Company policy

Refs #1780

5 files changed, 50 insertions, 14 deletions

diff --git a/app/controllers/companies_controller.rb b/app/controllers/companies_controller.rb
index cd0467a21..78b9f43a0 100644
--- a/app/controllers/companies_controller.rb
+++ b/app/controllers/companies_controller.rb
@@ -1,6 +1,6 @@
 class CompaniesController < BreadcrumbController
   include ApplicationHelper
-
+  before_action :check_policy, :only => [:edit, :update, :destroy]
   defaults :resource_class => Chouette::Company
   respond_to :html
   respond_to :xml
@@ -10,7 +10,6 @@ class CompaniesController < BreadcrumbController
   belongs_to :line_referential
 
   def index
-
     index! do |format|
       format.html {
         if collection.out_of_bounds?
@@ -21,6 +20,16 @@ class CompaniesController < BreadcrumbController
     end
   end
 
+  def new
+    authorize resource_class
+    super
+  end
+
+  def create
+    authorize resource_class
+    super
+  end
+
 
   protected
   def collection
@@ -39,6 +48,10 @@ class CompaniesController < BreadcrumbController
 
   alias_method :line_referential, :parent
 
+  def check_policy
+    authorize resource
+  end
+
   def company_params
     params.require(:company).permit( :objectid, :object_version, :creation_time, :creator_id, :name, :short_name, :organizational_unit, :operating_department_name, :code, :phone, :fax, :email, :registration_number, :url, :time_zone )
   end
diff --git a/app/policies/company_policy.rb b/app/policies/company_policy.rb
new file mode 100644
index 000000000..d28e9b515
--- /dev/null
+++ b/app/policies/company_policy.rb
@@ -0,0 +1,15 @@
+class CompanyPolicy < ApplicationPolicy
+  class Scope < Scope
+    def resolve
+      scope
+    end
+  end
+
+  def create?
+    false
+  end
+  def update?  ; create? end
+  def new?     ; create? end
+  def edit?    ; create? end
+  def destroy? ; create? end
+end
diff --git a/app/views/companies/index.html.slim b/app/views/companies/index.html.slim
index bf295dee7..1b616a6c8 100644
--- a/app/views/companies/index.html.slim
+++ b/app/views/companies/index.html.slim
@@ -20,6 +20,7 @@
 
 - content_for :sidebar do
   ul.actions
-    li
-      = link_to t('companies.actions.new'), new_line_referential_company_path(@line_referential), class: 'add'
-  br
\ No newline at end of file
+    - if policy(Chouette::Company).create?
+      li
+        = link_to t('companies.actions.new'), new_line_referential_company_path(@line_referential), class: 'add'
+    br
diff --git a/app/views/companies/show.html.slim b/app/views/companies/show.html.slim
index 693cea352..1c244a53a 100644
--- a/app/views/companies/show.html.slim
+++ b/app/views/companies/show.html.slim
@@ -44,12 +44,15 @@
 
 - content_for :sidebar do
   ul.actions
-    li
-      = link_to t('companies.actions.new'), new_line_referential_company_path(@line_referential), class: 'add'
-    li
-      = link_to t('companies.actions.edit'), edit_line_referential_company_path(@line_referential, @company), class: 'edit'
-    li
-      = link_to  t('companies.actions.destroy'), line_referential_company_path(@line_referential, @company), :method => :delete,  :data => {:confirm =>  t('companies.actions.destroy_confirm')}, class: 'remove'
-    br
-
-  = creation_tag(@company)
\ No newline at end of file
+    - if policy(Chouette::Company).create?
+      li
+        = link_to t('companies.actions.new'), new_line_referential_company_path(@line_referential), class: 'add'
+    - if policy(@company).update?
+      li
+        = link_to t('companies.actions.edit'), edit_line_referential_company_path(@line_referential, @company), class: 'edit'
+    - if policy(@company).destroy?
+      li
+        = link_to  t('companies.actions.destroy'), line_referential_company_path(@line_referential, @company), :method => :delete,  :data => {:confirm =>  t('companies.actions.destroy_confirm')}, class: 'remove'
+      br
+
+  = creation_tag(@company)
diff --git a/spec/policies/company_policy_spec.rb b/spec/policies/company_policy_spec.rb
new file mode 100644
index 000000000..7109b628f
--- /dev/null
+++ b/spec/policies/company_policy_spec.rb
@@ -0,0 +1,4 @@
+require 'rails_helper'
+
+RSpec.describe CompanyPolicy do
+end