diff --git a/app/controllers/phases_controller.rb b/app/controllers/phases_controller.rb index 391120b..eead0ca 100644 --- a/app/controllers/phases_controller.rb +++ b/app/controllers/phases_controller.rb @@ -8,10 +8,12 @@ def edit @plan = Plan.eager_load2(params[:plan_id]) + # authorization done on plan so found in plan_policy authorize @plan phase_id = params[:id].to_i @phase = @plan.template.phases.select {|p| p.id == phase_id}.first + @readonly = !@plan.editable_by?(current_user.id) # the eager_load pulls in ALL answers # need to restrict to just ones for this plan diff --git a/app/controllers/plans_controller.rb b/app/controllers/plans_controller.rb index 526f76a..e554b93 100644 --- a/app/controllers/plans_controller.rb +++ b/app/controllers/plans_controller.rb @@ -140,7 +140,7 @@ authorize @plan # If there was no phase specified use the template's 1st phase @phase = (params[:phase].nil? ? @plan.template.phases.first : Phase.find(params[:phase])) - @readonly = @plan.editable_by?(current_user.id) + @readonly = !@plan.editable_by?(current_user.id) respond_to :html end diff --git a/app/models/exported_plan.rb b/app/models/exported_plan.rb index 5684072..368f077 100644 --- a/app/models/exported_plan.rb +++ b/app/models/exported_plan.rb @@ -86,7 +86,7 @@ end def questions_for_section(section_id) - questions.where(section_id: section_id).sort_by(&:number) + Question.where(id: questions).where(section_id: section_id).order(:number) end def admin_details @@ -128,6 +128,8 @@ value = self.send(at) if value.present? output += admin_field_t(at.to_s) + ": " + value + "\n" + else + output += admin_field_t(at.to_s) + ": " + _('-') + "\n" end end @@ -162,18 +164,17 @@ private def questions - @questions ||= begin - question_settings = self.settings(:export).fields[:questions] - - return [] if question_settings.is_a?(Array) && question_settings.empty? - - questions = if question_settings.present? && question_settings != :all - Question.where(id: question_settings) + question_settings = self.settings(:export).fields[:questions] + @questions ||= if question_settings.present? + if question_settings == :all + Question.where(section_id: self.plan.sections.collect { |s| s.id }).pluck(:id) + elsif question_settings.is_a?(Array) + question_settings else - Question.where(section_id: self.plan.sections.collect {|s| s.id }) + [] end - - questions.order(:number) + else + [] end end diff --git a/app/models/user.rb b/app/models/user.rb index 352b564..14f1af2 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -107,14 +107,13 @@ # # @param new_organisation_id [Integer] the id for an organisation # @return [String] the empty string as a causality of setting api_token -=begin - def organisation_id=(new_organisation_id) - unless self.can_change_org? || new_organisation_id.nil? || self.organisation.nil? + def org_id=(new_org_id) + unless self.can_change_org? || new_org_id.nil? || self.org.nil? # rip all permissions from the user self.perms.delete_all end # set the user's new organisation - super(new_organisation_id) + super(new_org_id) self.save! # rip api permissions from the user self.remove_token! @@ -124,10 +123,9 @@ # sets a new organisation for the user # # @param new_organisation [Organisation] the new organisation for the user - def organisation=(new_organisation) - organisation_id = new_organisation.id unless new_organisation.nil? + def organisation=(new_org) + org_id = new_org.id unless new_org.nil? end -=end ## # checks if the user is a super admin diff --git a/app/policies/phase_policy.rb b/app/policies/phase_policy.rb index 5d43a7e..caa0e3c 100644 --- a/app/policies/phase_policy.rb +++ b/app/policies/phase_policy.rb @@ -8,10 +8,10 @@ end ## + # Org-admin side # Users can modify phases if: # - They can modify templates # - The template which they are modifying belongs to their org - ## def admin_show? user.can_modify_templates? && (phase.template.org_id == user.org_id) diff --git a/app/policies/plan_policy.rb b/app/policies/plan_policy.rb index d6c8703..aa99a2b 100644 --- a/app/policies/plan_policy.rb +++ b/app/policies/plan_policy.rb @@ -7,13 +7,13 @@ @user = user @plan = plan end - + def show? @plan.readable_by?(@user.id) end def edit? - @plan.editable_by?(@user.id) + @plan.readable_by?(@user.id) end def update_guidance_choices? diff --git a/app/views/phases/_answer_form_ro.html.erb b/app/views/phases/_answer_form_ro.html.erb index fcf175d..915db2a 100644 --- a/app/views/phases/_answer_form_ro.html.erb +++ b/app/views/phases/_answer_form_ro.html.erb @@ -1,4 +1,4 @@ - <% q_format = question.question_format%> + <% if readonly != "always" then %>
- <%= admin_field_t(field.to_s) -%>
<%= admin_field_t(field.to_s) -%> <%= value -%>
+ if value.present? %> +<%= admin_field_t(field.to_s) -%> <%= value -%>
+ <% else %> +<%= admin_field_t(field.to_s) -%> <%= _('-') %>
<% end %> <% end %> diff --git a/test/functional/plans_controller_test.rb b/test/functional/plans_controller_test.rb index 259bfbf..3811003 100644 --- a/test/functional/plans_controller_test.rb +++ b/test/functional/plans_controller_test.rb @@ -107,20 +107,6 @@ assert assigns(:selected_guidance_groups) end - # GET /plan/:id/edit (edit_plan_path) - # ---------------------------------------------------------- - test 'show the edit plan page' do - # Should redirect user to the root path if they are not logged in! - try_no_user_and_unauthorized(edit_plan_path(@plan)) - - sign_in @user - get edit_plan_path(@plan) - assert_response :success - assert assigns(:plan) - assert assigns(:phase) - assert assigns(:readonly) - end - # PUT /plan/:id (plan_path) # ---------------------------------------------------------- test 'update the plan' do