Authorisation management using CanCanCan added

app/models/ability.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+class Ability
+  include CanCan::Ability
+
+  def initialize(user)
+
+    # Define abilities for the passed in user here. For example:
+    #
+    #   user ||= User.new # guest user (not logged in)
+    #   if user.admin?
+    #     can :manage, :all
+    #   else
+    #     can :read, :all
+    #   end
+    #
+    # The first argument to `can` is the action you are giving the user
+    # permission to do.
+    # If you pass :manage it will apply to every action. Other common actions
+    # here are :read, :create, :update and :destroy.
+    #
+    # The second argument is the resource the user can perform the action on.
+    # If you pass :all it will apply to every resource. Otherwise pass a Ruby
+    # class of the resource.
+    #
+    # The third argument is an optional hash of conditions to further filter the
+    # objects.
+    # For example, here the user can only update published articles.
+    #
+    #   can :update, Article, :published => true
+    #
+    # See the wiki for details:
+    # https://github.com/CanCanCommunity/cancancan/wiki/Defining-Abilities
+
+    if user.present? # Logged-in users
+      if user.admin_role?
+        can :approve, Screenshot
+        can :destroy, Screenshot
+        can :destroy, User
+        can :view, Screenshot
+        can :destroy, Package
+      end
+      if user.moderator_role?
+        can :approve, Screenshot
+        can :view, Screenshot
+        can :destroy, Screenshot
+      end
+      if user.pseudo?
+        # Allow to view all public/approved screenshots
+        can :view, Screenshot, approved: true
+        # Allow to view any own uploads (even not-yet-approved)
+        can :view, Screenshot, user_id: user.id
+      end
+    end
+  end
+end

app/models/package.rb

@@ -53,7 +53,7 @@ class Package < ApplicationRecord
 
   # Return a list of packages that have screenshots to be moderated
   def self.need_moderation
-    Package.joins(:screenshots).where('screenshots.approved=false or screenshots.markedfordelete=true').distinct(:name)
+    Package.joins(:screenshots).where('screenshots.approved=false').distinct(:name)
   end
 
 
@@ -71,7 +71,7 @@ class Package < ApplicationRecord
 
   # Return a query of all approved/public screenshots of this package
   def screenshots_pending
-    self.screenshots.where('approved=false or markedfordelete=true')
+    self.screenshots.where('approved=false')
   end
 
   # Return a list of packages that have unapproved screenshots

app/models/screenshot.rb

@@ -10,11 +10,6 @@ class Screenshot < ApplicationRecord
   # Shrine
   include ImageUploader::Attachment(:simage) # adds an `simage` virtual attribute
 
-  # Calculate how many days ago this screenshot has been uploaded
-  def age
-    time_ago_in_words(self.created_at)
-  end
-
   # Return caption for full-screen screenshots.
   # Takes the description of a screenshot if available.
   # Otherwise it falls back to the general description of its package.
@@ -54,19 +49,16 @@ class Screenshot < ApplicationRecord
 
   # Brief text describing the status of this screenshots (for admins)
   def adminstatus
-    if self.markedfordelete
-      "Removal requested > #{self.delete_reason}"
-    elsif self.approved
+    if self.approved
       'Public'
     else
-      fa_icon('hourglass') + 'Waiting for approval'
+      #fa_icon('hourglass') + 'Waiting for approval'
+      'Waiting for approval'
     end
   end
 
   # Publish a screenshot from the moderation queue
   def approve!
-    self.delete_reason = nil
-    self.markedfordelete = false
     self.approved = true
     self.save!
   end
@@ -76,35 +68,6 @@ class Screenshot < ApplicationRecord
     self.order(created_at: :desc).where(approved: true).first
   end
 
-  # Returns true if the current user has administrative permissions
-  # def can_admin?
-  #   self.admin == 1
-  # end
-
-  # Returns true if the current user can upload screenshots without moderation
-  # def can_upload_without_moderation?
-  #   # Admins can upload without moderation
-  #   true if self.can_admin
-
-  #   # Authenticated users with at least one approved screenshot
-  #   #true if self.screenshots.where(approved: true).count >= 1
-
-  #   # Other visitors require moderation
-  #   false
-  # end
-
-  # Returns true if the current user can delete screenshots
-  # def can_delete?
-  #   # Admins can delete screenshots
-  #   true if self.can_admin
-
-  #   # Authenticated users with at least one approved screenshot
-  #   #true if self.screenshots.where(approved: true).count >= 1
-
-  #   # Other visitors require moderation
-  #   false
-  # end
-
   # Return the part of the version up to the first - or +
   def upstream_version
     self.version.split(/[\-\+]/).first

app/models/user.rb

@@ -40,10 +40,6 @@ class User < ApplicationRecord
     end
   end
 
-  def is_admin?
-    self.admin == 1
-  end
-
   # Check if a user has been created on-the-fly and is just an
   # anonymous user who uploaded a screenshot. They can turn this
   # user record into a registered account though.
@@ -59,6 +55,11 @@ class User < ApplicationRecord
       user.name = auth.info.name
       # Set a random password
       user.password = Devise.friendly_token[0,20]
+
+      # Users coming through salsa.debian.net/OpenID-Connect will get moderator role
+      if user.email.end_with?('@debian.org') && user.provider=='salsa'
+        user.moderator_role = true
+      end
     end
   end
 
@@ -66,20 +67,18 @@ class User < ApplicationRecord
     self.screenshots.where(approved: true)
   end
 
-  # Seamlessly create a user account for the current client.
+  # Seamlessly create a user account for the current visitor.
   # It helps track uploads because uploaded screenshots get assigned
-  # to this user record. The user can later decide to use a real
-  # account and get their screenshots transferred to that.
-  # def self.create_pseudo_user
-  #   generated_password = Devise.friendly_token.first(8)
-  #   new_user = User.create(
-  #   name: 'Anonymous',
-  #   password: generated_password)
-  #   Log.log "New pseudo user for anonymous upload created: #{new_user}"
-  #   sign_in new_user
-  # end
-  #
-  # Currently the approach is different: do not create an account
-  # for a user. Instead store the IDs of the uploaded screenshots
-  # and transfer them if the user decides to do a real login using SSO.
+  # to this user record.
+  # TODO: The user can later decide to use a real account and get their screenshots transferred to that.
+  def self.create_pseudo_user
+    generated_password = Devise.friendly_token.first(8)
+    new_user = User.create(
+      name: 'Anonymous',
+      password: generated_password,
+      pseudo: true
+    )
+    Log.log "New pseudo user for anonymous upload created: #{new_user}"
+    return new_user
+  end
 end