role.rb
203 lines
| 6.0 KiB
| text/x-ruby
|
RubyLexer
|
r5213 | # Redmine - project management software | ||
|
r9453 | # Copyright (C) 2006-2012 Jean-Philippe Lang | ||
|
r330 | # | ||
# This program is free software; you can redistribute it and/or | ||||
# modify it under the terms of the GNU General Public License | ||||
# as published by the Free Software Foundation; either version 2 | ||||
# of the License, or (at your option) any later version. | ||||
|
r6737 | # | ||
|
r330 | # This program is distributed in the hope that it will be useful, | ||
# but WITHOUT ANY WARRANTY; without even the implied warranty of | ||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||||
# GNU General Public License for more details. | ||||
|
r6737 | # | ||
|
r330 | # You should have received a copy of the GNU General Public License | ||
# along with this program; if not, write to the Free Software | ||||
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. | ||||
class Role < ActiveRecord::Base | ||||
|
r9733 | # Custom coder for the permissions attribute that should be an | ||
# array of symbols. Rails 3 uses Psych which can be *unbelievably* | ||||
# slow on some platforms (eg. mingw32). | ||||
class PermissionsAttributeCoder | ||||
def self.load(str) | ||||
str.to_s.scan(/:([a-z0-9_]+)/).flatten.map(&:to_sym) | ||||
end | ||||
def self.dump(value) | ||||
YAML.dump(value) | ||||
end | ||||
end | ||||
|
r663 | # Built-in roles | ||
BUILTIN_NON_MEMBER = 1 | ||||
BUILTIN_ANONYMOUS = 2 | ||||
|
r6737 | |||
|
r5296 | ISSUES_VISIBILITY_OPTIONS = [ | ||
|
r5346 | ['all', :label_issues_visibility_all], | ||
['default', :label_issues_visibility_public], | ||||
|
r5296 | ['own', :label_issues_visibility_own] | ||
] | ||||
|
r1812 | |||
|
r9532 | scope :sorted, order("#{table_name}.builtin ASC, #{table_name}.position ASC") | ||
scope :givable, order("#{table_name}.position ASC").where(:builtin => 0) | ||||
|
r9355 | scope :builtin, lambda { |*args| | ||
|
r9532 | compare = (args.first == true ? 'not' : '') | ||
where("#{compare} builtin = 0") | ||||
|
r1812 | } | ||
|
r6737 | |||
|
r663 | before_destroy :check_deletable | ||
|
r9794 | has_many :workflow_rules, :dependent => :delete_all do | ||
|
r3040 | def copy(source_role) | ||
|
r9794 | WorkflowRule.copy(nil, source_role, nil, proxy_association.owner) | ||
|
r1237 | end | ||
end | ||||
|
r6737 | |||
|
r2627 | has_many :member_roles, :dependent => :destroy | ||
has_many :members, :through => :member_roles | ||||
|
r330 | acts_as_list | ||
|
r6737 | |||
|
r9733 | serialize :permissions, ::Role::PermissionsAttributeCoder | ||
|
r663 | attr_protected :builtin | ||
|
r330 | |||
validates_presence_of :name | ||||
validates_uniqueness_of :name | ||||
|
r590 | validates_length_of :name, :maximum => 30 | ||
|
r5296 | validates_inclusion_of :issues_visibility, | ||
:in => ISSUES_VISIBILITY_OPTIONS.collect(&:first), | ||||
:if => lambda {|role| role.respond_to?(:issues_visibility)} | ||||
|
r6737 | |||
|
r10102 | # Copies attributes from another role, arg can be an id or a Role | ||
def copy_from(arg, options={}) | ||||
return unless arg.present? | ||||
role = arg.is_a?(Role) ? arg : Role.find_by_id(arg.to_s) | ||||
self.attributes = role.attributes.dup.except("id", "name", "position", "builtin", "permissions") | ||||
self.permissions = role.permissions.dup | ||||
self | ||||
end | ||||
|
r663 | def permissions=(perms) | ||
|
r1812 | perms = perms.collect {|p| p.to_sym unless p.blank? }.compact.uniq if perms | ||
|
r663 | write_attribute(:permissions, perms) | ||
end | ||||
|
r1812 | |||
def add_permission!(*perms) | ||||
self.permissions = [] unless permissions.is_a?(Array) | ||||
permissions_will_change! | ||||
perms.each do |p| | ||||
p = p.to_sym | ||||
permissions << p unless permissions.include?(p) | ||||
end | ||||
save! | ||||
end | ||||
def remove_permission!(*perms) | ||||
return unless permissions.is_a?(Array) | ||||
permissions_will_change! | ||||
perms.each { |p| permissions.delete(p.to_sym) } | ||||
save! | ||||
end | ||||
|
r6737 | |||
|
r1813 | # Returns true if the role has the given permission | ||
def has_permission?(perm) | ||||
!permissions.nil? && permissions.include?(perm.to_sym) | ||||
end | ||||
|
r6737 | |||
|
r431 | def <=>(role) | ||
|
r9532 | if role | ||
if builtin == role.builtin | ||||
position <=> role.position | ||||
else | ||||
builtin <=> role.builtin | ||||
end | ||||
else | ||||
-1 | ||||
end | ||||
|
r2627 | end | ||
|
r6737 | |||
|
r2627 | def to_s | ||
name | ||||
|
r431 | end | ||
|
r6737 | |||
|
r5213 | def name | ||
case builtin | ||||
when 1; l(:label_role_non_member, :default => read_attribute(:name)) | ||||
when 2; l(:label_role_anonymous, :default => read_attribute(:name)) | ||||
else; read_attribute(:name) | ||||
end | ||||
end | ||||
|
r6737 | |||
|
r663 | # Return true if the role is a builtin role | ||
def builtin? | ||||
self.builtin != 0 | ||||
end | ||||
|
r6737 | |||
|
r663 | # Return true if the role is a project member role | ||
def member? | ||||
!self.builtin? | ||||
end | ||||
|
r6737 | |||
|
r663 | # Return true if role is allowed to do the specified action | ||
# action can be: | ||||
# * a parameter-like Hash (eg. :controller => 'projects', :action => 'edit') | ||||
# * a permission Symbol (eg. :edit_project) | ||||
def allowed_to?(action) | ||||
if action.is_a? Hash | ||||
allowed_actions.include? "#{action[:controller]}/#{action[:action]}" | ||||
else | ||||
allowed_permissions.include? action | ||||
end | ||||
end | ||||
|
r6737 | |||
|
r663 | # Return all the permissions that can be given to the role | ||
def setable_permissions | ||||
setable_permissions = Redmine::AccessControl.permissions - Redmine::AccessControl.public_permissions | ||||
setable_permissions -= Redmine::AccessControl.members_only_permissions if self.builtin == BUILTIN_NON_MEMBER | ||||
setable_permissions -= Redmine::AccessControl.loggedin_only_permissions if self.builtin == BUILTIN_ANONYMOUS | ||||
setable_permissions | ||||
end | ||||
# Find all the roles that can be given to a project member | ||||
def self.find_all_givable | ||||
|
r9532 | Role.givable.all | ||
|
r663 | end | ||
|
r3249 | # Return the builtin 'non member' role. If the role doesn't exist, | ||
# it will be created on the fly. | ||||
|
r663 | def self.non_member | ||
|
r6179 | find_or_create_system_role(BUILTIN_NON_MEMBER, 'Non member') | ||
|
r663 | end | ||
|
r3249 | # Return the builtin 'anonymous' role. If the role doesn't exist, | ||
# it will be created on the fly. | ||||
|
r663 | def self.anonymous | ||
|
r6179 | find_or_create_system_role(BUILTIN_ANONYMOUS, 'Anonymous') | ||
|
r663 | end | ||
|
r6737 | |||
|
r330 | private | ||
|
r6737 | |||
|
r663 | def allowed_permissions | ||
@allowed_permissions ||= permissions + Redmine::AccessControl.public_permissions.collect {|p| p.name} | ||||
end | ||||
def allowed_actions | ||||
@actions_allowed ||= allowed_permissions.inject([]) { |actions, permission| actions += Redmine::AccessControl.allowed_actions(permission) }.flatten | ||||
end | ||||
|
r6737 | |||
|
r663 | def check_deletable | ||
raise "Can't delete role" if members.any? | ||||
raise "Can't delete builtin role" if builtin? | ||||
|
r2 | end | ||
|
r6737 | |||
|
r6179 | def self.find_or_create_system_role(builtin, name) | ||
|
r9532 | role = where(:builtin => builtin).first | ||
|
r6179 | if role.nil? | ||
role = create(:name => name, :position => 0) do |r| | ||||
r.builtin = builtin | ||||
end | ||||
raise "Unable to create the #{name} role." if role.new_record? | ||||
end | ||||
role | ||||
end | ||||
|
r2 | end | ||