show order_list when logged in as Librarian next-l/enju_leaf#925

next-l · Dec 8, 2015 · 2563eda · 2563eda
1 parent c6b180f
commit 2563eda
Show file tree

Hide file tree

Showing 3 changed files with 15 additions and 4 deletions.
diff --git a/Gemfile b/Gemfile
@@ -10,6 +10,9 @@ gemspec
 # Git. Remember to move these dependencies to your gemspec before releasing
 # your gem to rubygems.org.
 gem 'enju_leaf', github: 'next-l/enju_leaf', branch: '1.2'
+gem 'enju_biblio', github: 'next-l/enju_biblio', branch: '1.2'
+gem 'enju_library', github: 'next-l/enju_library', branch: '1.2'
+gem 'enju_manifestation_viewer', github: 'next-l/enju_manifestation_viewer', branch: '1.2'
 gem 'enju_bookmark', github: 'next-l/enju_bookmark', branch: '1.2'
 
 # To use debugger

diff --git a/app/views/purchase_requests/_index.html.erb b/app/views/purchase_requests/_index.html.erb
@@ -27,8 +27,10 @@
         <%= purchase_request.author -%>
         <%= purchase_request.publisher -%>
         <%= purchase_request.pub_date -%>
-        <br />
-        <%= t('activerecord.models.order_list') %>: <%= link_to purchase_request.order_list.title, purchase_requests_path(order_list_id: purchase_request.order_list.id) if purchase_request.order_list -%>
+        <% if current_user.has_role?('Librarian') %>
+          <br />
+          <%= t('activerecord.models.order_list') %>: <%= link_to purchase_request.order_list.title, purchase_requests_path(order_list_id: purchase_request.order_list.id) if purchase_request.order_list -%>
+        <% end %>
       </td>
       <td><%= purchase_request.price -%></td>
       <td>

diff --git a/lib/enju_purchase_request.rb b/lib/enju_purchase_request.rb
@@ -17,11 +17,17 @@ module InstanceMethods
     private
 
     def get_order_list
-      @order_list = OrderList.find(params[:order_list_id]) if params[:order_list_id]
+      if params[:order_list_id]
+        @order_list = OrderList.find(params[:order_list_id])
+        authorize @order_list, :show?
+      end
     end
 
     def get_purchase_request
-      @purchase_request = PurchaseRequest.find(params[:purchase_request_id]) if params[:purchase_request_id]
+      if params[:purchase_request_id]
+        @purchase_request = PurchaseRequest.find(params[:purchase_request_id])
+        authorize @purchase_request,  :show?
+      end
     end
   end
 end