Skip to content

Commit 964059e

Browse files
sampoderalexbluo
sampoder
authored and
alexbluo
committed
Revert "Revert "Reader permission fixes"" (hackclub#10853)
1 parent 5e76ee7 commit 964059e

File tree

8 files changed

+103
-82
lines changed

8 files changed

+103
-82
lines changed

‎app/controllers/receiptables_controller.rb‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ class ReceiptablesController < ApplicationController
55
skip_after_action :verify_authorized # do not force pundit
66

77
def mark_no_or_lost
8+
authorize @receiptable, policy_class: ReceiptablePolicy
9+
810
if @receiptable.no_or_lost_receipt!
911
flash[:success] = "Marked no/lost receipt on that transaction."
1012
redirect_to @receiptable

‎app/policies/receiptable_policy.rb‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,20 @@
11
# frozen_string_literal: true
22

33
class ReceiptablePolicy < ApplicationPolicy
4-
def link?
4+
def upload?
55
user&.admin? || present_in_events? || Pundit.policy(user, record).try(:receiptable_upload?)
66
end
77

8+
def link?
9+
upload?
10+
end
11+
812
def link_modal?
9-
user&.admin? || present_in_events? || Pundit.policy(user, record).try(:receiptable_upload?)
13+
upload?
1014
end
1115

12-
def upload?
13-
user&.admin? || present_in_events? || Pundit.policy(user, record).try(:receiptable_upload?)
16+
def mark_no_or_lost?
17+
upload?
1418
end
1519

1620
private

‎app/views/canonical_pending_transactions/_canonical_pending_transaction.html.erb‎

Lines changed: 22 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -85,27 +85,29 @@
8585
<% end %>
8686
</div>
8787
<% end %>
88-
<div class="overflow-visible relative" style="margin-left: 0.5rem;" data-controller="menu" data-menu-append-to-value="turbo-frame#ledger">
89-
<button class="list-badge add-tag-badge ml0 menu__toggle menu__toggle--arrowless" data-menu-target="toggle" data-action="menu#toggle click@document->menu#close keydown@document->menu#keydown">+ Add tag</button>
90-
<div class="menu__content menu__content--2 menu__content--compact menu__content--left text-sm" data-menu-target="content">
91-
<% (@event || pt.local_hcb_code.event).tags.each do |tag| %>
92-
<div class="flex items-center" data-tag="<%= tag.id %>">
93-
<%= button_to toggle_tag_hcb_code_path(id: pt.local_hcb_code.hashid, tag_id: tag.id), class: "menu__action #{tag_dom_id(pt.local_hcb_code, tag, "_toggle")}", form_class: "flex-auto", form: { "data-turbo" => "true" } do %>
94-
<%= render partial: "canonical_transactions/tag_icon", locals: { tag: } %>
95-
<%= tag.label %>
96-
<%= "✓" if tagged_with.include?(tag) %>
97-
<% end %>
98-
<%= button_to event_tag_path(@event || pt.local_hcb_code.event, tag), class: "menu__action", method: :delete, title: "Delete this tag", form: { "data-turbo" => "true", "data-turbo-confirm" => tag.removal_confirmation_message } do %>
99-
<%= inline_icon "delete", size: 18, style: "margin: 0" %>
100-
<% end %>
101-
</div>
102-
<% end %>
103-
<% if (@event || pt.local_hcb_code.event).tags.any? %>
104-
<div class="menu__divider tags__divider"></div>
105-
<% end %>
106-
<%= render partial: "hcb_codes/create_tag", locals: { button: pt.local_hcb_code.hashid } %>
88+
<% if policy(pt.local_hcb_code).toggle_tag? %>
89+
<div class="overflow-visible relative" style="margin-left: 0.5rem;" data-controller="menu" data-menu-append-to-value="turbo-frame#ledger">
90+
<button class="list-badge add-tag-badge ml0 menu__toggle menu__toggle--arrowless" data-menu-target="toggle" data-action="menu#toggle click@document->menu#close keydown@document->menu#keydown">+ Add tag</button>
91+
<div class="menu__content menu__content--2 menu__content--compact menu__content--left text-sm" data-menu-target="content">
92+
<% (@event || pt.local_hcb_code.event).tags.each do |tag| %>
93+
<div class="flex items-center" data-tag="<%= tag.id %>">
94+
<%= button_to toggle_tag_hcb_code_path(id: pt.local_hcb_code.hashid, tag_id: tag.id), class: "menu__action #{tag_dom_id(pt.local_hcb_code, tag, "_toggle")}", form_class: "flex-auto", form: { "data-turbo" => "true" } do %>
95+
<%= render partial: "canonical_transactions/tag_icon", locals: { tag: } %>
96+
<%= tag.label %>
97+
<%= "✓" if tagged_with.include?(tag) %>
98+
<% end %>
99+
<%= button_to event_tag_path(@event || pt.local_hcb_code.event, tag), class: "menu__action", method: :delete, title: "Delete this tag", form: { "data-turbo" => "true", "data-turbo-confirm" => tag.removal_confirmation_message } do %>
100+
<%= inline_icon "delete", size: 18, style: "margin: 0" %>
101+
<% end %>
102+
</div>
103+
<% end %>
104+
<% if (@event || pt.local_hcb_code.event).tags.any? %>
105+
<div class="menu__divider tags__divider"></div>
106+
<% end %>
107+
<%= render partial: "hcb_codes/create_tag", locals: { button: pt.local_hcb_code.hashid } %>
108+
</div>
107109
</div>
108-
</div>
110+
<% end %>
109111
<% end %>
110112
<% if pt.local_hcb_code %>
111113
<%= list_badge_for auditor_signed_in? ? pt.local_hcb_code.comments.size : pt.local_hcb_code.not_admin_only_comments_count, "comment", "post", optional: true %>

‎app/views/canonical_transactions/_canonical_transaction.html.erb‎

Lines changed: 22 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -83,27 +83,29 @@
8383
<% end %>
8484
</div>
8585
<% end %>
86-
<div class="overflow-visible relative" style="margin-left: 0.5rem;" data-controller="menu" data-menu-append-to-value="turbo-frame#ledger">
87-
<button class="list-badge add-tag-badge ml0 menu__toggle menu__toggle--arrowless" data-menu-target="toggle" data-action="menu#toggle click@document->menu#close keydown@document->menu#keydown">+ Add tag</button>
88-
<div class="menu__content menu__content--2 menu__content--compact menu__content--left text-sm" data-menu-target="content">
89-
<% (@event || ct.local_hcb_code.event).tags.each do |tag| %>
90-
<div class="flex items-center" data-tag="<%= tag.id %>">
91-
<%= button_to toggle_tag_hcb_code_path(id: ct.local_hcb_code.hashid, tag_id: tag.id), class: "menu__action #{tag_dom_id(ct.local_hcb_code, tag, "_toggle")}", form_class: "flex-auto", form: { "data-turbo" => "true" } do %>
92-
<%= render partial: "canonical_transactions/tag_icon", locals: { tag: } %>
93-
<%= tag.label %>
94-
<%= "✓" if tagged_with.include?(tag) %>
95-
<% end %>
96-
<%= button_to event_tag_path(@event || ct.local_hcb_code.event, tag), class: "menu__action", method: :delete, title: "Delete this tag", form: { "data-turbo" => "true", "data-turbo-confirm" => tag.removal_confirmation_message } do %>
97-
<%= inline_icon "delete", size: 18, style: "margin: 0" %>
98-
<% end %>
99-
</div>
100-
<% end %>
101-
<% if (@event || ct.local_hcb_code.event).tags.any? %>
102-
<div class="menu__divider tags__divider"></div>
103-
<% end %>
104-
<%= render partial: "hcb_codes/create_tag", locals: { button: ct.local_hcb_code.hashid } %>
86+
<% if policy(ct.local_hcb_code).toggle_tag? %>
87+
<div class="overflow-visible relative" style="margin-left: 0.5rem;" data-controller="menu" data-menu-append-to-value="turbo-frame#ledger">
88+
<button class="list-badge add-tag-badge ml0 menu__toggle menu__toggle--arrowless" data-menu-target="toggle" data-action="menu#toggle click@document->menu#close keydown@document->menu#keydown">+ Add tag</button>
89+
<div class="menu__content menu__content--2 menu__content--compact menu__content--left text-sm" data-menu-target="content">
90+
<% (@event || ct.local_hcb_code.event).tags.each do |tag| %>
91+
<div class="flex items-center" data-tag="<%= tag.id %>">
92+
<%= button_to toggle_tag_hcb_code_path(id: ct.local_hcb_code.hashid, tag_id: tag.id), class: "menu__action #{tag_dom_id(ct.local_hcb_code, tag, "_toggle")}", form_class: "flex-auto", form: { "data-turbo" => "true" } do %>
93+
<%= render partial: "canonical_transactions/tag_icon", locals: { tag: } %>
94+
<%= tag.label %>
95+
<%= "✓" if tagged_with.include?(tag) %>
96+
<% end %>
97+
<%= button_to event_tag_path(@event || ct.local_hcb_code.event, tag), class: "menu__action", method: :delete, title: "Delete this tag", form: { "data-turbo" => "true", "data-turbo-confirm" => tag.removal_confirmation_message } do %>
98+
<%= inline_icon "delete", size: 18, style: "margin: 0" %>
99+
<% end %>
100+
</div>
101+
<% end %>
102+
<% if (@event || ct.local_hcb_code.event).tags.any? %>
103+
<div class="menu__divider tags__divider"></div>
104+
<% end %>
105+
<%= render partial: "hcb_codes/create_tag", locals: { button: ct.local_hcb_code.hashid } %>
106+
</div>
105107
</div>
106-
</div>
108+
<% end %>
107109
<% end %>
108110
<% if ct.local_hcb_code %>
109111
<%= list_badge_for auditor_signed_in? ? ct.local_hcb_code.comments.size : ct.local_hcb_code.not_admin_only_comments_count, "comment", "post", optional: true %>

‎app/views/events/promotions.html.erb‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
<% page_md %>
33
<%= render "events/nav", selected: :promotions %>
44

5-
<% @perks_available = organizer_signed_in? && [email protected]_mode? %>
5+
<% @perks_available = OrganizerPosition.role_at_least?(current_user, @event, :manager) && organizer_signed_in? && [email protected]_mode? %>
66

77
<h1>
88
Promotions &amp; perks
@@ -86,7 +86,7 @@
8686
</div>
8787

8888
<p>
89-
<%= link_to "The Event Helper", "https://www.theeventhelper.com/", target: :_blank %>
89+
<%= link_to "The Event Helper", "https://www.theeventhelper.com/", class: ("disabled" unless @perks_available).to_s, target: :_blank %>
9090
is partnering with HCB to create a simplified way for your team to
9191
purchase event insurance. Just apply with your event details to receive a quote from the HCB team.
9292
All costs are directly from The Event Helper, we don't charge a fee on top.
@@ -146,14 +146,14 @@
146146

147147
<% if @event.hackathon? %>
148148
<p class="mb0">
149-
<%= link_to "1Password", "https://1password.com" %> is offering hackathons running on HCB
149+
<%= link_to "1Password", "https://1password.com", class: ("disabled" unless @perks_available) %> is offering hackathons running on HCB
150150
a year-long 1Password plan for up to 5 people. This can handed out as a prize, however, it
151151
can only be claimed once per hackathon.
152152
</p>
153153
<% else %>
154154
<h3 class="mb0 mt0">Do you make open source software?</h3>
155155
<p class="mb0">
156-
<%= link_to "1Password", "https://1password.com" %> is offering a lifetime 1Password Teams
156+
<%= link_to "1Password", "https://1password.com", class: ("disabled" unless @perks_available) %> is offering a lifetime 1Password Teams
157157
license (up to 10 seats) to any open source project running on HCB.
158158
</p>
159159
<h3 class="mb0 mt2">Does your nonprofit do something else?</h3>

‎app/views/hcb_codes/_create_tag.html.erb‎

Lines changed: 31 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,34 @@
1-
<% if button %>
2-
<%= link_to "#", class: "menu__input #{ "btn mt-3" if defined?(large)}", data: { behavior: "modal_trigger", modal: "create_tag" }, onclick: "document.getElementById('create_tag_hcb_code_id').value = #{button.to_json}" do %>
3-
<%= inline_icon "plus", size: 15 %>
4-
Create tag
5-
<% end %>
6-
<% else %>
7-
<section class="modal modal--scroll max-w-md bg-snow" data-behavior="modal" role="dialog" id="create_tag">
8-
<%= modal_header("Create tag") %>
9-
<%= form_with url: event_tags_path(@event), id: "create_tag_form", data: { turbo: true } do |form| %>
10-
<%= form.hidden_field :hcb_code_id, value: "", id: "create_tag_hcb_code_id" %>
11-
<div class="flex flex-col gap-3 mb-2">
12-
<div class="flex gap-3">
13-
<div data-controller="emoji-picker" class="relative" data-emoji-picker-target="container">
14-
<%= form.text_field :emoji, placeholder: "🏦", class: "!w-10 placeholder:opacity-50", autocomplete: "off", data: { turbo: true, "emoji-picker-target": "input", "action": "focus->emoji-picker#togglePicker input->emoji-picker#validateInput" }, required: true %>
15-
<emoji-picker data-emoji-picker-target="picker" data-action="emoji-click->emoji-picker#addEmoji" class="fixed mt-3 z-[300]" style="display: none;"></emoji-picker>
1+
<% if OrganizerPosition.role_at_least?(current_user, @event, :member) %>
2+
<% if button %>
3+
<%= link_to "#", class: "menu__input #{ "btn mt-3" if defined?(large)}", data: { behavior: "modal_trigger", modal: "create_tag" }, onclick: "document.getElementById('create_tag_hcb_code_id').value = #{button.to_json}" do %>
4+
<%= inline_icon "plus", size: 15 %>
5+
Create tag
6+
<% end %>
7+
<% else %>
8+
<section class="modal modal--scroll max-w-md bg-snow" data-behavior="modal" role="dialog" id="create_tag">
9+
<%= modal_header("Create tag") %>
10+
<%= form_with url: event_tags_path(@event), id: "create_tag_form", data: { turbo: true } do |form| %>
11+
<%= form.hidden_field :hcb_code_id, value: "", id: "create_tag_hcb_code_id" %>
12+
<div class="flex flex-col gap-3 mb-2">
13+
<div class="flex gap-3">
14+
<div data-controller="emoji-picker" class="relative" data-emoji-picker-target="container">
15+
<%= form.text_field :emoji, placeholder: "🏦", class: "!w-10 placeholder:opacity-50", autocomplete: "off", data: { turbo: true, "emoji-picker-target": "input", "action": "focus->emoji-picker#togglePicker input->emoji-picker#validateInput" }, required: true %>
16+
<emoji-picker data-emoji-picker-target="picker" data-action="emoji-click->emoji-picker#addEmoji" class="fixed mt-3 z-[300]" style="display: none;"></emoji-picker>
17+
</div>
18+
<%= form.text_field :label, autofocus: true, placeholder: "Tag name", style: "max-width: 100%", autocomplete: "off", data: { turbo: true }, required: true %>
19+
</div>
20+
<div class="flex gap-3">
21+
<% Tag::COLORS.each do |color| %>
22+
<label class="tags__radio">
23+
<%# Default color: Muted %>
24+
<%= form.radio_button :color, color, checked: color == "muted" %>
25+
<div class="radio__control tag-darker tag-<%= color %>"></div>
26+
</label>
27+
<% end %>
28+
</div>
1629
</div>
17-
<%= form.text_field :label, autofocus: true, placeholder: "Tag name", style: "max-width: 100%", autocomplete: "off", data: { turbo: true }, required: true %>
18-
</div>
19-
<div class="flex gap-3">
20-
<% Tag::COLORS.each do |color| %>
21-
<label class="tags__radio">
22-
<%# Default color: Muted %>
23-
<%= form.radio_button :color, color, checked: color == "muted" %>
24-
<div class="radio__control tag-darker tag-<%= color %>"></div>
25-
</label>
26-
<% end %>
27-
</div>
28-
</div>
29-
<%= form.submit "Create", class: "btn bg-info mt-2 float-right" %>
30+
<%= form.submit "Create", class: "btn bg-info mt-2 float-right" %>
31+
<% end %>
32+
</section>
3033
<% end %>
31-
</section>
3234
<% end %>

‎app/views/hcb_codes/_tags.html.erb‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,9 @@
66
</div>
77

88
<div data-controller="menu">
9-
<button class="list-badge add-tag-badge ml0 menu__toggle menu__toggle--arrowless h-full" style="height: 1.6rem" data-menu-target="toggle" data-action="menu#toggle click@document->menu#close keydown@document->menu#keydown">+ Add tag</button>
9+
<% if policy(Tag.new).create? %>
10+
<button class="list-badge add-tag-badge ml0 menu__toggle menu__toggle--arrowless h-full" style="height: 1.6rem" data-menu-target="toggle" data-action="menu#toggle click@document->menu#close keydown@document->menu#keydown">+ Add tag</button>
11+
<% end %>
1012
<div class="menu__content menu__content--2 menu__content--compact menu__content--left text-sm" data-menu-target="content">
1113
<% @event.tags.each do |tag| %>
1214
<div class="flex items-center" data-tag="<%= tag.id %>">
@@ -15,8 +17,10 @@
1517
<%= tag.label %>
1618
<%= "✓" if hcb_code.tags.include?(tag) %>
1719
<% end %>
18-
<%= button_to event_tag_path(@event, tag), class: "menu__action", method: :delete, title: "Delete this tag", form: { "data-turbo" => "true", "data-turbo-confirm" => tag.removal_confirmation_message } do %>
19-
<%= inline_icon "delete", size: 16, style: "margin: 0" %>
20+
<% if policy(tag).destroy? %>
21+
<%= button_to event_tag_path(@event, tag), class: "menu__action", method: :delete, title: "Delete this tag", form: { "data-turbo" => "true", "data-turbo-confirm" => tag.removal_confirmation_message } do %>
22+
<%= inline_icon "delete", size: 16, style: "margin: 0" %>
23+
<% end %>
2024
<% end %>
2125
</div>
2226
<% end %>

‎app/views/receipts/_form_v3.html.erb‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,12 @@
6262
"action" => "change->form#submit"
6363
} %>
6464
<span class="flex items-center justify-center flex-row flex-wrap" style="margin: -8px;">
65-
<%= form.label :file, class: "btn m1 #{"bg-success" if local_assigns[:success]} #{"bg-error" if local_assigns[:error]}", id: "upload-receipt-button" do %>
65+
<% additional_classes = [].tap do |array|
66+
array << "bg-success" if local_assigns[:success]
67+
array << "bg-error" if local_assigns[:error]
68+
array << "disabled" if defined?(receiptable) && !ReceiptablePolicy.new(current_user, receiptable).upload?
69+
end.join(", ") %>
70+
<%= form.label :file, class: "btn m1 #{additional_classes}", id: "upload-receipt-button" do %>
6671
<%= inline_icon "cloud-upload" %>
6772
<% if local_assigns[:success] || local_assigns[:error] %>
6873
<span id="upload-receipt-button-text"><%= local_assigns[:success] || local_assigns[:error] %></span>
@@ -80,7 +85,7 @@
8085
<% end %>
8186
<% end %>
8287
<% if defined?(enable_linking) %>
83-
<%= link_to my_receipts_upload_path(current_user), class: "btn bg-primary m1", data: defined?(inline_linking) ? nil : { behavior: "modal_trigger", modal: "link_receipt_#{instance}" }, onclick: defined?(inline_linking) ? "event.preventDefault(); $('#link_receipt_#{instance}_select').show(); $('#link_receipt_#{instance}_form').hide();" : "" do %>
88+
<%= link_to my_receipts_upload_path(current_user), class: "btn bg-primary m1 #{"disabled" if defined?(receiptable) && !ReceiptablePolicy.new(current_user, receiptable).link_modal?}", data: defined?(inline_linking) ? nil : { behavior: "modal_trigger", modal: "link_receipt_#{instance}" }, onclick: defined?(inline_linking) ? "event.preventDefault(); $('#link_receipt_#{instance}_select').show(); $('#link_receipt_#{instance}_form').hide();" : "" do %>
8489
<%= inline_icon "payment-docs" %>
8590
<span>Select from Receipt Bin</span>
8691
<% end %>

0 commit comments

Comments
 (0)