First version for App and Object auth.Taking Announcement as experiment

app/controllers/admin/object_auths_controller.rb

@@ -1,8 +1,12 @@
 class Admin::ObjectAuthsController < ApplicationController
+  include OrbitCoreLib::PermissionUnility
   layout "admin"
   before_filter :authenticate_user!
+  before_filter :check_if_user_can_do_object_auth
 #  before_filter :is_admin? ,:only => :index
   
+
+  
   def index
     # if current_user.admin?
       @object_auths = ObjectAuth.all
@@ -70,7 +74,11 @@ class Admin::ObjectAuthsController < ApplicationController
   def edit
     @object_auth = ObjectAuth.find(params[:id])
   end
-  
-
 
+private
+  def check_if_user_can_do_object_auth
+    unless  check_permission(:manager)
+      render :nothing => true, :status => 403 
+    end
+  end
 end

app/controllers/obit_frontend_controller.rb

@@ -1,3 +0,0 @@
-class ObitFrontendController< ObitFrontendComponentController
-
-end

app/controllers/obit_widget_controller.rb

@@ -1,3 +0,0 @@
-class ObitWidgetController< ObitFrontendComponentController
-
-end

app/controllers/orbit_backend_controller.rb

@@ -0,0 +1,24 @@
+class OrbitBackendController< ApplicationController
+  before_filter :authenticate_user!
+  before_filter :setup_vars
+ # before_filter {|c| c.front_end_available(@app_title)}
+  before_filter :check_user_can_use,:except => [:public]
+  include OrbitCoreLib::PermissionUnility
+  
+  layout 'admin'
+  
+  def setup_vars
+    @app_title = request.fullpath.split('/')[2]
+    @module_app = ModuleApp.first(conditions: {:key => @app_title} )
+    
+  end
+  
+  private
+  
+  def check_user_can_use 
+    unless check_permission
+      redirect_to polymorphic_path(['panel',@app_title,'back_end','public'])
+    end
+  end
+  
+end

app/controllers/orbit_frontend_component_controller.rb

@@ -1,4 +1,4 @@
-class ObitFrontendComponentController< ApplicationController
+class OrbitFrontendComponentController< ApplicationController
   before_filter :setup_vars
   before_filter {|c| c.front_end_available(@app_title)}
   layout 'module_widget'

app/controllers/orbit_frontend_controller.rb

@@ -0,0 +1,3 @@
+class OrbitFrontendController< OrbitFrontendComponentController
+
+end

app/controllers/orbit_widget_controller.rb

@@ -0,0 +1,3 @@
+class ObitWidgetController< OrbitFrontendComponentController
+
+end

app/helpers/admin/app_auth_helper.rb

@@ -3,4 +3,9 @@ module Admin::AppAuthHelper
     link_to t(:enable), eval("admin_#{attribute_type}_path(attribute, :authenticity_token => form_authenticity_token, :#{attribute_type} => {:disabled => true})"), :remote => true, :method => :put, :id => "disable_#{attribute.id}", :style => "display:#{attribute.is_disabled? ? 'none' : ''}", :class => 'switch' 
     link_to t(:disable), eval("admin_#{attribute_type}_path(attribute, :authenticity_token => form_authenticity_token, :#{attribute_type} => {:disabled => false})"), :remote => true, :method => :put, :id => "enable_#{attribute.id}", :style => "display:#{attribute.is_disabled? ? '' : 'none'}", :class => 'switch'
   end
+  
+  def if_permitted_to(user,role)
+    
+  end
+  
 end

app/helpers/admin_helper.rb

@@ -5,4 +5,17 @@ module AdminHelper
     link_to('/' , admin_items_path) + ( @parent_items.map{ |i| link_to(i.name, admin_items_path(:parent_id=>i.id) ) } << @parent_item.name ).join("/").html_safe
   end
   
+  # Check if the current_user is manager in current module app
+  def is_manager?
+    @module_app.is_manager?(current_user) || is_admin?
+  end
+
+  # Check if the current_user is sub manager in current module app
+  def is_sub_manager?
+    @module_app.is_sub_manager?(current_user)|| is_admin?
+  end
+  
+  def is_admin?
+    current_user.admin?
+  end
 end

app/models/app_auth.rb

@@ -2,4 +2,5 @@ class AppAuth < PrototypeAuth
 
   belongs_to :module_app
   
+  
 end

app/models/module_app.rb

@@ -26,6 +26,14 @@ class ModuleApp
   
   before_save :set_key
   
+  def is_manager?(user)
+    managing_users.include?(user)
+  end
+  
+  def is_sub_manager?(user)
+    sub_managing_users.include?(user) || is_manager?(user)
+  end
+  
   def managing_users
     self.managers.collect{ |t| t.user }
   end

app/models/prototype_auth.rb

@@ -16,7 +16,7 @@ class PrototypeAuth
   has_and_belongs_to_many :roles
   has_and_belongs_to_many :sub_roles
   
-  attr_protected :roles,:sub_roles,:privilege_users,:blocked_users,:users
+  attr_protected :roles,:sub_roles,:privilege_users,:blocked_users
 
   def add_role role
     add_operation(:roles,role)

app/views/admin/module_apps/_app_selector.html.erb

@@ -1 +0,0 @@
-<%= f.select :module_app_id, @apps.collect { |t| [t.title.capitalize, t.id] }, {}, {:rel => admin_module_apps_path } %>

app/views/admin/object_auths/edit.html.erb

@@ -11,4 +11,4 @@
 <%= render :partial => "admin/components/user_role_management", :locals => { 
 	:object => @object_auth.auth_obj ,:auth=>@object_auth,:submit_url=>create_role_admin_object_auth_path(@object_auth),:ploy_route_ary=>['remove',:admin,@object_auth] } %>
 
-
+<%= link_to 'Back to object',eval(@object_auth.obj_authable.class.to_s+"::AfterObjectAuthUrl")  %>