diff --git a/app/controllers/org_admin/users_controller.rb b/app/controllers/org_admin/users_controller.rb index e2c730c..c8d51ff 100644 --- a/app/controllers/org_admin/users_controller.rb +++ b/app/controllers/org_admin/users_controller.rb @@ -6,11 +6,12 @@ after_action :verify_authorized + # SEE MODULE def edit @user = User.find(params[:id]) authorize @user @departments = @user.org.departments.order(:name) - @plans = Plan.active(@user).page(1) + @plans = Plan.org_admin_visible(@user).page(1) render "org_admin/users/edit", locals: { user: @user, departments: @departments, diff --git a/app/models/plan.rb b/app/models/plan.rb index 2131930..521f34a 100644 --- a/app/models/plan.rb +++ b/app/models/plan.rb @@ -185,6 +185,21 @@ ) } + scope :org_admin_visible, -> (user) { + plan_ids = user.org.plans.pluck(:id) + + includes(:template, roles: :user) + .where(id: plan_ids, visibility: [ + visibilities[:administrator_visible], + visibilities[:organisationally_visible], + visibilities[:publicly_visible] + ]) + .where( + "NOT EXISTS (SELECT 1 FROM roles WHERE plan_id = plans.id AND user_id = ?)", + user.id + ) + } + scope :search, lambda { |term| search_pattern = "%#{term}%" joins(:template) diff --git a/lib/dmpopidor/controllers/org_admin/users.rb b/lib/dmpopidor/controllers/org_admin/users.rb new file mode 100644 index 0000000..46bc443 --- /dev/null +++ b/lib/dmpopidor/controllers/org_admin/users.rb @@ -0,0 +1,25 @@ +module Dmpopidor + module Controllers + module OrgAdmin + module Plans + + # CHANGES : Org Admin should access plan with administrator, organisation & public plan when editing a user + def edit + @user = User.find(params[:id]) + authorize @user + @departments = @user.org.departments.order(:name) + @plans = Plan.org_admin_visible(@user).page(1) + render "org_admin/users/edit", + locals: { user: @user, + departments: @departments, + plans: @plans, + languages: @languages, + orgs: @orgs, + identifier_schemes: @identifier_schemes, + default_org: @user.org } + end + + end + end + end +end \ No newline at end of file diff --git a/lib/dmpopidor/controllers/paginable/plans.rb b/lib/dmpopidor/controllers/paginable/plans.rb index 8de81e8..65859c1 100644 --- a/lib/dmpopidor/controllers/paginable/plans.rb +++ b/lib/dmpopidor/controllers/paginable/plans.rb @@ -32,7 +32,22 @@ query_params: { sort_field: 'plans.updated_at', sort_direction: :desc } ) end - end + + # CHANGES : Org Admin should access plan with administrator, organisation & public plan when editing a user + # GET /paginable/plans/org_admin/:page + def org_admin_other_user + @user = User.find(params[:id]) + authorize @user + unless current_user.present? && current_user.can_org_admin? && @user.present? + raise Pundit::NotAuthorizedError + end + paginable_renderise( + partial: "org_admin_other_user", + scope: Plan.org_admin_visible(@user), + query_params: { sort_field: 'plans.updated_at', sort_direction: :desc } + ) + end end end - end \ No newline at end of file + end +end \ No newline at end of file