diff --git a/app/controllers/spree/admin/base_controller_decorator.rb b/app/controllers/spree/admin/base_controller_decorator.rb new file mode 100644 index 0000000000..8e876513fa --- /dev/null +++ b/app/controllers/spree/admin/base_controller_decorator.rb @@ -0,0 +1,14 @@ +Spree::Admin::BaseController.class_eval do + # Override Spree method + # It's a shame Spree doesn't just let CanCan handle this in it's own way + def authorize_admin + if respond_to?(:model_class, true) && model_class + record = model_class + else + # this line changed to allow specificity for each non-resource controller (to be consistent with "authorize_resource :class => false", see https://github.com/ryanb/cancan/blob/60cf6a67ef59c0c9b63bc27ea0101125c4193ea6/lib/cancan/controller_resource.rb#L146) + record = self.class.to_s.sub("Controller", "").underscore.split('/').last.singularize.to_sym + end + authorize! :admin, record + authorize! action, record + end +end \ No newline at end of file diff --git a/app/models/spree/ability_decorator.rb b/app/models/spree/ability_decorator.rb index ccd4252897..9b2875ce43 100644 --- a/app/models/spree/ability_decorator.rb +++ b/app/models/spree/ability_decorator.rb @@ -17,7 +17,7 @@ class AbilityDecorator can [:admin, :index, :read, :search], Spree::Taxon can [:admin, :index, :read, :create, :edit], Spree::Classification - #User can only access orders that they are a distributor for + #Enterprise User can only access orders that they are a distributor for can [:index, :create], Spree::Order can [:admin, :read, :update, :fire, :resend ], Spree::Order do |order| user.enterprises.include? order.distributor @@ -52,6 +52,8 @@ class AbilityDecorator user.enterprises.include? enterprise end + #Enterprise User can access reports page + can [:admin, :index, :orders_and_distributors, :group_buys, :bulk_coop, :payments, :order_cycles], :report end end end