mirror of
https://github.com/we-promise/sure.git
synced 2026-05-12 15:15:01 +00:00
560c9fbff3
* Initial account sharing changes * Update schema.rb * Update schema.rb * Change sharing UI to modal * UX fixes and sharing controls * Scope include in finances better * Update totals.rb * Update totals.rb * Scope reports to finance account scope * Update impersonation_sessions_controller_test.rb * Review fixes * Update schema.rb * Update show.html.erb * FIX db validation * Refine edit permissions * Review items * Review * Review * Add application level helper * Critical review * Address remaining review items * Fix modals * more scoping * linter * small UI fix * Fix: Sync broadcasts push unscoped balance sheet to all users * Update sync_complete_event.rb The fix removes the sidebar broadcasts (which rendered unscoped account groups using family.balance_sheet without user context) along with the now-unused sidebar_targets, account_group, and family_balance_sheet private methods. The sidebar will still update correctly — when the sync completes, Family::SyncCompleteEvent#broadcast fires family.broadcast_refresh, which triggers a morph-based page refresh for each user with their own authenticated session, rendering properly scoped sidebar content.
39 lines
820 B
Ruby
39 lines
820 B
Ruby
# frozen_string_literal: true
|
|
|
|
class AccountPolicy < ApplicationPolicy
|
|
def show?
|
|
record.shared_with?(user)
|
|
end
|
|
|
|
def create?
|
|
user.member? || user.admin?
|
|
end
|
|
|
|
def update?
|
|
permission = record.permission_for(user)
|
|
permission.in?([ :owner, :full_control ])
|
|
end
|
|
|
|
# For read_write users: categorize, tag, add notes/receipts on transactions
|
|
def annotate?
|
|
permission = record.permission_for(user)
|
|
permission.in?([ :owner, :full_control, :read_write ])
|
|
end
|
|
|
|
# Only the owner can delete the account itself.
|
|
# full_control users can delete transactions but not the account.
|
|
def destroy?
|
|
record.owned_by?(user)
|
|
end
|
|
|
|
def manage_sharing?
|
|
record.owned_by?(user)
|
|
end
|
|
|
|
class Scope < ApplicationPolicy::Scope
|
|
def resolve
|
|
scope.accessible_by(user)
|
|
end
|
|
end
|
|
end
|