Commit f9bcb963 authored by Douwe Maan's avatar Douwe Maan

Add specific ability for managing group members

parent 43d11880
...@@ -21,6 +21,8 @@ class Groups::GroupMembersController < Groups::ApplicationController ...@@ -21,6 +21,8 @@ class Groups::GroupMembersController < Groups::ApplicationController
end end
def create def create
return render_403 unless can?(current_user, :admin_group_member, @group)
@group.add_users(params[:user_ids].split(','), params[:access_level], current_user) @group.add_users(params[:user_ids].split(','), params[:access_level], current_user)
redirect_to group_group_members_path(@group), notice: 'Users were successfully added.' redirect_to group_group_members_path(@group), notice: 'Users were successfully added.'
...@@ -28,6 +30,9 @@ class Groups::GroupMembersController < Groups::ApplicationController ...@@ -28,6 +30,9 @@ class Groups::GroupMembersController < Groups::ApplicationController
def update def update
@member = @group.group_members.find(params[:id]) @member = @group.group_members.find(params[:id])
return render_403 unless can?(current_user, :update_group_member, @member)
@member.update_attributes(member_params) @member.update_attributes(member_params)
end end
...@@ -46,6 +51,8 @@ class Groups::GroupMembersController < Groups::ApplicationController ...@@ -46,6 +51,8 @@ class Groups::GroupMembersController < Groups::ApplicationController
end end
def resend_invite def resend_invite
return render_403 unless can?(current_user, :admin_group_member, @group)
redirect_path = group_group_members_path(@group) redirect_path = group_group_members_path(@group)
@group_member = @group.group_members.find(params[:id]) @group_member = @group.group_members.find(params[:id])
......
...@@ -233,7 +233,8 @@ class Ability ...@@ -233,7 +233,8 @@ class Ability
if group.has_owner?(user) || user.admin? if group.has_owner?(user) || user.admin?
rules.push(*[ rules.push(*[
:admin_group, :admin_group,
:admin_namespace :admin_namespace,
:admin_group_member
]) ])
end end
...@@ -295,7 +296,7 @@ class Ability ...@@ -295,7 +296,7 @@ class Ability
rules = [] rules = []
target_user = subject.user target_user = subject.user
group = subject.group group = subject.group
can_manage = group_abilities(user, group).include?(:admin_group) can_manage = group_abilities(user, group).include?(:admin_group_member)
if can_manage && (user != target_user) if can_manage && (user != target_user)
rules << :update_group_member rules << :update_group_member
......
...@@ -23,6 +23,7 @@ ...@@ -23,6 +23,7 @@
%i.fa.fa-cogs %i.fa.fa-cogs
Settings Settings
- if can?(current_user, :destroy_group_member, group_member)
= link_to leave_group_group_members_path(group), data: { confirm: leave_group_message(group.name) }, method: :delete, class: "btn-sm btn btn-grouped", title: 'Leave this group' do = link_to leave_group_group_members_path(group), data: { confirm: leave_group_message(group.name) }, method: :delete, class: "btn-sm btn btn-grouped", title: 'Leave this group' do
%i.fa.fa-sign-out %i.fa.fa-sign-out
Leave Leave
......
...@@ -24,7 +24,7 @@ ...@@ -24,7 +24,7 @@
= link_to member.created_by.name, user_path(member.created_by) = link_to member.created_by.name, user_path(member.created_by)
= time_ago_with_tooltip(member.created_at) = time_ago_with_tooltip(member.created_at)
- if show_controls && can?(current_user, :admin_group, @group) - if show_controls && can?(current_user, :admin_group_member, member)
= link_to resend_invite_group_group_member_path(@group, member), method: :post, class: "btn-xs btn", title: 'Resend invite' do = link_to resend_invite_group_group_member_path(@group, member), method: :post, class: "btn-xs btn", title: 'Resend invite' do
Resend invite Resend invite
......
...@@ -17,7 +17,7 @@ ...@@ -17,7 +17,7 @@
= search_field_tag :search, params[:search], { placeholder: 'Find existing member by name', class: 'form-control search-text-input' } = search_field_tag :search, params[:search], { placeholder: 'Find existing member by name', class: 'form-control search-text-input' }
= button_tag 'Search', class: 'btn' = button_tag 'Search', class: 'btn'
- if current_user && current_user.can?(:admin_group, @group) - if current_user && current_user.can?(:admin_group_member, @group)
.pull-right .pull-right
= button_tag class: 'btn btn-new js-toggle-button', type: 'button' do = button_tag class: 'btn btn-new js-toggle-button', type: 'button' do
Add members Add members
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment