0703b8a8..8f1f3ab6ceb05da4c4134907e4c088ba91de0008 100644 --- a/app/views/users/show.html.erb +++ b/app/views/users/show.html.erb @@ -14,7 +14,7 @@ </div> </div> <div class="col-md-6 right-column align-right"> - <% if current_user_page? @user %> + <% if user_signed_in? && current_user_page?(@user) %> <%= link_to 'Adicionar novo objeto', new_learning_object_path, class: 'btn btn-primary'%> <% else %> <!-- <button type="button" class="btn btn-primary">Enviar mensagem</button> --> @@ -48,7 +48,7 @@ </div> </div> <div class="col-md-6 right-column align-right"> - <%= render('collections/create', collection: @new_collection, publishers: @publishers, placement: 'left') if current_user_page?(@user) %> + <%= render('collections/create', collection: @new_collection, publishers: @publishers, placement: 'left') if user_signed_in? && current_user_page?(@user) %> </div> </div>