Use authorized_scope within controllers#851
Conversation
jmilljr24
changed the title
| if current_user.super_user? | ||
| WorkshopLog.all | ||
| else | ||
| WorkshopLog.where(created_by_id: current_user.id) |
There was a problem hiding this comment.
did this filter get lost? i don't think it's in the policy
There was a problem hiding this comment.
Going off the policy and comment I left off the by project_id since we need have the table change coming and there are a bunch more scope this policy will need to filter the search filters if we filter on org as well.
relation_scope do |relation|
next relation if admin?
relation.where(user: user) # TODO - maybe also allow users to see peers' within same organization
end
I do notice now that the scope for user should be on created_by_id.
It looks like WorkshopLog has user_id on it not created_by_id so the relation_scope was correct.
There was a problem hiding this comment.
gotcha re project!
the report/workshop_log models are actually still user_id. so we must've never tested as non-admin.
|
|
||
| it "populates workshops dropdown with only workshops from visible logs" do | ||
| # TODO use action policy to filter | ||
| xit "populates workshops dropdown with only workshops from visible logs" do |
There was a problem hiding this comment.
what was wrong w this test?
There was a problem hiding this comment.
We need to scope all the dropdowns. I think it should be its own separate PR. We are disabling workshop logs for this phase right? So this can be lower priority?
There was a problem hiding this comment.
workshop_logs are in scope. it's the workshop_idea he wants us to hide for now.
There was a problem hiding this comment.
OoOOOOH ok. I will open a separate issue for the scoped filters.
| @@ -20,7 +20,7 @@ def manage? | |||
| # Define shared methods useful for most policies. | |||
|
|
|||
There was a problem hiding this comment.
i found note somewhere of adding scope_matcher :relation, ActiveRecord::Relation to ApplicationPolicy and after_action :verify_authorized, except: :index to validate that the indexes are using the scopes. not sure if you'd want to do that?
There was a problem hiding this comment.
In ApplicationController I have verify_authorized commented out and ready to go once we think we have every policy done and and proper. That makes sure every controller action has a policy checked going forward.
I'll have to look into the scope stuff and see if/what makes sense for us. Thanks for pointing it out.
jmilljr24
force-pushed
the
additonal-policy-stuff
branch
from
f90c40b to
04e8f5f
Compare
2 participants
What is the goal of this PR and why is this important?
Relation scopes were set up in policies. This uses them in the controllers.
How did you approach the change?
Anything else to add?