New authorization

app/models/auth/auth_approval.rb

@@ -0,0 +1,6 @@
+class AuthApproval < Authorization
+	field :title
+	
+	belongs_to :approval_authorizable, polymorphic: true
+	has_and_belongs_to_many :authorized_users, class_name: 'User', inverse_of: 'approving_apps'
+end

app/models/auth/auth_manager.rb

@@ -0,0 +1,4 @@
+class AuthManager < Authorization
+	# belongs_to :manager_authorizable, polymorphic: true
+	has_and_belongs_to_many :authorized_users, class_name: 'User', inverse_of: 'managing_apps'
+end

app/models/auth/auth_sub_manager.rb

@@ -0,0 +1,6 @@
+class AuthSubManager < Authorization
+	field :title
+
+	belongs_to :sub_manager_authorizable, polymorphic: true
+	has_and_belongs_to_many :authorized_users, class_name: 'User', inverse_of: 'sub_managing_apps'
+end

app/models/auth/authorization.rb

@@ -0,0 +1,108 @@
+class Authorization
+  include Mongoid::Document
+  include Mongoid::Timestamps
+
+  field :title
+
+  belongs_to :module_app
+
+  has_and_belongs_to_many :roles
+  has_and_belongs_to_many :sub_roles
+
+  delegate :update_auth_approval_users, :update_auth_manager_users, :update_auth_sub_manager_users, to: :module_app, prefix: true, allow_nil: true
+
+  after_save :update_module_app
+
+
+  def add_roles(roles)
+  	users = []
+  	roles = Array(roles)
+    add_operation(:roles, roles)
+    sub_roles = [] 
+    roles.each{|role| role.sub_roles.each{|sub_role| sub_roles << sub_role.id}}
+    add_operation(:sub_roles, sub_roles)
+    roles.each{|role| role.users.where(admin: false).each{|user| users << user}}
+		add_users(users, false)
+  end
+  
+  def add_sub_roles(sub_roles)
+  	users = []
+  	sub_roles = Array(sub_roles)
+    add_operation(:sub_roles, sub_roles)
+    sub_roles.each do |sub_role| 
+			self.roles << sub_role.role unless self.roles.include?(sub_role.role)
+    	sub_role.users.where(admin: false).each{|user| users << user}
+    end
+		add_users(users, false)
+  end
+  
+  def add_users(users, with_parents = true)
+  	users = Array(users)
+    add_operation(:authorized_users, users)
+    users.each do |user|
+    	user.roles.each do |role|
+	    	self.roles << role unless self.roles.include?(role)
+    	end
+    	user.sub_roles.each do |sub_role|
+	    	self.sub_roles << sub_role unless self.sub_roles.include?(sub_role)
+    	end
+    end if with_parents
+   	self.save
+  end
+
+  def remove_roles(roles)
+  	users = []
+  	sub_roles = []
+  	roles = Array(roles)
+  	remove_operation(:roles, roles)
+ 		roles.each do |role|
+ 			role.sub_roles.each{|sub_role| sub_roles << sub_role}
+ 			role.users.where(admin: false).each{|user| users << user}
+ 		end
+		remove_operation(:sub_role_ids, sub_roles)
+		remove_operation(:authorized_user_ids, users)
+		add_roles(self.roles)
+  end
+
+  def remove_sub_roles(sub_roles)
+  	users = []
+  	sub_roles = Array(sub_roles)
+  	remove_operation(:sub_roles, sub_roles)
+  	sub_roles.each do |sub_role|
+  		users << sub_role.users.where(admin: false)
+  	end
+		remove_operation(:authorized_user_ids, users)
+		add_roles(self.roles)
+  end
+
+  def remove_users(users)
+  	users = Array(users)
+  	remove_operation(:authorized_user_ids, users)
+   	self.save
+  end
+
+  protected
+
+  def add_operation(db_field, objs)
+   	objs.each do |obj|
+	   	self.send(db_field) << obj unless self.send(db_field).include?(obj)
+   	end
+  end  
+
+  def remove_operation(db_field, obj)
+    self.write_attribute(db_field, self.send(db_field) - obj.map{|y| y.id})
+  end
+
+  private
+
+  def update_module_app
+  	case self._type
+  	when "AuthApproval"
+  		self.module_app_update_auth_approval_users
+  	when "AuthManager"
+  		self.module_app_update_auth_manager_users
+  	when "AuthSubManager"
+  		self.module_app_update_auth_sub_manager_users
+  	end
+  end
+end

app/models/category.rb

@@ -1,7 +1,7 @@
 class Category
   include Mongoid::Document
   include Mongoid::Timestamps
-  include OrbitCoreLib::ObjectAuthable
+  include OrbitModel::Authorizable
 
   field :disable, type: Boolean, default: false
   field :title, localize: true

app/models/module_app.rb

@@ -1,16 +1,26 @@
 class ModuleApp
   include Mongoid::Document
   include Mongoid::Timestamps
-  include OrbitCoreLib::ObjectTokenUtility
-  include OrbitApp::ModuleAppMembershipTools
+  # include OrbitCoreLib::ObjectTokenUtility
+  # include OrbitApp::ModuleAppMembershipTools
 
+  field :auth_approval_users, type: Array, default: nil
+  field :auth_manager_users, type: Array, default: nil
+  field :auth_sub_manager_users, type: Array, default: nil
   field :key
   field :title
   field :sidebar_order,type: Integer,default: 0
 
+  has_one :auth_manager, dependent: :destroy
+  has_many :auth_approvals, dependent: :destroy
+  has_many :auth_sub_managers, dependent: :destroy
   has_many :categories, dependent: :destroy
   has_many :module_tags, dependent: :destroy
 
+  has_many :approvals #to remove
+
+  delegate :authorized_users, to: :auth_manager, prefix: true, allow_nil: true
+
   def refetch_setting!(reg)
     # %w{module_label category base_url version organization author intro update_info create_date}.each  do |field|
     #   self[field.to_sym] =  reg.send field 
@@ -24,6 +34,7 @@ class ModuleApp
     self[:has_category] = reg.get_has_category
     self[:is_approvable] = reg.get_is_approvable
     self[:is_authorizable] = reg.get_is_authorizable
+    self[:approvable_models] = reg.get_approvable_models
     self[:authorizable_models] = reg.get_authorizable_models
   end
 
@@ -168,4 +179,71 @@ class ModuleApp
     self.module_tags.map{|t| t.tag }
   end
 
+
+  # authorization
+  def update_auth_approval_users
+    user_ids = self.auth_approvals.inject([]) do |users, auth|
+      users += auth.authorized_users.map{|user| user.id}
+    end
+    update_attribute(:auth_approval_users, user_ids.uniq)
+  end
+
+  def update_auth_manager_users
+    update_attribute(:auth_manager_users, self.auth_manager_authorized_users.map{|user| user.id})
+  end
+
+  def update_auth_sub_manager_users
+    user_ids = self.auth_sub_managers.inject([]) do |users, auth|
+      users += auth.authorized_users.map{|user| user.id}
+    end
+    update_attribute(:auth_sub_manager_users, user_ids.uniq)
+  end
+
+  def managers
+    auth_manager_authorized_users || []
+  end
+
+  def user_can_manage?(user)
+    managers.include?(user)
+  end
+
+  def add_managers(users)
+    users = Array(users)
+    if auth_manager = self.auth_manager
+      auth_manager.update_attribute(:authorized_users, (auth_manager.authorized_users + users).uniq)
+    else
+      self.create_auth_manager(authorized_users: users)
+    end
+  end
+
+  def remove_managers(users)
+    users = Array(users)
+    users = users.delete_if{|user| user == current_user || is_admin?}
+    self.auth_manager.update_attribute(:authorized_users, auth_manager.authorized_users - users)
+  end
+
+  def is_manager?(user)
+    if user && !auth_manager_users.blank?
+      auth_manager_users.include?(user.id)
+    else
+      false
+    end
+  end
+  
+  def is_sub_manager?(user)
+    if user && !auth_sub_manager_users.blank?
+      auth_sub_manager_users.include?(user.id)
+    else
+      false
+    end
+  end
+  
+  def can_approve?(user)
+    if user && !auth_approval_users.blank?
+      auth_approval_users.include?(user.id)
+    else
+      false
+    end
+  end
+
 end

app/models/user/user.rb

@@ -19,12 +19,16 @@ class User
   field :cache_dept,type: Hash
   field :status_record,type: Hash
 
+  has_and_belongs_to_many :approving_apps, class_name: 'AuthApproval', inverse_of: 'authorized_users'
+  has_and_belongs_to_many :managing_apps, class_name: 'AuthManager', inverse_of: 'authorized_users'
+  has_and_belongs_to_many :sub_managing_apps, class_name: 'AuthSubManager', inverse_of: 'authorized_users'
+
   has_many :attribute_values, :autosave => true, :dependent => :destroy
   has_many :app_auths,as: :privilege_apps,:inverse_of => :privilege_lists
   has_many :blocked_apps,  :inverse_of => :blocked_users, :class_name => "AppAuth", :dependent => :destroy
   has_many :privilege_apps,  :inverse_of => :privilege_users, :class_name => "AppAuth", :dependent => :destroy
 
-  has_many :managing_apps,:class_name => "AppManager", :dependent => :destroy
+  # has_many :managing_apps,:class_name => "AppManager", :dependent => :destroy
   has_one :desktop, :autosave => true, :dependent => :destroy
   has_one :facebook, :autosave => true, :dependent => :destroy
   has_many :other_accounts, :autosave => true, :dependent => :destroy
@@ -273,8 +277,8 @@ class User
   end
 
   def managed_module_apps
-    self.managing_apps.inject([]) do |managed_apps, app_manager|
-      managed_apps << app_manager.managing_app unless app_manager.managing_app.blank?
+    self.managing_apps.inject([]) do |managed_apps, auth_manager|
+      managed_apps << auth_manager.module_app
       managed_apps
     end
   end