jro_apps/redmine Commit - r13911:ed9f00178c65

Ability to limit member management to certain roles (#19707)....

Jean-Philippe Lang -

r13911:ed9f00178c65

parent child

Context file:

r13911:ed9f00178c65

Collapse all files

db/migrate/20150528084820_add_roles_all_roles_managed.rb created 644 +5 0

@@ -0,0 +1,5
	1	class AddRolesAllRolesManaged < ActiveRecord::Migration
	2	def change
	3	add_column :roles, :all_roles_managed, :boolean, :default => true, :null => false
	4	end
	5	end

db/migrate/20150528092912_create_roles_managed_roles.rb created 644 +8 0

@@ -0,0 +1,8
	1	class CreateRolesManagedRoles < ActiveRecord::Migration
	2	def change
	3	create_table :roles_managed_roles, :id => false do \|t\|
	4	t.integer :role_id, :null => false
	5	t.integer :managed_role_id, :null => false
	6	end
	7	end
	8	end

db/migrate/20150528093249_add_unique_index_on_roles_managed_roles.rb created 644 +5 0

@@ -0,0 +1,5
	1	class AddUniqueIndexOnRolesManagedRoles < ActiveRecord::Migration
	2	def change
	3	add_index :roles_managed_roles, [:role_id, :managed_role_id], :unique => true
	4	end
	5	end

app/controllers/members_controller.rb +7 -9

             # Redmine - project management software
             # Copyright (C) 2006-2015  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class MembersController < ApplicationController
               model_object Member
               before_filter :find_model_object, :except => [:index, :new, :create, :autocomplete]
               before_filter :find_project_from_association, :except => [:index, :new, :create, :autocomplete]
               before_filter :find_project_by_project_id, :only => [:index, :new, :create, :autocomplete]
               before_filter :authorize
               accept_api_auth :index, :show, :create, :update, :destroy
               def index
                 @offset, @limit = api_offset_and_limit
                 @member_count = @project.member_principals.count
                 @member_pages = Paginator.new @member_count, @limit, params['page']
                 @offset ||= @member_pages.offset
                 @members =  @project.member_principals.
                                 order("#{Member.table_name}.id").
                                 limit(@limit).
                                 offset(@offset).
                                 to_a
                 respond_to do |format|
                   format.html { head 406 }
                   format.api
                 end
               end
               def show
                 respond_to do |format|
                   format.html { head 406 }
                   format.api
                 end
               end
               def new
                 @member = Member.new
               end
               def create
                 members = []
                 if params[:membership]
-                  if params[:membership][:user_ids]
+                  user_ids = Array.wrap(params[:membership][:user_id] || params[:membership][:user_ids])
-                    attrs = params[:membership].dup
+                  user_ids << nil if user_ids.empty?
-                    user_ids = attrs.delete(:user_ids)
                   user_ids.each do |user_id|
-                      members << Member.new(:role_ids => params[:membership][:role_ids], :user_id => user_id)
+                    member = Member.new(:project => @project, :user_id => user_id)
-                    end
+                    member.set_editable_role_ids(params[:membership][:role_ids])
-                  else
+                    members << member
-                    members << Member.new(:role_ids => params[:membership][:role_ids], :user_id => params[:membership][:user_id])
                   end
                   @project.members << members
                 end
                 respond_to do |format|
                   format.html { redirect_to_settings_in_projects }
                   format.js {
                     @members = members
                     @member = Member.new
                   }
                   format.api {
                     @member = members.first
                     if @member.valid?
                       render :action => 'show', :status => :created, :location => membership_url(@member)
                     else
                       render_validation_errors(@member)
                     end
                   }
                 end
               end
               def update
                 if params[:membership]
-                  @member.role_ids = params[:membership][:role_ids]
+                  @member.set_editable_role_ids(params[:membership][:role_ids])
                 end
                 saved = @member.save
                 respond_to do |format|
                   format.html { redirect_to_settings_in_projects }
                   format.js
                   format.api {
                     if saved
                       render_api_ok
                     else
                       render_validation_errors(@member)
                     end
                   }
                 end
               end
               def destroy
-                if request.delete? && @member.deletable?
+                if @member.deletable?
                   @member.destroy
                 end
                 respond_to do |format|
                   format.html { redirect_to_settings_in_projects }
                   format.js
                   format.api {
                     if @member.destroyed?
                       render_api_ok
                     else
                       head :unprocessable_entity
                     end
                   }
                 end
               end
               def autocomplete
                 respond_to do |format|
                   format.js
                 end
               end
               private
               def redirect_to_settings_in_projects
                 redirect_to settings_project_path(@project, :tab => 'members')
               end
             end

app/models/member.rb +67 -10

             # Redmine - project management software
             # Copyright (C) 2006-2015  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class Member < ActiveRecord::Base
               belongs_to :user
               belongs_to :principal, :foreign_key => 'user_id'
               has_many :member_roles, :dependent => :destroy
               has_many :roles, lambda {uniq}, :through => :member_roles
               belongs_to :project
               validates_presence_of :principal, :project
               validates_uniqueness_of :user_id, :scope => :project_id
               validate :validate_role
               attr_protected :id
               before_destroy :set_issue_category_nil
+              alias :base_reload :reload
+              def reload(*args)
+                @managed_roles = nil
+                base_reload(*args)
+              end
               def role
               end
               def role=
               end
               def name
                 self.user.name
               end
               alias :base_role_ids= :role_ids=
               def role_ids=(arg)
                 ids = (arg || []).collect(&:to_i) - [0]
                 # Keep inherited roles
                 ids += member_roles.select {|mr| !mr.inherited_from.nil?}.collect(&:role_id)
                 new_role_ids = ids - role_ids
                 # Add new roles
                 new_role_ids.each {|id| member_roles << MemberRole.new(:role_id => id, :member => self) }
                 # Remove roles (Rails' #role_ids= will not trigger MemberRole#on_destroy)
                 member_roles_to_destroy = member_roles.select {|mr| !ids.include?(mr.role_id)}
                 if member_roles_to_destroy.any?
                   member_roles_to_destroy.each(&:destroy)
                 end
               end
               def <=>(member)
                 a, b = roles.sort.first, member.roles.sort.first
                 if a == b
                   if principal
                     principal <=> member.principal
                   else
                   end
                 elsif a
                   a <=> b
                 else
                 end
               end
-              def deletable?
+            	# Set member role ids ignoring any change to roles that
-                member_roles.detect {|mr| mr.inherited_from}.nil?
+            	# user is not allowed to manage
+              def set_editable_role_ids(ids, user=User.current)
+                ids = (ids || []).collect(&:to_i) - [0]
+                editable_role_ids = user.managed_roles(project).map(&:id)
+                untouched_role_ids = self.role_ids - editable_role_ids
+                touched_role_ids = ids & editable_role_ids
+                self.role_ids = untouched_role_ids + touched_role_ids
               end
-              def destroy
+            	# Returns true if one of the member roles is inherited
-                if member_roles.reload.present?
+              def any_inherited_role?
-                  # destroying the last role will destroy another instance
+                member_roles.any? {|mr| mr.inherited_from}
-                  # of the same Member record, #super would then trigger callbacks twice
+              end
-                  member_roles.destroy_all
-                  @destroyed = true
+            	# Returns true if the member has the role and if it's inherited
-                  freeze
+              def has_inherited_role?(role)
+                member_roles.any? {|mr| mr.role_id == role.id && mr.inherited_from.present?}
+              end
+            	# Returns true if the member's role is editable by user
+              def role_editable?(role, user=User.current)
+                if has_inherited_role?(role)
+                  false
                 else
-                  super
+                  user.managed_roles(project).include?(role)
+                end
+              end
+            	# Returns true if the member is deletable by user
+              def deletable?(user=User.current)
+                if any_inherited_role?
+                  false
+                else
+                  roles & user.managed_roles(project) == roles
                 end
               end
+            	# Destroys the member
+              def destroy
+                member_roles.reload.each(&:destroy_without_member_removal)
+                super
+              end
+            	# Returns true if the member is user or is a group
+            	# that includes user
               def include?(user)
                 if principal.is_a?(Group)
                   !user.nil? && user.groups.include?(principal)
                 else
                   self.user == user
                 end
               end
               def set_issue_category_nil
                 if user_id && project_id
                   # remove category based auto assignments for this member
                   IssueCategory.where(["project_id = ? AND assigned_to_id = ?", project_id, user_id]).
                     update_all("assigned_to_id = NULL")
                 end
               end
+              # Returns the roles that the member is allowed to manage
+              # in the project the member belongs to
+              def managed_roles
+                @managed_roles ||= begin
+                  if principal.try(:admin?)
+                    Role.givable.to_a
+                  else
+                    members_management_roles = roles.select do |role|
+                      role.has_permission?(:manage_members)
+                    end
+                    if members_management_roles.empty?
+                      []
+                    elsif members_management_roles.any?(&:all_roles_managed?)
+                      Role.givable.to_a
+                    else
+                      members_management_roles.map(&:managed_roles).reduce(&:|)
+                    end
+                  end
+                end
+              end
               # Creates memberships for principal with the attributes
               # * project_ids : one or more project ids
               # * role_ids : ids of the roles to give to each membership
               #
               # Example:
               #   Member.create_principal_memberships(user, :project_ids => [2, 5], :role_ids => [1, 3]
               def self.create_principal_memberships(principal, attributes)
                 members = []
                 if attributes
                   project_ids = Array.wrap(attributes[:project_ids] || attributes[:project_id])
                   role_ids = attributes[:role_ids]
                   project_ids.each do |project_id|
                     members << Member.new(:principal => principal, :role_ids => role_ids, :project_id => project_id)
                   end
                   principal.members << members
                 end
                 members
               end
               # Finds or initilizes a Member for the given project and principal
               def self.find_or_new(project, principal)
                 project_id = project.is_a?(Project) ? project.id : project
                 principal_id = principal.is_a?(Principal) ? principal.id : principal
                 member = Member.find_by_project_id_and_user_id(project_id, principal_id)
                 member ||= Member.new(:project_id => project_id, :user_id => principal_id)
                 member
               end
               protected
               def validate_role
                 errors.add_on_empty :role if member_roles.empty? && roles.empty?
               end
             end

app/models/member_role.rb +8 -1

             # Redmine - project management software
             # Copyright (C) 2006-2015  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class MemberRole < ActiveRecord::Base
               belongs_to :member
               belongs_to :role
               after_destroy :remove_member_if_empty
               after_create :add_role_to_group_users, :add_role_to_subprojects
               after_destroy :remove_inherited_roles
               validates_presence_of :role
               validate :validate_role_member
               attr_protected :id
               def validate_role_member
                 errors.add :role_id, :invalid if role && !role.member?
               end
               def inherited?
                 !inherited_from.nil?
               end
+              # Destroys the MemberRole without destroying its Member if it doesn't have
+              # any other roles
+              def destroy_without_member_removal
+                @member_removal = false
+                destroy
+              end
               private
               def remove_member_if_empty
-                if member.roles.empty?
+                if @member_removal != false && member.roles.empty?
                   member.destroy
                 end
               end
               def add_role_to_group_users
                 if member.principal.is_a?(Group) && !inherited?
                   member.principal.users.each do |user|
                     user_member = Member.find_or_new(member.project_id, user.id)
                     user_member.member_roles << MemberRole.new(:role => role, :inherited_from => id)
                     user_member.save!
                   end
                 end
               end
               def add_role_to_subprojects
                 member.project.children.each do |subproject|
                   if subproject.inherit_members?
                     child_member = Member.find_or_new(subproject.id, member.user_id)
                     child_member.member_roles << MemberRole.new(:role => role, :inherited_from => id)
                     child_member.save!
                   end
                 end
               end
               def remove_inherited_roles
                 MemberRole.where(:inherited_from => id).group_by(&:member).
                     each do |member, member_roles|
                   member_roles.each(&:destroy)
                 end
               end
             end

app/models/role.rb +4 0

             # Redmine - project management software
             # Copyright (C) 2006-2015  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class Role < ActiveRecord::Base
               # Custom coder for the permissions attribute that should be an
               # array of symbols. Rails 3 uses Psych which can be *unbelievably*
               # slow on some platforms (eg. mingw32).
               class PermissionsAttributeCoder
                 def self.load(str)
                   str.to_s.scan(/:([a-z0-9_]+)/).flatten.map(&:to_sym)
                 end
                 def self.dump(value)
                   YAML.dump(value)
                 end
               end
               # Built-in roles
               BUILTIN_NON_MEMBER = 1
               BUILTIN_ANONYMOUS  = 2
               ISSUES_VISIBILITY_OPTIONS = [
                 ['all', :label_issues_visibility_all],
                 ['default', :label_issues_visibility_public],
                 ['own', :label_issues_visibility_own]
               ]
               TIME_ENTRIES_VISIBILITY_OPTIONS = [
                 ['all', :label_time_entries_visibility_all],
                 ['own', :label_time_entries_visibility_own]
               ]
               USERS_VISIBILITY_OPTIONS = [
                 ['all', :label_users_visibility_all],
                 ['members_of_visible_projects', :label_users_visibility_members_of_visible_projects]
               ]
               scope :sorted, lambda { order(:builtin, :position) }
               scope :givable, lambda { order(:position).where(:builtin => 0) }
               scope :builtin, lambda { |*args|
                 compare = (args.first == true ? 'not' : '')
                 where("#{compare} builtin = 0")
               }
               before_destroy :check_deletable
               has_many :workflow_rules, :dependent => :delete_all do
                 def copy(source_role)
                   WorkflowRule.copy(nil, source_role, nil, proxy_association.owner)
                 end
               end
               has_and_belongs_to_many :custom_fields, :join_table => "#{table_name_prefix}custom_fields_roles#{table_name_suffix}", :foreign_key => "role_id"
+              has_and_belongs_to_many :managed_roles, :class_name => 'Role',
+                :join_table => "#{table_name_prefix}roles_managed_roles#{table_name_suffix}",
+                :association_foreign_key => "managed_role_id"
               has_many :member_roles, :dependent => :destroy
               has_many :members, :through => :member_roles
               acts_as_list
               serialize :permissions, ::Role::PermissionsAttributeCoder
               attr_protected :builtin
               validates_presence_of :name
               validates_uniqueness_of :name
               validates_length_of :name, :maximum => 30
               validates_inclusion_of :issues_visibility,
                 :in => ISSUES_VISIBILITY_OPTIONS.collect(&:first),
                 :if => lambda {|role| role.respond_to?(:issues_visibility) && role.issues_visibility_changed?}
               validates_inclusion_of :users_visibility,
                 :in => USERS_VISIBILITY_OPTIONS.collect(&:first),
                 :if => lambda {|role| role.respond_to?(:users_visibility) && role.users_visibility_changed?}
               validates_inclusion_of :time_entries_visibility,
                 :in => TIME_ENTRIES_VISIBILITY_OPTIONS.collect(&:first),
                 :if => lambda {|role| role.respond_to?(:time_entries_visibility) && role.time_entries_visibility_changed?}
               # Copies attributes from another role, arg can be an id or a Role
               def copy_from(arg, options={})
                 return unless arg.present?
                 role = arg.is_a?(Role) ? arg : Role.find_by_id(arg.to_s)
                 self.attributes = role.attributes.dup.except("id", "name", "position", "builtin", "permissions")
                 self.permissions = role.permissions.dup
                 self
               end
               def permissions=(perms)
                 perms = perms.collect {|p| p.to_sym unless p.blank? }.compact.uniq if perms
                 write_attribute(:permissions, perms)
               end
               def add_permission!(*perms)
                 self.permissions = [] unless permissions.is_a?(Array)
                 permissions_will_change!
                 perms.each do |p|
                   p = p.to_sym
                   permissions << p unless permissions.include?(p)
                 end
                 save!
               end
               def remove_permission!(*perms)
                 return unless permissions.is_a?(Array)
                 permissions_will_change!
                 perms.each { |p| permissions.delete(p.to_sym) }
                 save!
               end
               # Returns true if the role has the given permission
               def has_permission?(perm)
                 !permissions.nil? && permissions.include?(perm.to_sym)
               end
               def consider_workflow?
                 has_permission?(:add_issues) || has_permission?(:edit_issues)
               end
               def <=>(role)
                 if role
                   if builtin == role.builtin
                     position <=> role.position
                   else
                     builtin <=> role.builtin
                   end
                 else
                   -1
                 end
               end
               def to_s
                 name
               end
               def name
                 case builtin
                 when 1; l(:label_role_non_member, :default => read_attribute(:name))
                 when 2; l(:label_role_anonymous,  :default => read_attribute(:name))
                 else; read_attribute(:name)
                 end
               end
               # Return true if the role is a builtin role
               def builtin?
                 self.builtin != 0
               end
               # Return true if the role is the anonymous role
               def anonymous?
                 builtin == 2
               end
               # Return true if the role is a project member role
               def member?
                 !self.builtin?
               end
               # Return true if role is allowed to do the specified action
               # action can be:
               # * a parameter-like Hash (eg. :controller => 'projects', :action => 'edit')
               # * a permission Symbol (eg. :edit_project)
               def allowed_to?(action)
                 if action.is_a? Hash
                   allowed_actions.include? "#{action[:controller]}/#{action[:action]}"
                 else
                   allowed_permissions.include? action
                 end
               end
               # Return all the permissions that can be given to the role
               def setable_permissions
                 setable_permissions = Redmine::AccessControl.permissions - Redmine::AccessControl.public_permissions
                 setable_permissions -= Redmine::AccessControl.members_only_permissions if self.builtin == BUILTIN_NON_MEMBER
                 setable_permissions -= Redmine::AccessControl.loggedin_only_permissions if self.builtin == BUILTIN_ANONYMOUS
                 setable_permissions
               end
               # Find all the roles that can be given to a project member
               def self.find_all_givable
                 Role.givable.to_a
               end
               # Return the builtin 'non member' role.  If the role doesn't exist,
               # it will be created on the fly.
               def self.non_member
                 find_or_create_system_role(BUILTIN_NON_MEMBER, 'Non member')
               end
               # Return the builtin 'anonymous' role.  If the role doesn't exist,
               # it will be created on the fly.
               def self.anonymous
                 find_or_create_system_role(BUILTIN_ANONYMOUS, 'Anonymous')
               end
             private
               def allowed_permissions
                 @allowed_permissions ||= permissions + Redmine::AccessControl.public_permissions.collect {|p| p.name}
               end
               def allowed_actions
                 @actions_allowed ||= allowed_permissions.inject([]) { |actions, permission| actions += Redmine::AccessControl.allowed_actions(permission) }.flatten
               end
               def check_deletable
                 raise "Cannot delete role" if members.any?
                 raise "Cannot delete builtin role" if builtin?
               end
               def self.find_or_create_system_role(builtin, name)
                 role = where(:builtin => builtin).first
                 if role.nil?
                   role = create(:name => name, :position => 0) do |r|
                     r.builtin = builtin
                   end
                   raise "Unable to create the #{name} role." if role.new_record?
                 end
                 role
               end
             end

app/models/user.rb +9 0

             # Redmine - project management software
             # Copyright (C) 2006-2015  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require "digest/sha1"
             class User < Principal
               include Redmine::SafeAttributes
               # Different ways of displaying/sorting users
               USER_FORMATS = {
                 :firstname_lastname => {
                     :string => '#{firstname} #{lastname}',
                     :order => %w(firstname lastname id),
                     :setting_order => 1
                   },
                 :firstname_lastinitial => {
                     :string => '#{firstname} #{lastname.to_s.chars.first}.',
                     :order => %w(firstname lastname id),
                     :setting_order => 2
                   },
                 :firstinitial_lastname => {
                     :string => '#{firstname.to_s.gsub(/(([[:alpha:]])[[:alpha:]]*\.?)/, \'\2.\')} #{lastname}',
                     :order => %w(firstname lastname id),
                     :setting_order => 2
                   },
                 :firstname => {
                     :string => '#{firstname}',
                     :order => %w(firstname id),
                     :setting_order => 3
                   },
                 :lastname_firstname => {
                     :string => '#{lastname} #{firstname}',
                     :order => %w(lastname firstname id),
                     :setting_order => 4
                   },
                 :lastname_coma_firstname => {
                     :string => '#{lastname}, #{firstname}',
                     :order => %w(lastname firstname id),
                     :setting_order => 5
                   },
                 :lastname => {
                     :string => '#{lastname}',
                     :order => %w(lastname id),
                     :setting_order => 6
                   },
                 :username => {
                     :string => '#{login}',
                     :order => %w(login id),
                     :setting_order => 7
                   },
               }
               MAIL_NOTIFICATION_OPTIONS = [
                 ['all', :label_user_mail_option_all],
                 ['selected', :label_user_mail_option_selected],
                 ['only_my_events', :label_user_mail_option_only_my_events],
                 ['only_assigned', :label_user_mail_option_only_assigned],
                 ['only_owner', :label_user_mail_option_only_owner],
                 ['none', :label_user_mail_option_none]
               ]
               has_and_belongs_to_many :groups,
                                       :join_table   => "#{table_name_prefix}groups_users#{table_name_suffix}",
                                       :after_add    => Proc.new {|user, group| group.user_added(user)},
                                       :after_remove => Proc.new {|user, group| group.user_removed(user)}
               has_many :changesets, :dependent => :nullify
               has_one :preference, :dependent => :destroy, :class_name => 'UserPreference'
               has_one :rss_token, lambda {where "action='feeds'"}, :class_name => 'Token'
               has_one :api_token, lambda {where "action='api'"}, :class_name => 'Token'
               has_one :email_address, lambda {where :is_default => true}, :autosave => true
               has_many :email_addresses, :dependent => :delete_all
               belongs_to :auth_source
               scope :logged, lambda { where("#{User.table_name}.status <> #{STATUS_ANONYMOUS}") }
               scope :status, lambda {|arg| where(arg.blank? ? nil : {:status => arg.to_i}) }
               acts_as_customizable
               attr_accessor :password, :password_confirmation, :generate_password
               attr_accessor :last_before_login_on
               # Prevents unauthorized assignments
               attr_protected :login, :admin, :password, :password_confirmation, :hashed_password
               LOGIN_LENGTH_LIMIT = 60
               MAIL_LENGTH_LIMIT = 60
               validates_presence_of :login, :firstname, :lastname, :if => Proc.new { |user| !user.is_a?(AnonymousUser) }
               validates_uniqueness_of :login, :if => Proc.new { |user| user.login_changed? && user.login.present? }, :case_sensitive => false
               # Login must contain letters, numbers, underscores only
               validates_format_of :login, :with => /\A[a-z0-9_\-@\.]*\z/i
               validates_length_of :login, :maximum => LOGIN_LENGTH_LIMIT
               validates_length_of :firstname, :lastname, :maximum => 30
               validates_inclusion_of :mail_notification, :in => MAIL_NOTIFICATION_OPTIONS.collect(&:first), :allow_blank => true
               validate :validate_password_length
               validate do
                 if password_confirmation && password != password_confirmation
                   errors.add(:password, :confirmation)
                 end
               end
               before_validation :instantiate_email_address
               before_create :set_mail_notification
               before_save   :generate_password_if_needed, :update_hashed_password
               before_destroy :remove_references_before_destroy
               after_save :update_notified_project_ids, :destroy_tokens
               scope :in_group, lambda {|group|
                 group_id = group.is_a?(Group) ? group.id : group.to_i
                 where("#{User.table_name}.id IN (SELECT gu.user_id FROM #{table_name_prefix}groups_users#{table_name_suffix} gu WHERE gu.group_id = ?)", group_id)
               }
               scope :not_in_group, lambda {|group|
                 group_id = group.is_a?(Group) ? group.id : group.to_i
                 where("#{User.table_name}.id NOT IN (SELECT gu.user_id FROM #{table_name_prefix}groups_users#{table_name_suffix} gu WHERE gu.group_id = ?)", group_id)
               }
               scope :sorted, lambda { order(*User.fields_for_order_statement)}
               scope :having_mail, lambda {|arg|
                 addresses = Array.wrap(arg).map {|a| a.to_s.downcase}
                 if addresses.any?
                   joins(:email_addresses).where("LOWER(#{EmailAddress.table_name}.address) IN (?)", addresses).uniq
                 else
                   none
                 end
               }
               def set_mail_notification
                 self.mail_notification = Setting.default_notification_option if self.mail_notification.blank?
                 true
               end
               def update_hashed_password
                 # update hashed_password if password was set
                 if self.password && self.auth_source_id.blank?
                   salt_password(password)
                 end
               end
               alias :base_reload :reload
               def reload(*args)
                 @name = nil
                 @projects_by_role = nil
                 @membership_by_project_id = nil
                 @notified_projects_ids = nil
                 @notified_projects_ids_changed = false
                 @builtin_role = nil
                 @visible_project_ids = nil
                 base_reload(*args)
               end
               def mail
                 email_address.try(:address)
               end
               def mail=(arg)
                 email = email_address || build_email_address
                 email.address = arg
               end
               def mail_changed?
                 email_address.try(:address_changed?)
               end
               def mails
                 email_addresses.pluck(:address)
               end
               def self.find_or_initialize_by_identity_url(url)
                 user = where(:identity_url => url).first
                 unless user
                   user = User.new
                   user.identity_url = url
                 end
                 user
               end
               def identity_url=(url)
                 if url.blank?
                   write_attribute(:identity_url, '')
                 else
                   begin
                     write_attribute(:identity_url, OpenIdAuthentication.normalize_identifier(url))
                   rescue OpenIdAuthentication::InvalidOpenId
                     # Invalid url, don't save
                   end
                 end
                 self.read_attribute(:identity_url)
               end
               # Returns the user that matches provided login and password, or nil
               def self.try_to_login(login, password, active_only=true)
                 login = login.to_s
                 password = password.to_s
                 # Make sure no one can sign in with an empty login or password
                 return nil if login.empty? || password.empty?
                 user = find_by_login(login)
                 if user
                   # user is already in local database
                   return nil unless user.check_password?(password)
                   return nil if !user.active? && active_only
                 else
                   # user is not yet registered, try to authenticate with available sources
                   attrs = AuthSource.authenticate(login, password)
                   if attrs
                     user = new(attrs)
                     user.login = login
                     user.language = Setting.default_language
                     if user.save
                       user.reload
                       logger.info("User '#{user.login}' created from external auth source: #{user.auth_source.type} - #{user.auth_source.name}") if logger && user.auth_source
                     end
                   end
                 end
                 user.update_column(:last_login_on, Time.now) if user && !user.new_record? && user.active?
                 user
               rescue => text
                 raise text
               end
               # Returns the user who matches the given autologin +key+ or nil
               def self.try_to_autologin(key)
                 user = Token.find_active_user('autologin', key, Setting.autologin.to_i)
                 if user
                   user.update_column(:last_login_on, Time.now)
                   user
                 end
               end
               def self.name_formatter(formatter = nil)
                 USER_FORMATS[formatter || Setting.user_format] || USER_FORMATS[:firstname_lastname]
               end
               # Returns an array of fields names than can be used to make an order statement for users
               # according to how user names are displayed
               # Examples:
               #
               #   User.fields_for_order_statement              => ['users.login', 'users.id']
               #   User.fields_for_order_statement('authors')   => ['authors.login', 'authors.id']
               def self.fields_for_order_statement(table=nil)
                 table ||= table_name
                 name_formatter[:order].map {|field| "#{table}.#{field}"}
               end
               # Return user's full name for display
               def name(formatter = nil)
                 f = self.class.name_formatter(formatter)
                 if formatter
                   eval('"' + f[:string] + '"')
                 else
                   @name ||= eval('"' + f[:string] + '"')
                 end
               end
               def active?
                 self.status == STATUS_ACTIVE
               end
               def registered?
                 self.status == STATUS_REGISTERED
               end
               def locked?
                 self.status == STATUS_LOCKED
               end
               def activate
                 self.status = STATUS_ACTIVE
               end
               def register
                 self.status = STATUS_REGISTERED
               end
               def lock
                 self.status = STATUS_LOCKED
               end
               def activate!
                 update_attribute(:status, STATUS_ACTIVE)
               end
               def register!
                 update_attribute(:status, STATUS_REGISTERED)
               end
               def lock!
                 update_attribute(:status, STATUS_LOCKED)
               end
               # Returns true if +clear_password+ is the correct user's password, otherwise false
               def check_password?(clear_password)
                 if auth_source_id.present?
                   auth_source.authenticate(self.login, clear_password)
                 else
                   User.hash_password("#{salt}#{User.hash_password clear_password}") == hashed_password
                 end
               end
               # Generates a random salt and computes hashed_password for +clear_password+
               # The hashed password is stored in the following form: SHA1(salt + SHA1(password))
               def salt_password(clear_password)
                 self.salt = User.generate_salt
                 self.hashed_password = User.hash_password("#{salt}#{User.hash_password clear_password}")
                 self.passwd_changed_on = Time.now.change(:usec => 0)
               end
               # Does the backend storage allow this user to change their password?
               def change_password_allowed?
                 return true if auth_source.nil?
                 return auth_source.allow_password_changes?
               end
               # Returns true if the user password has expired
               def password_expired?
                 period = Setting.password_max_age.to_i
                 if period.zero?
                   false
                 else
                   changed_on = self.passwd_changed_on || Time.at(0)
                   changed_on < period.days.ago
                 end
               end
               def must_change_password?
                 (must_change_passwd? || password_expired?) && change_password_allowed?
               end
               def generate_password?
                 generate_password == '1' || generate_password == true
               end
               # Generate and set a random password on given length
               def random_password(length=40)
                 chars = ("a".."z").to_a + ("A".."Z").to_a + ("0".."9").to_a
                 chars -= %w(0 O 1 l)
                 password = ''
                 length.times {|i| password << chars[SecureRandom.random_number(chars.size)] }
                 self.password = password
                 self.password_confirmation = password
                 self
               end
               def pref
                 self.preference ||= UserPreference.new(:user => self)
               end
               def time_zone
                 @time_zone ||= (self.pref.time_zone.blank? ? nil : ActiveSupport::TimeZone[self.pref.time_zone])
               end
               def force_default_language?
                 Setting.force_default_language_for_loggedin?
               end
               def language
                 if force_default_language?
                   Setting.default_language
                 else
                   super
                 end
               end
               def wants_comments_in_reverse_order?
                 self.pref[:comments_sorting] == 'desc'
               end
               # Return user's RSS key (a 40 chars long string), used to access feeds
               def rss_key
                 if rss_token.nil?
                   create_rss_token(:action => 'feeds')
                 end
                 rss_token.value
               end
               # Return user's API key (a 40 chars long string), used to access the API
               def api_key
                 if api_token.nil?
                   create_api_token(:action => 'api')
                 end
                 api_token.value
               end
               # Return an array of project ids for which the user has explicitly turned mail notifications on
               def notified_projects_ids
                 @notified_projects_ids ||= memberships.select {|m| m.mail_notification?}.collect(&:project_id)
               end
               def notified_project_ids=(ids)
                 @notified_projects_ids_changed = true
                 @notified_projects_ids = ids.map(&:to_i).uniq.select {|n| n > 0}
               end
               # Updates per project notifications (after_save callback)
               def update_notified_project_ids
                 if @notified_projects_ids_changed
                   ids = (mail_notification == 'selected' ? Array.wrap(notified_projects_ids).reject(&:blank?) : [])
                   members.update_all(:mail_notification => false)
                   members.where(:project_id => ids).update_all(:mail_notification => true) if ids.any?
                 end
               end
               private :update_notified_project_ids
               def valid_notification_options
                 self.class.valid_notification_options(self)
               end
               # Only users that belong to more than 1 project can select projects for which they are notified
               def self.valid_notification_options(user=nil)
                 # Note that @user.membership.size would fail since AR ignores
                 # :include association option when doing a count
                 if user.nil? || user.memberships.length < 1
                   MAIL_NOTIFICATION_OPTIONS.reject {|option| option.first == 'selected'}
                 else
                   MAIL_NOTIFICATION_OPTIONS
                 end
               end
               # Find a user account by matching the exact login and then a case-insensitive
               # version.  Exact matches will be given priority.
               def self.find_by_login(login)
                 login = Redmine::CodesetUtil.replace_invalid_utf8(login.to_s)
                 if login.present?
                   # First look for an exact match
                   user = where(:login => login).detect {|u| u.login == login}
                   unless user
                     # Fail over to case-insensitive if none was found
                     user = where("LOWER(login) = ?", login.downcase).first
                   end
                   user
                 end
               end
               def self.find_by_rss_key(key)
                 Token.find_active_user('feeds', key)
               end
               def self.find_by_api_key(key)
                 Token.find_active_user('api', key)
               end
               # Makes find_by_mail case-insensitive
               def self.find_by_mail(mail)
                 having_mail(mail).first
               end
               # Returns true if the default admin account can no longer be used
               def self.default_admin_account_changed?
                 !User.active.find_by_login("admin").try(:check_password?, "admin")
               end
               def to_s
                 name
               end
               CSS_CLASS_BY_STATUS = {
                 STATUS_ANONYMOUS  => 'anon',
                 STATUS_ACTIVE     => 'active',
                 STATUS_REGISTERED => 'registered',
                 STATUS_LOCKED     => 'locked'
               }
               def css_classes
                 "user #{CSS_CLASS_BY_STATUS[status]}"
               end
               # Returns the current day according to user's time zone
               def today
                 if time_zone.nil?
                   Date.today
                 else
                   Time.now.in_time_zone(time_zone).to_date
                 end
               end
               # Returns the day of +time+ according to user's time zone
               def time_to_date(time)
                 if time_zone.nil?
                   time.to_date
                 else
                   time.in_time_zone(time_zone).to_date
                 end
               end
               def logged?
                 true
               end
               def anonymous?
                 !logged?
               end
               # Returns user's membership for the given project
               # or nil if the user is not a member of project
               def membership(project)
                 project_id = project.is_a?(Project) ? project.id : project
                 @membership_by_project_id ||= Hash.new {|h, project_id|
                   h[project_id] = memberships.where(:project_id => project_id).first
                 }
                 @membership_by_project_id[project_id]
               end
               # Returns the user's bult-in role
               def builtin_role
                 @builtin_role ||= Role.non_member
               end
               # Return user's roles for project
               def roles_for_project(project)
                 # No role on archived projects
                 return [] if project.nil? || project.archived?
                 if membership = membership(project)
                   membership.roles.dup
                 elsif project.is_public?
                   project.override_roles(builtin_role)
                 else
                   []
                 end
               end
               # Returns a hash of user's projects grouped by roles
               def projects_by_role
                 return @projects_by_role if @projects_by_role
                 hash = Hash.new([])
                 group_class = anonymous? ? GroupAnonymous : GroupNonMember
                 members = Member.joins(:project, :principal).
                   where("#{Project.table_name}.status <> 9").
                   where("#{Member.table_name}.user_id = ? OR (#{Project.table_name}.is_public = ? AND #{Principal.table_name}.type = ?)", self.id, true, group_class.name).
                   preload(:project, :roles).
                   to_a
                 members.reject! {|member| member.user_id != id && project_ids.include?(member.project_id)}
                 members.each do |member|
                   if member.project
                     member.roles.each do |role|
                       hash[role] = [] unless hash.key?(role)
                       hash[role] << member.project
                     end
                   end
                 end
                 hash.each do |role, projects|
                   projects.uniq!
                 end
                 @projects_by_role = hash
               end
               # Returns the ids of visible projects
               def visible_project_ids
                 @visible_project_ids ||= Project.visible(self).pluck(:id)
               end
+              # Returns the roles that the user is allowed to manage for the given project
+              def managed_roles(project)
+                if admin?
+                  Role.givable.to_a
+                else
+                  membership(project).try(:managed_roles) || []
+                end
+              end
               # Returns true if user is arg or belongs to arg
               def is_or_belongs_to?(arg)
                 if arg.is_a?(User)
                   self == arg
                 elsif arg.is_a?(Group)
                   arg.users.include?(self)
                 else
                   false
                 end
               end
               # Return true if the user is allowed to do the specified action on a specific context
               # Action can be:
               # * a parameter-like Hash (eg. :controller => 'projects', :action => 'edit')
               # * a permission Symbol (eg. :edit_project)
               # Context can be:
               # * a project : returns true if user is allowed to do the specified action on this project
               # * an array of projects : returns true if user is allowed on every project
               # * nil with options[:global] set : check if user has at least one role allowed for this action,
               #   or falls back to Non Member / Anonymous permissions depending if the user is logged
               def allowed_to?(action, context, options={}, &block)
                 if context && context.is_a?(Project)
                   return false unless context.allows_to?(action)
                   # Admin users are authorized for anything else
                   return true if admin?
                   roles = roles_for_project(context)
                   return false unless roles
                   roles.any? {|role|
                     (context.is_public? || role.member?) &&
                     role.allowed_to?(action) &&
                     (block_given? ? yield(role, self) : true)
                   }
                 elsif context && context.is_a?(Array)
                   if context.empty?
                     false
                   else
                     # Authorize if user is authorized on every element of the array
                     context.map {|project| allowed_to?(action, project, options, &block)}.reduce(:&)
                   end
                 elsif context
                   raise ArgumentError.new("#allowed_to? context argument must be a Project, an Array of projects or nil")
                 elsif options[:global]
                   # Admin users are always authorized
                   return true if admin?
                   # authorize if user has at least one role that has this permission
                   roles = memberships.collect {|m| m.roles}.flatten.uniq
                   roles << (self.logged? ? Role.non_member : Role.anonymous)
                   roles.any? {|role|
                     role.allowed_to?(action) &&
                     (block_given? ? yield(role, self) : true)
                   }
                 else
                   false
                 end
               end
               # Is the user allowed to do the specified action on any project?
               # See allowed_to? for the actions and valid options.
               #
               # NB: this method is not used anywhere in the core codebase as of
               # 2.5.2, but it's used by many plugins so if we ever want to remove
               # it it has to be carefully deprecated for a version or two.
               def allowed_to_globally?(action, options={}, &block)
                 allowed_to?(action, nil, options.reverse_merge(:global => true), &block)
               end
               def allowed_to_view_all_time_entries?(context)
                 allowed_to?(:view_time_entries, context) do |role, user|
                   role.time_entries_visibility == 'all'
                 end
               end
               # Returns true if the user is allowed to delete the user's own account
               def own_account_deletable?
                 Setting.unsubscribe? &&
                   (!admin? || User.active.where("admin = ? AND id <> ?", true, id).exists?)
               end
               safe_attributes 'login',
                 'firstname',
                 'lastname',
                 'mail',
                 'mail_notification',
                 'notified_project_ids',
                 'language',
                 'custom_field_values',
                 'custom_fields',
                 'identity_url'
               safe_attributes 'status',
                 'auth_source_id',
                 'generate_password',
                 'must_change_passwd',
                 :if => lambda {|user, current_user| current_user.admin?}
               safe_attributes 'group_ids',
                 :if => lambda {|user, current_user| current_user.admin? && !user.new_record?}
               # Utility method to help check if a user should be notified about an
               # event.
               #
               # TODO: only supports Issue events currently
               def notify_about?(object)
                 if mail_notification == 'all'
                   true
                 elsif mail_notification.blank? || mail_notification == 'none'
                   false
                 else
                   case object
                   when Issue
                     case mail_notification
                     when 'selected', 'only_my_events'
                       # user receives notifications for created/assigned issues on unselected projects
                       object.author == self || is_or_belongs_to?(object.assigned_to) || is_or_belongs_to?(object.assigned_to_was)
                     when 'only_assigned'
                       is_or_belongs_to?(object.assigned_to) || is_or_belongs_to?(object.assigned_to_was)
                     when 'only_owner'
                       object.author == self
                     end
                   when News
                     # always send to project members except when mail_notification is set to 'none'
                     true
                   end
                 end
               end
               def self.current=(user)
                 RequestStore.store[:current_user] = user
               end
               def self.current
                 RequestStore.store[:current_user] ||= User.anonymous
               end
               # Returns the anonymous user.  If the anonymous user does not exist, it is created.  There can be only
               # one anonymous user per database.
               def self.anonymous
                 anonymous_user = AnonymousUser.first
                 if anonymous_user.nil?
                   anonymous_user = AnonymousUser.create(:lastname => 'Anonymous', :firstname => '', :login => '', :status => 0)
                   raise 'Unable to create the anonymous user.' if anonymous_user.new_record?
                 end
                 anonymous_user
               end
               # Salts all existing unsalted passwords
               # It changes password storage scheme from SHA1(password) to SHA1(salt + SHA1(password))
               # This method is used in the SaltPasswords migration and is to be kept as is
               def self.salt_unsalted_passwords!
                 transaction do
                   User.where("salt IS NULL OR salt = ''").find_each do |user|
                     next if user.hashed_password.blank?
                     salt = User.generate_salt
                     hashed_password = User.hash_password("#{salt}#{user.hashed_password}")
                     User.where(:id => user.id).update_all(:salt => salt, :hashed_password => hashed_password)
                   end
                 end
               end
               protected
               def validate_password_length
                 return if password.blank? && generate_password?
                 # Password length validation based on setting
                 if !password.nil? && password.size < Setting.password_min_length.to_i
                   errors.add(:password, :too_short, :count => Setting.password_min_length.to_i)
                 end
               end
               def instantiate_email_address
                 email_address || build_email_address
               end
               private
               def generate_password_if_needed
                 if generate_password? && auth_source.nil?
                   length = [Setting.password_min_length.to_i + 2, 10].max
                   random_password(length)
                 end
               end
               # Delete all outstanding password reset tokens on password change.
               # Delete the autologin tokens on password change to prohibit session leakage.
               # This helps to keep the account secure in case the associated email account
               # was compromised.
               def destroy_tokens
                 if hashed_password_changed?
                   tokens = ['recovery', 'autologin']
                   Token.where(:user_id => id, :action => tokens).delete_all
                 end
               end
               # Removes references that are not handled by associations
               # Things that are not deleted are reassociated with the anonymous user
               def remove_references_before_destroy
                 return if self.id.nil?
                 substitute = User.anonymous
                 Attachment.where(['author_id = ?', id]).update_all(['author_id = ?', substitute.id])
                 Comment.where(['author_id = ?', id]).update_all(['author_id = ?', substitute.id])
                 Issue.where(['author_id = ?', id]).update_all(['author_id = ?', substitute.id])
                 Issue.where(['assigned_to_id = ?', id]).update_all('assigned_to_id = NULL')
                 Journal.where(['user_id = ?', id]).update_all(['user_id = ?', substitute.id])
                 JournalDetail.
                   where(["property = 'attr' AND prop_key = 'assigned_to_id' AND old_value = ?", id.to_s]).
                   update_all(['old_value = ?', substitute.id.to_s])
                 JournalDetail.
                   where(["property = 'attr' AND prop_key = 'assigned_to_id' AND value = ?", id.to_s]).
                   update_all(['value = ?', substitute.id.to_s])
                 Message.where(['author_id = ?', id]).update_all(['author_id = ?', substitute.id])
                 News.where(['author_id = ?', id]).update_all(['author_id = ?', substitute.id])
                 # Remove private queries and keep public ones
                 ::Query.delete_all ['user_id = ? AND visibility = ?', id, ::Query::VISIBILITY_PRIVATE]
                 ::Query.where(['user_id = ?', id]).update_all(['user_id = ?', substitute.id])
                 TimeEntry.where(['user_id = ?', id]).update_all(['user_id = ?', substitute.id])
                 Token.delete_all ['user_id = ?', id]
                 Watcher.delete_all ['user_id = ?', id]
                 WikiContent.where(['author_id = ?', id]).update_all(['author_id = ?', substitute.id])
                 WikiContent::Version.where(['author_id = ?', id]).update_all(['author_id = ?', substitute.id])
               end
               # Return password digest
               def self.hash_password(clear_password)
                 Digest::SHA1.hexdigest(clear_password || "")
               end
               # Returns a 128bits random salt as a hex string (32 chars long)
               def self.generate_salt
                 Redmine::Utils.random_hex(16)
               end
             end
             class AnonymousUser < User
               validate :validate_anonymous_uniqueness, :on => :create
               def validate_anonymous_uniqueness
                 # There should be only one AnonymousUser in the database
                 errors.add :base, 'An anonymous user already exists.' if AnonymousUser.exists?
               end
               def available_custom_fields
                 []
               end
               # Overrides a few properties
               def logged?; false end
               def admin; false end
               def name(*args); I18n.t(:label_user_anonymous) end
               def mail=(*args); nil end
               def mail; nil end
               def time_zone; nil end
               def rss_key; nil end
               def pref
                 UserPreference.new(:user => self)
               end
               # Returns the user's bult-in role
               def builtin_role
                 @builtin_role ||= Role.anonymous
               end
               def membership(*args)
                 nil
               end
               def member_of?(*args)
                 false
               end
               # Anonymous user can not be destroyed
               def destroy
                 false
               end
               protected
               def instantiate_email_address
               end
             end

app/views/members/_new_form.html.erb +1 -1

             <fieldset class="box">
               <legend><%= label_tag("principal_search", l(:label_principal_search)) %></legend>
               <p><%= text_field_tag('principal_search', nil) %></p>
               <%= javascript_tag "observeSearchfield('principal_search', null, '#{ escape_javascript autocomplete_project_memberships_path(@project, :format => 'js') }')" %>
               <div id="principals_for_new_member">
                 <%= render_principals_for_new_members(@project) %>
               </div>
             </fieldset>
             <fieldset class="box">
               <legend><%= l(:label_role_plural) %> <%= toggle_checkboxes_link('.roles-selection input') %></legend>
               <div class="roles-selection">
-                <% Role.givable.all.each do |role| %>
+                <% User.current.managed_roles(@project).each do |role| %>
                   <label><%= check_box_tag 'membership[role_ids][]', role.id, false, :id => nil %> <%= role %></label>
                 <% end %>
               </div>
             </fieldset>

app/views/projects/settings/_members.html.erb +1 -3

             <% roles = Role.find_all_givable
                members = @project.member_principals.includes(:member_roles, :roles, :principal).to_a.sort %>
             <p><%= link_to l(:label_member_new), new_project_membership_path(@project), :remote => true, :class => "icon icon-add" %></p>
             <% if members.any? %>
             <table class="list members">
               <thead>
                 <tr>
                   <th><%= l(:label_user) %> / <%= l(:label_group) %></th>
                   <th><%= l(:label_role_plural) %></th>
                   <th style="width:15%"></th>
                   <%= call_hook(:view_projects_settings_members_table_header, :project => @project) %>
                 </tr>
               </thead>
               <tbody>
               <% members.each do |member| %>
               <% next if member.new_record? %>
               <tr id="member-<%= member.id %>" class="<%= cycle 'odd', 'even' %> member">
               <td class="name <%= member.principal.class.name.downcase %>"><%= link_to_user member.principal %></td>
               <td class="roles">
                 <span id="member-<%= member.id %>-roles"><%= member.roles.sort.collect(&:to_s).join(', ') %></span>
                   <%= form_for(member,
                                {:as => :membership, :remote => true,
                                 :url => membership_path(member),
                                 :method => :put,
                                 :html => { :id => "member-#{member.id}-roles-form", :class => 'hol' }}
                          ) do |f| %>
                     <p>
                       <% roles.each do |role| %>
                       <label>
                         <%= check_box_tag('membership[role_ids][]',
                                           role.id, member.roles.include?(role),
                                           :id => nil,
-                                          :disabled => member.member_roles.detect {
+                                          :disabled => !member.role_editable?(role)) %> <%= role %>
-                                             |mr| mr.role_id == role.id && !mr.inherited_from.nil?
-                                             } ) %> <%= role %>
                       </label><br />
                       <% end %>
                     </p>
                     <%= hidden_field_tag 'membership[role_ids][]', '', :id => nil %>
                     <p>
                       <%= submit_tag l(:button_save), :class => "small" %>
                       <%= link_to_function(l(:button_cancel),
                                            "$('#member-#{member.id}-roles').show(); $('#member-#{member.id}-roles-form').hide(); return false;") %>
                     </p>
                   <% end %>
               </td>
               <td class="buttons">
                   <%= link_to_function l(:button_edit),
                                        "$('#member-#{member.id}-roles').hide(); $('#member-#{member.id}-roles-form').show(); return false;",
                                        :class => 'icon icon-edit' %>
                   <%= delete_link membership_path(member),
                                   :remote => true,
                                   :data => (!User.current.admin? && member.include?(User.current) ? {:confirm => l(:text_own_membership_delete_confirmation)} : {}) if member.deletable? %>
               </td>
               <%= call_hook(:view_projects_settings_members_table_row, { :project => @project, :member => member}) %>
               </tr>
             <% end; reset_cycle %>
               </tbody>
             </table>
             <% else %>
             <p class="nodata"><%= l(:label_no_data) %></p>
             <% end %>

app/views/roles/_form.html.erb +32 -1

             <%= error_messages_for 'role' %>
             <div class="box tabular">
               <% unless @role.builtin? %>
                 <p><%= f.text_field :name, :required => true %></p>
                 <p><%= f.check_box :assignable %></p>
               <% end %>
               <% unless @role.anonymous? %>
                 <p><%= f.select :issues_visibility, Role::ISSUES_VISIBILITY_OPTIONS.collect {|v| [l(v.last), v.first]} %></p>
               <% end %>
               <% unless @role.anonymous? %>
                 <p><%= f.select :time_entries_visibility, Role::TIME_ENTRIES_VISIBILITY_OPTIONS.collect {|v| [l(v.last), v.first]} %></p>
               <% end %>
               <p><%= f.select :users_visibility, Role::USERS_VISIBILITY_OPTIONS.collect {|v| [l(v.last), v.first]} %></p>
+              <% unless @role.builtin? %>
+                <p id="manage_members_options">
+                  <label>Gestion des membres</label>
+                  <label class="block">
+                    <%= radio_button_tag 'role[all_roles_managed]', 1, @role.all_roles_managed?, :id => 'role_all_roles_managed_on',
+                          :data => {:disables => '.role_managed_role input'} %>
+                    tous les rôles
+                  </label>
+                  <label class="block">
+                    <%= radio_button_tag 'role[all_roles_managed]', 0, !@role.all_roles_managed?, :id => 'role_all_roles_managed_off',
+                          :data => {:enables => '.role_managed_role input'} %>
+                    ces rôles uniquement:
+                  </label>
+                  <% Role.givable.sorted.each do |role| %>
+                    <label class="block role_managed_role" style="padding-left:2em;">
+                      <%= check_box_tag 'role[managed_role_ids][]', role.id, @role.managed_roles.include?(role), :id => nil %>
+                      <%= role.name %>
+                    </label>
+                  <% end %>
+                  <%= hidden_field_tag 'role[managed_role_ids][]', '' %>
+              <% end %>
               <% if @role.new_record? && @roles.any? %>
                 <p><label for="copy_workflow_from"><%= l(:label_copy_workflow_from) %></label>
                 <%= select_tag(:copy_workflow_from, content_tag("option") + options_from_collection_for_select(@roles, :id, :name, params[:copy_workflow_from] || @copy_from.try(:id))) %></p>
               <% end %>
             </div>
             <h3><%= l(:label_permissions) %></h3>
             <div class="box tabular" id="permissions">
             <% perms_by_module = @role.setable_permissions.group_by {|p| p.project_module.to_s} %>
             <% perms_by_module.keys.sort.each do |mod| %>
                 <fieldset><legend><%= mod.blank? ? l(:label_project) : l_or_humanize(mod, :prefix => 'project_module_') %></legend>
                 <% perms_by_module[mod].each do |permission| %>
                     <label class="floating">
-                    <%= check_box_tag 'role[permissions][]', permission.name, (@role.permissions.include? permission.name), :id => nil %>
+                    <%= check_box_tag 'role[permissions][]', permission.name, (@role.permissions.include? permission.name),
+                          :id => "role_permissions_#{permission.name}" %>
                     <%= l_or_humanize(permission.name, :prefix => 'permission_') %>
                     </label>
                 <% end %>
                 </fieldset>
             <% end %>
             <br /><%= check_all_links 'permissions' %>
             <%= hidden_field_tag 'role[permissions][]', '' %>
             </div>
+            <%= javascript_tag do %>
+            $(document).ready(function(){
+              $("#role_permissions_manage_members").change(function(){
+                $("#manage_members_options").toggle($(this).is(":checked"));
+              }).change();
+            });
+            <% end %>

test/functional/members_controller_test.rb +81 -2

             # Redmine - project management software
             # Copyright (C) 2006-2015  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require File.expand_path('../../test_helper', __FILE__)
             class MembersControllerTest < ActionController::TestCase
               fixtures :projects, :members, :member_roles, :roles, :users
               def setup
                 User.current = nil
                 @request.session[:user_id] = 2
               end
               def test_new
                 get :new, :project_id => 1
                 assert_response :success
               end
+              def test_new_should_propose_managed_roles_only
+                role = Role.find(1)
+                role.update! :all_roles_managed => false
+                role.managed_roles = Role.where(:id => [2, 3]).to_a
+                get :new, :project_id => 1
+                assert_response :success
+                assert_select 'div.roles-selection' do
+                  assert_select 'label', :text => 'Manager', :count => 0
+                  assert_select 'label', :text => 'Developer'
+                  assert_select 'label', :text => 'Reporter'
+                end
+              end
               def test_xhr_new
                 xhr :get, :new, :project_id => 1
                 assert_response :success
                 assert_equal 'text/javascript', response.content_type
               end
               def test_create
                 assert_difference 'Member.count' do
                   post :create, :project_id => 1, :membership => {:role_ids => [1], :user_id => 7}
                 end
                 assert_redirected_to '/projects/ecookbook/settings/members'
                 assert User.find(7).member_of?(Project.find(1))
               end
               def test_create_multiple
                 assert_difference 'Member.count', 3 do
                   post :create, :project_id => 1, :membership => {:role_ids => [1], :user_ids => [7, 8, 9]}
                 end
                 assert_redirected_to '/projects/ecookbook/settings/members'
                 assert User.find(7).member_of?(Project.find(1))
               end
+              def test_create_should_ignore_unmanaged_roles
+                role = Role.find(1)
+                role.update! :all_roles_managed => false
+                role.managed_roles = Role.where(:id => [2, 3]).to_a
+                assert_difference 'Member.count' do
+                  post :create, :project_id => 1, :membership => {:role_ids => [1, 2], :user_id => 7}
+                end
+                member = Member.order(:id => :desc).first
+                assert_equal [2], member.role_ids
+              end
+              def test_create_should_be_allowed_for_admin_without_role
+                User.find(1).members.delete_all
+                @request.session[:user_id] = 1
+                assert_difference 'Member.count' do
+                  post :create, :project_id => 1, :membership => {:role_ids => [1, 2], :user_id => 7}
+                end
+                member = Member.order(:id => :desc).first
+                assert_equal [1, 2], member.role_ids
+              end
               def test_xhr_create
                 assert_difference 'Member.count', 3 do
                   xhr :post, :create, :project_id => 1, :membership => {:role_ids => [1], :user_ids => [7, 8, 9]}
                   assert_response :success
                   assert_template 'create'
                   assert_equal 'text/javascript', response.content_type
                 end
                 assert User.find(7).member_of?(Project.find(1))
                 assert User.find(8).member_of?(Project.find(1))
                 assert User.find(9).member_of?(Project.find(1))
                 assert_include 'tab-content-members', response.body
               end
               def test_xhr_create_with_failure
                 assert_no_difference 'Member.count' do
                   xhr :post, :create, :project_id => 1, :membership => {:role_ids => [], :user_ids => [7, 8, 9]}
                   assert_response :success
                   assert_template 'create'
                   assert_equal 'text/javascript', response.content_type
                 end
                 assert_match /alert/, response.body, "Alert message not sent"
               end
-              def test_edit
+              def test_update
                 assert_no_difference 'Member.count' do
                   put :update, :id => 2, :membership => {:role_ids => [1], :user_id => 3}
                 end
                 assert_redirected_to '/projects/ecookbook/settings/members'
               end
-              def test_xhr_edit
+              def test_update_should_not_add_unmanaged_roles
+                role = Role.find(1)
+                role.update! :all_roles_managed => false
+                role.managed_roles = Role.where(:id => [2, 3]).to_a
+                member = Member.create!(:user => User.find(9), :role_ids => [3], :project_id => 1)
+                put :update, :id => member.id, :membership => {:role_ids => [1, 2, 3]}
+                assert_equal [2, 3], member.reload.role_ids.sort
+              end
+              def test_update_should_not_remove_unmanaged_roles
+                role = Role.find(1)
+                role.update! :all_roles_managed => false
+                role.managed_roles = Role.where(:id => [2, 3]).to_a
+                member = Member.create!(:user => User.find(9), :role_ids => [1, 3], :project_id => 1)
+                put :update, :id => member.id, :membership => {:role_ids => [2]}
+                assert_equal [1, 2], member.reload.role_ids.sort
+              end
+              def test_xhr_update
                 assert_no_difference 'Member.count' do
                   xhr :put, :update, :id => 2, :membership => {:role_ids => [1], :user_id => 3}
                   assert_response :success
                   assert_template 'update'
                   assert_equal 'text/javascript', response.content_type
                 end
                 member = Member.find(2)
                 assert_equal [1], member.role_ids
                 assert_equal 3, member.user_id
                 assert_include 'tab-content-members', response.body
               end
               def test_destroy
                 assert_difference 'Member.count', -1 do
                   delete :destroy, :id => 2
                 end
                 assert_redirected_to '/projects/ecookbook/settings/members'
                 assert !User.find(3).member_of?(Project.find(1))
               end
+              def test_destroy_should_fail_with_unmanaged_roles
+                role = Role.find(1)
+                role.update! :all_roles_managed => false
+                role.managed_roles = Role.where(:id => [2, 3]).to_a
+                member = Member.create!(:user => User.find(9), :role_ids => [1, 3], :project_id => 1)
+                assert_no_difference 'Member.count' do
+                  delete :destroy, :id => member.id
+                end
+              end
+              def test_destroy_should_succeed_with_managed_roles_only
+                role = Role.find(1)
+                role.update! :all_roles_managed => false
+                role.managed_roles = Role.where(:id => [2, 3]).to_a
+                member = Member.create!(:user => User.find(9), :role_ids => [3], :project_id => 1)
+                assert_difference 'Member.count', -1 do
+                  delete :destroy, :id => member.id
+                end
+              end
               def test_xhr_destroy
                 assert_difference 'Member.count', -1 do
                   xhr :delete, :destroy, :id => 2
                   assert_response :success
                   assert_template 'destroy'
                   assert_equal 'text/javascript', response.content_type
                 end
                 assert_nil Member.find_by_id(2)
                 assert_include 'tab-content-members', response.body
               end
               def test_autocomplete
                 xhr :get, :autocomplete, :project_id => 1, :q => 'mis', :format => 'js'
                 assert_response :success
                 assert_include 'User Misc', response.body
               end
             end

test/unit/member_test.rb +31 0

             # Redmine - project management software
             # Copyright (C) 2006-2015  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require File.expand_path('../../test_helper', __FILE__)
             class MemberTest < ActiveSupport::TestCase
               fixtures :projects, :trackers, :issue_statuses, :issues,
                        :enumerations, :users, :issue_categories,
                        :projects_trackers,
                        :roles,
                        :member_roles,
                        :members,
                        :enabled_modules,
                        :groups_users,
                        :watchers,
                        :journals, :journal_details,
                        :messages,
                        :wikis, :wiki_pages, :wiki_contents, :wiki_content_versions,
                        :boards
               include Redmine::I18n
               def setup
                 @jsmith = Member.find(1)
               end
               def test_create
                 member = Member.new(:project_id => 1, :user_id => 4, :role_ids => [1, 2])
                 assert member.save
                 member.reload
                 assert_equal 2, member.roles.size
                 assert_equal Role.find(1), member.roles.sort.first
               end
               def test_update
                 assert_equal "eCookbook", @jsmith.project.name
                 assert_equal "Manager", @jsmith.roles.first.name
                 assert_equal "jsmith", @jsmith.user.login
                 @jsmith.mail_notification = !@jsmith.mail_notification
                 assert @jsmith.save
               end
               def test_update_roles
                 assert_equal 1, @jsmith.roles.size
                 @jsmith.role_ids = [1, 2]
                 assert @jsmith.save
                 assert_equal 2, @jsmith.reload.roles.size
               end
               def test_validate
                 member = Member.new(:project_id => 1, :user_id => 2, :role_ids => [2])
                 # same use cannot have more than one membership for a project
                 assert !member.save
                 # must have one role at least
                 user = User.new(:firstname => "new1", :lastname => "user1",
                                 :mail => "test_validate@somenet.foo")
                 user.login = "test_validate"
                 user.password, user.password_confirmation = "password", "password"
                 assert user.save
                 set_language_if_valid 'fr'
                 member = Member.new(:project_id => 1, :user_id => user.id, :role_ids => [])
                 assert !member.save
                 assert_include I18n.translate('activerecord.errors.messages.empty'), member.errors[:role]
                 assert_equal "R\xc3\xb4le doit \xc3\xaatre renseign\xc3\xa9(e)".force_encoding('UTF-8'),
                 	[member.errors.full_messages].flatten.join
               end
               def test_validate_member_role
                 user = User.new(:firstname => "new1", :lastname => "user1",
                                 :mail => "test_validate@somenet.foo")
                 user.login = "test_validate_member_role"
                 user.password, user.password_confirmation = "password", "password"
                 assert user.save
                 member = Member.new(:project_id => 1, :user_id => user.id, :role_ids => [5])
                 assert !member.save
               end
               def test_set_issue_category_nil_should_handle_nil_values
                 m = Member.new
                 assert_nil m.user
                 assert_nil m.project
                 assert_nothing_raised do
                   m.set_issue_category_nil
                 end
               end
               def test_destroy
                 category1 = IssueCategory.find(1)
                 assert_equal @jsmith.user.id, category1.assigned_to_id
                 assert_difference 'Member.count', -1 do
                   assert_difference 'MemberRole.count', -1 do
                     @jsmith.destroy
                   end
                 end
                 assert_raise(ActiveRecord::RecordNotFound) { Member.find(@jsmith.id) }
                 category1.reload
                 assert_nil category1.assigned_to_id
               end
               def test_destroy_should_trigger_callbacks_only_once
                 Member.class_eval { def destroy_test_callback; end}
                 Member.after_destroy :destroy_test_callback
                 m = Member.create!(:user_id => 1, :project_id => 1, :role_ids => [1,3])
                 Member.any_instance.expects(:destroy_test_callback).once
                 assert_difference 'Member.count', -1 do
                   assert_difference 'MemberRole.count', -2 do
                     m.destroy
                   end
                 end
                 assert m.destroyed?
               ensure
                 Member._destroy_callbacks.delete(:destroy_test_callback)
               end
               def test_roles_should_be_unique
                 m = Member.new(:user_id => 1, :project_id => 1)
                 m.member_roles.build(:role_id => 1)
                 m.member_roles.build(:role_id => 1)
                 m.save!
                 m.reload
                 assert_equal 1, m.roles.count
                 assert_equal [1], m.roles.ids
               end
               def test_sort_without_roles
                 a = Member.new(:roles => [Role.first])
                 b = Member.new
                 assert_equal -1, a <=> b
                 assert_equal 1,  b <=> a
               end
               def test_sort_without_principal
                 role = Role.first
                 a = Member.new(:roles => [role], :principal => User.first)
                 b = Member.new(:roles => [role])
                 assert_equal -1, a <=> b
                 assert_equal 1,  b <=> a
               end
+              def test_managed_roles_should_return_all_roles_for_role_with_all_roles_managed
+                member = Member.new
+                member.roles << Role.generate!(:permissions => [:manage_members], :all_roles_managed => true)
+                assert_equal Role.givable.all, member.managed_roles
+              end
+              def test_managed_roles_should_return_all_roles_for_admins
+                member = Member.new(:user => User.find(1))
+                member.roles << Role.generate!
+                assert_equal Role.givable.all, member.managed_roles
+              end
+              def test_managed_roles_should_return_limited_roles_for_role_without_all_roles_managed
+                member = Member.new
+                member.roles << Role.generate!(:permissions => [:manage_members], :all_roles_managed => false, :managed_role_ids => [2, 3])
+                assert_equal [2, 3], member.managed_roles.map(&:id).sort
+              end
+              def test_managed_roles_should_cumulated_managed_roles
+                member = Member.new
+                member.roles << Role.generate!(:permissions => [:manage_members], :all_roles_managed => false, :managed_role_ids => [3])
+                member.roles << Role.generate!(:permissions => [:manage_members], :all_roles_managed => false, :managed_role_ids => [2])
+                assert_equal [2, 3], member.managed_roles.map(&:id).sort
+              end
+              def test_managed_roles_should_return_no_roles_for_role_without_permission
+                member = Member.new
+                member.roles << Role.generate!(:all_roles_managed => true)
+                assert_equal [], member.managed_roles
+              end
             end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages