add ability for journal editors to manage project grants

ManifoldScholar · Feb 28, 2025 · 65f4e99 · 65f4e99
1 parent eba7381
commit 65f4e99
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 2 deletions.
diff --git a/api/app/authorizers/entitlement_authorizer.rb b/api/app/authorizers/entitlement_authorizer.rb
@@ -58,13 +58,15 @@ def default(_adjective, user, options = {})
     # @param [Hash] options
     # @option options [ApplicationRecord] :for
     def creatable_by?(user, options = {})
+      return false if user.marketeer?
       might_access? user, options
     end
 
     # @param [User] user
     # @param [Hash] options
     # @option options [ApplicationRecord] :for
     def manageable_by?(user, options = {})
+      return false if user.marketeer?
       might_access? user, options
     end
 

diff --git a/api/app/authorizers/project_authorizer.rb b/api/app/authorizers/project_authorizer.rb
@@ -106,9 +106,10 @@ def project_administered_by?(user, _options = {})
   # @param [User] user
   # @param [Hash] options
   def entitlements_creatable_by?(user, options = {})
+    return false if resource.draft? && !has_any_role?(user, :admin, :editor)
     options ||= {}
 
-    options[:subject] = resource
+    options[:for] = resource
 
     user.can_create? Entitlement, options
   end
@@ -117,9 +118,10 @@ def entitlements_creatable_by?(user, options = {})
   # @param [User] user
   # @param [Hash] options
   def entitlements_manageable_by?(user, options = {})
+    return false if resource.draft? && !has_any_role?(user, :admin, :editor)
     options ||= {}
 
-    options[:subject] = resource
+    options[:for] = resource
 
     user.can_manage? Entitlement, options
   end

diff --git a/api/spec/authorizers/project_authorizer_spec.rb b/api/spec/authorizers/project_authorizer_spec.rb
@@ -341,6 +341,8 @@
     it { is_expected.to be_able_to(:read).on(journal_issue.project) }
     it { is_expected.to be_able_to(:update).on(journal_issue.project) }
     it { is_expected.not_to be_able_to(:create).on(journal_issue.project) }
+    it { is_expected.to be_able_to(:manage_entitlements).on(journal_issue.project) }
+    it { is_expected.to be_able_to(:create_entitlements).on(journal_issue.project) }
 
     it "cannot delete a journal issue's project directly (delete the journal issue itself)" do
       is_expected.not_to be_able_to(:delete).on(journal_issue.project)