raggedstaff/openfoodnetwork
1
0
Fork 0
mirror of https://github.com/openfoodfoundation/openfoodnetwork synced 2026-02-08 22:56:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

Enterprise user can only see relationships involving their enterprises

Browse Source
This commit is contained in:
Rohan Mitchell
2014-05-22 11:27:19 +10:00
parent d7b4318aff
commit c2f762d570
2 changed files with 17 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/controllers/admin/enterprise_relationships_controller.rb
View File

@@ -3,7 +3,7 @@ module Admin
def index
@my_enterprises = Enterprise.managed_by(spree_current_user).by_name
@all_enterprises = Enterprise.by_name
@enterprise_relationships = EnterpriseRelationship.by_name
@enterprise_relationships = EnterpriseRelationship.by_name.involving_enterprises @my_enterprises
end
def create

17
spec/features/admin/enterprise_relationships_spec.rb
View File

@@ -76,17 +76,32 @@ feature %q{
end
end
context "as an enterprise user" do
let!(:d1) { create(:distributor_enterprise) }
let!(:d2) { create(:distributor_enterprise) }
let!(:d3) { create(:distributor_enterprise) }
let(:enterprise_user) { create_enterprise_user([d1]) }
let!(:er1) { create(:enterprise_relationship, parent: d1, child: d2) }
let!(:er2) { create(:enterprise_relationship, parent: d2, child: d1) }
let!(:er3) { create(:enterprise_relationship, parent: d2, child: d3) }
before { login_to_admin_as enterprise_user }
scenario "enterprise user can only see relationships involving their enterprises" do
visit admin_enterprise_relationships_path
page.should have_table_row [d1.name, 'permits', d2.name, '']
page.should have_table_row [d2.name, 'permits', d1.name, '']
page.should_not have_table_row [d2.name, 'permits', d3.name, '']
end
scenario "enterprise user can only add their own enterprises as parent" do
visit admin_enterprise_relationships_path
page.should have_select 'enterprise_relationship_parent_id', options: ['', d1.name]
page.should have_select 'enterprise_relationship_child_id', options: ['', d1.name, d2.name]
page.should have_select 'enterprise_relationship_child_id', options: ['', d1.name, d2.name, d3.name]
end
end
end