app/models/ability.rb
# Should be called after other main methods as it restricts some permissions granted earlier.
Should be called after other main methods as it restricts some permissions granted earlier.
Should be called after other main methods as it restricts some permissions granted earlier .
def user_independent_permissions
    cannot(:destroy, Form) { |f| f.not_draft? || f.has_responses? }
    cannot(:download, Form, status: "draft")
    cannot(%i[add_questions remove_questions reorder_questions], Form, &:not_draft?)
    cannot(%i[destroy update update_core], Questioning, &:published?)
    can(:update, Questioning) { |q| can?(:update, q.question) }
    cannot(:destroy, Questioning, &:data?)
    cannot(:update_core, Question) { |q| q.published? || q.data? }
    cannot(:update_code, Question, &:standard_copy?) 
    cannot(%i[add_options remove_options reorder_options], OptionSet, &:published?)
    cannot(:destroy, OptionSet) { |o| o.data? || o.in_use? || o.published? }
    cannot(:destroy, OptionNode) { |n| n.data? || n.in_use? }
    cannot(:destroy, Operation) do |op|
      op.provider_job_id.present? && Delayed::Job.exists?(op.provider_job_id) && op.status != :pending
    end
    cannot(:assign_to, Mission, locked: true)
    cannot(%i[create update destroy], Assignment, mission: {locked: true})
  end
def user_independent_permissions cannot ( :destroy , Form ) { | f | f . not_draft? || f . has_responses? } cannot ( :download , Form , status : "draft" ) cannot ( %i[ add_questions remove_questions reorder_questions ] , Form , & :not_draft? ) cannot ( %i[ destroy update update_core ] , Questioning , & :published? ) can ( :update , Questioning ) { | q | can? ( :update , q . question ) } cannot ( :destroy , Questioning , & :data? ) cannot ( :update_core , Question ) { | q | q . published? || q . data? } cannot ( :update_code , Question , & :standard_copy? ) cannot ( %i[ add_options remove_options reorder_options ] , OptionSet , & :published? ) cannot ( :destroy , OptionSet ) { | o | o . data? || o . in_use? || o . published? } cannot ( :destroy , OptionNode ) { | n | n . data? || n . in_use? } cannot ( :destroy , Operation ) do | op | op . provider_job_id . present? && Delayed :: Job . exists? ( op . provider_job_id ) && op . status != :pending end cannot ( :assign_to , Mission , locked : true ) cannot ( %i[ create update destroy ] , Assignment , mission : { locked : true } ) end
Should be called after other main methods as it restricts some permissions granted earlier.
Should be called after other main methods as it restricts some permissions granted earlier .
# BUT can update questioning (though not its core) if can update related question # we need this because questions are updated via questionings # so a question (though not its core) may be updatable even though it's published # and we need to allow access to that question via the questioning index # update_core refers to the core fields: question type, option set, constraints # question code attribute # we need these specialized permissions because option names/hints are updated via option set # operations can't be destroyed while their underlying job is in progress unless it is pending