Fix import policy to not authorize destroy and not be linked with referential state (archived) Refs #5093

2 files changed, 16 insertions, 4 deletions

diff --git a/app/policies/compliance_check_set_policy.rb b/app/policies/compliance_check_set_policy.rb
index 171a33347..85e7e8ddd 100644
--- a/app/policies/compliance_check_set_policy.rb
+++ b/app/policies/compliance_check_set_policy.rb
@@ -3,5 +3,17 @@ class ComplianceCheckSetPolicy < ApplicationPolicy
     def resolve
       scope
     end
+
+      def create?
+        false # ComplianceCheckSet can not be created from controller
+      end
+
+      def destroy?
+        false # Asynchronous operations must not be deleted
+      end
+
+      def update?
+        false # ComplianceCheckSet can not be updated from controller
+      end
   end
-end
\ No newline at end of file
+end
diff --git a/app/policies/import_policy.rb b/app/policies/import_policy.rb
index b12dcc167..b5e8c5b7e 100644
--- a/app/policies/import_policy.rb
+++ b/app/policies/import_policy.rb
@@ -6,14 +6,14 @@ class ImportPolicy < ApplicationPolicy
   end
 
   def create?
-    !archived? && user.has_permission?('imports.create')
+    user.has_permission?('imports.create')
   end
 
   def destroy?
-    !archived? && user.has_permission?('imports.destroy')
+    false # Asynchronous operations must not be deleted
   end
 
   def update?
-    !archived? && user.has_permission?('imports.update')
+    user.has_permission?('imports.update')
   end
 end