First version of app and object auth for web_resource module. Basic fund is ok. backend need to be secued

vendor/built_in_modules/web_resource/app/controllers/panel/web_resource/back_end/web_links_controller.rb

@@ -1,7 +1,7 @@
 class Panel::WebResource::BackEnd::WebLinksController < OrbitBackendController
-  
   before_filter :authenticate_user!
-  before_filter :is_admin?
+  # before_filter :for_app_manager,:except => [:index,:show] 
+  # before_filter :for_app_sub_manager
 
   def index
   

vendor/built_in_modules/web_resource/app/models/web_link_category.rb

@@ -3,12 +3,21 @@
 class WebLinkCategory
   include Mongoid::Document
   include Mongoid::Timestamps
+  include OrbitCoreLib::ObjectAuthable
+
   # include Mongoid::MultiParameterAttributes
-  
+  AfterObjectAuthUrl = '/panel/page_content/back_end/page_contexts'
+  APP_NAME = 'web_resource'
+  ObjectAuthTitlesOptions = %W{edit}
+
   field :key
   
   has_one :i18n_variable, :as => :language_value, :autosave => true, :dependent => :destroy
   
   has_many :web_links
   
+  def pp_object
+    i18n_variable[I18n.locale]
+  end
+
 end

vendor/built_in_modules/web_resource/app/views/panel/web_resource/back_end/web_link_categorys/_web_link_category.html.erb

@@ -3,12 +3,15 @@
 	<tr id="<%= dom_id web_link_category %>" class="with_action">
 		<td>
 			<%= web_link_category.key %>
-			<div class="quick-edit">
-				<ul class="nav nav-pills hide">
-					<li><%= link_to t('web_link_category.edit'), edit_panel_web_resource_back_end_web_link_category_path(web_link_category), :remote => true %></li>
-					<li><%= link_to t('web_link_category.delete'), panel_web_resource_back_end_web_link_category_path(web_link_category), :confirm => t('announcement.sure?'), :method => :delete, :remote => true %></li>
-				</ul>
-			</div>
+			<%if at_least_module_manager %>
+				<div class="quick-edit">
+					<ul class="nav nav-pills hide">
+						<li><%= link_to t('web_link_category.edit'), edit_panel_web_resource_back_end_web_link_category_path(web_link_category), :remote => true %></li>
+						<li><%= link_to t('web_link_category.delete'), panel_web_resource_back_end_web_link_category_path(web_link_category), :confirm => t('announcement.sure?'), :method => :delete, :remote => true %></li>
+						<li><%= show_web_link_permission_link web_link_category %></li>
+					</ul>
+				</div>
+			<% end -%>
 		</td>
 		<% @site_valid_locales.each do |locale| %>
 		<td><%= web_link_category.i18n_variable[locale] rescue nil %></td>

vendor/built_in_modules/web_resource/app/views/panel/web_resource/back_end/web_link_categorys/index.html.erb

@@ -34,6 +34,6 @@
 	</tbody>
 </table>
 
-<div id="form"><%= render :partial => "form" %></div>
+<div id="form"><%= render :partial => "form"  if at_least_module_manager%></div>
 
 

vendor/built_in_modules/web_resource/app/views/panel/web_resource/back_end/web_links/_web_link.html.erb

@@ -24,8 +24,10 @@
 	<%= link_to web_link.name[I18n.locale], panel_web_resource_back_end_web_link_path(web_link) %>
 	<div class="quick-edit">
 		<ul class="nav nav-pills hide">
+			<%if at_least_module_manager || web_link.web_link_category.cur_user_is_sub_manager_of(:edit)%>
 			<li><%= link_to t('web_link.edit'), edit_panel_web_resource_back_end_web_link_path(web_link) %></li>
 			<li><%= link_to t('web_link.delete'), panel_web_resource_back_end_web_link_path(web_link), :confirm => t('sure?'), :method => :delete, :remote => true %></li>
+			<% end -%>
 		</ul>
 	</div>
 	</td>