New authorization

lib/orbit_app/module/registration.rb

@@ -28,7 +28,7 @@ module OrbitApp
         end
 
         class DataSheet
-          attr_reader :name,:key,:base_path,:module_label,:data_count, :has_category, :has_tag, :authorizable_models, :is_approvable, :is_authorizable
+          attr_reader :name,:key,:base_path,:module_label,:data_count, :has_category, :has_tag, :approvable_models, :authorizable_models, :is_approvable, :is_authorizable
 
           def initialize(name, &block)
             @name = name
@@ -39,6 +39,7 @@ module OrbitApp
             @data_count = 1..15 # as default
             @has_category = nil
             @has_tag = nil
+            @approvable_models = []
             @authorizable_models = []
             @is_approvable = nil
             @is_authorizable = nil
@@ -145,8 +146,13 @@ module OrbitApp
               define_method(field){|var| instance_variable_set( "@" + field, var)}
           end
 
-          def approvable(link=true)
+          def approvable(link=true, &block)
             @is_approvable = {:with_link => link}
+            if block
+              block.call
+            else
+              approvable_on
+            end
           end
 
           def authorizable(link=true, &block)
@@ -158,6 +164,10 @@ module OrbitApp
             end
           end
 
+          def approvable_on(klass = 'Category')
+            @approvable_models << klass
+          end
+
           def authorizable_on(klass = 'Category')
             @authorizable_models << klass
           end
@@ -170,6 +180,10 @@ module OrbitApp
             @has_tag = true
           end
 
+          def get_approvable_models
+            @approvable_models
+          end
+
           def get_authorizable_models
             @authorizable_models
           end

lib/orbit_category/categorizing.rb

@@ -9,11 +9,11 @@ module OrbitCategory
       end
     end
 
-    def get_categories_for_form(func_authed_for_sub_manager = "category_#{@module_app.key}")
+    def get_categories_for_form
       categories = if is_manager? || is_admin?
         @module_app.categories.enabled
       elsif is_sub_manager?
-        @module_app.categories.enabled.authed_for_user(current_user, func_authed_for_sub_manager)
+        @module_app.categories.enabled.entries.delete_if{|category| !category.user_can_sub_manage?(current_user)}
       end
       if categories.empty?
         flash[:alert] = t(:no_category)

lib/orbit_core_lib.rb

@@ -140,30 +140,39 @@ module  OrbitCoreLib
     end
   end
 
-  module AppBackendUtility
+  module Authorization
+    def self.included(base)
+      base.class_eval do
+        before_filter :can_use
+      end
+    end
+
     def setup_vars
       @app_title ||= controller_path.split('/')[1].singularize
       @module_app ||= ModuleApp.first(conditions: {:key => @app_title} )
+      # raise ModuleAppError, 'Can not find ModuleApp' if @module_app.nil?
     end
 
     private
 
-    def force_order_for_visitor
-      setup_vars
-      set_current_user
+    def can_use
+      unless @override_can_use
+        check_backend_openness if @public
+        setup_vars
+        set_current_user
+        unless @public
+          authenticate_user!
+          check_user_can_use
+        end
+      end
     end
 
-
-    def force_order_for_user
-      setup_vars
-      set_current_user    
-      authenticate_user!
-      check_user_can_use
+    def set_public
+      @public = true
     end
 
-    def check_user_can_use 
-      unless check_permission
-        #redirect_to polymorphic_path(['panel',@app_title,'back_end','public'])
+    def check_user_can_use
+      unless current_or_guest_user.admin? || @module_app.is_manager?(current_or_guest_user) || @module_app.is_sub_manager?(current_or_guest_user) || @module_app.can_approve?(current_or_guest_user)
         redirect_to root_url
       end
     end

lib/orbit_model/authorizable.rb

@@ -0,0 +1,55 @@
+module OrbitModel
+
+  module Authorizable
+
+    def self.included(base)
+      base.class_eval do
+        has_one :auth_approval, as: :approval_authorizable, dependent: :destroy
+        has_one :auth_sub_manager, as: :sub_manager_authorizable, dependent: :destroy
+        delegate :authorized_users, to: :auth_approval, prefix: true, allow_nil: true
+        delegate :authorized_users, to: :auth_sub_manager, prefix: true, allow_nil: true
+        send :include, InstanceMethods
+      end
+    end
+
+    module InstanceMethods
+
+    	# Normal case
+    	# Use of categories to define approval and sub-manager
+	    def approval_users
+	    	auth_approval_authorized_users
+	    end
+
+	    def sub_managers
+	    	auth_sub_manager_authorized_users
+	    end
+
+    	def user_can_approve?(user)
+    		approval_users.include?(user) if approval_users
+    	end
+
+    	def user_can_sub_manage?(user)
+    		sub_managers.include?(user) if sub_managers
+    	end
+
+    	# Specific case
+    	# Approval or sub-manager is defined on something else than categories
+	    def authorized_users_by_title(title)
+	    	approval_users if auth_approval && auth_approval.title.eql?(title)
+	    	sub_managers if auth_sub_manager && auth_sub_manager.title.eql?(title)
+	    end
+
+	    def get_authorization_by_title(title)
+	    	auth_approval if auth_approval && auth_approval.title.eql?(title)
+	    	auth_sub_manager if auth_sub_manager && auth_sub_manager.title.eql?(title)
+	    end
+
+    	def user_is_authorized_by_title?(user, title)
+    		authorized_users_by_title(title).include?(user)
+    	end
+
+    end
+    
+  end
+
+end