Merge 2604941 into a6b3880

app/controllers/authorized_users_controller.rb

@@ -1,6 +1,7 @@
 # Controller to show, create, and edit AuthorizedUsers
 class AuthorizedUsersController < ApplicationController
   load_and_authorize_resource
+
   before_action :redirect_cancel, only: %i[create update]
 
   def index

app/controllers/change_current_locations_controller.rb

@@ -1,6 +1,7 @@
 # Controller for the batch update for current locations
 class ChangeCurrentLocationsController < ApplicationController
   load_and_authorize_resource
+
   def new
     @change_current_location = ChangeCurrentLocation.new
   end

app/controllers/change_home_locations_controller.rb

@@ -1,6 +1,7 @@
 # Controller for the change home location form
 class ChangeHomeLocationsController < ApplicationController
-  load_and_authorize_resource
+  load_and_authorize_resource param_method: :change_home_location_params
+
   def new
     @change_home_location = ChangeHomeLocation.new
   end

app/controllers/change_item_types_controller.rb

@@ -1,6 +1,7 @@
 # Controller for the change_item_type form
 class ChangeItemTypesController < ApplicationController
-  load_and_authorize_resource
+  load_and_authorize_resource param_method: :change_item_type_params
+
   def new
     @change_item_type = ChangeItemType.new
   end

app/controllers/circulation_statistics_reports_controller.rb

@@ -2,6 +2,8 @@
 #  Controller to handle the Circulation Statistics Report
 ###
 class CirculationStatisticsReportsController < ApplicationController
+  load_and_authorize_resource param_method: :circulation_statistics_report_params
+
   def new
     @circulation_statistics_report = CirculationStatisticsReport.new
   end

app/controllers/edi_error_reports_controller.rb

@@ -1,6 +1,7 @@
 # Controller to handle Edi Error Report requests
 class EdiErrorReportsController < ApplicationController
   load_and_authorize_resource
+
   has_scope :day
   has_scope :level
   has_scope :type

app/controllers/edi_inv_line_controller.rb

@@ -1,5 +1,7 @@
 # Controller for EdiInvLine editing and updating
 class EdiInvLineController < ApplicationController
+  load_and_authorize_resource param_method: :edi_inv_line_params
+
   def edit
     @edi_inv_line = EdiInvLine.find(params[:id])
   end

app/controllers/edi_invoices_controller.rb

@@ -1,6 +1,7 @@
 # Controller for EdiInvoice management
 class EdiInvoicesController < ApplicationController
   load_and_authorize_resource
+
   has_scope :vendfilter
 
   def menu; end

app/controllers/edi_lins_controller.rb

@@ -1,5 +1,7 @@
 # Controller for Edi Lines
 class EdiLinsController < ApplicationController
+  load_and_authorize_resource
+
   def allow_nobib
     @edi_lin = EdiLin.all
     respond_to do |format|

app/controllers/encumbrance_reports_controller.rb

@@ -2,6 +2,8 @@
 # Controller to handle the Encumberances Report
 ###
 class EncumbranceReportsController < ApplicationController
+  load_and_authorize_resource param_method: :batch_params
+
   before_action :set_no_cache
 
   rescue_from ActiveRecord::RecordNotFound do |exception|

app/controllers/endowed_funds_reports_controller.rb

@@ -2,6 +2,8 @@
 # Controller to handle the Encumberances Report
 ###
 class EndowedFundsReportsController < ApplicationController
+  load_and_authorize_resource param_method: :batch_params
+
   include SymphonyCgi
   before_action :set_no_cache
 

app/controllers/expenditure_reports_controller.rb

@@ -2,6 +2,8 @@
 # Controller to handle the Encumberances Report
 ###
 class ExpenditureReportsController < ApplicationController
+  load_and_authorize_resource param_method: :batch_params
+
   before_action :set_no_cache
 
   rescue_from ActiveRecord::RecordNotFound do

app/controllers/expenditures_with_circ_stats_reports_controller.rb

@@ -2,6 +2,8 @@
 # Controller to handle the Encumberances Report
 ###
 class ExpendituresWithCircStatsReportsController < ApplicationController
+  load_and_authorize_resource param_method: :batch_params
+
   rescue_from ActiveRecord::RecordNotFound do |exception|
     flash[:error] = 'There are no records for the specified date range'
     render action: 'new'

app/controllers/package_files_controller.rb

@@ -3,6 +3,7 @@
 ##
 class PackageFilesController < ApplicationController
   load_and_authorize_resource
+
   def queue
     @files = PackageFile.files_to_load
   end

app/controllers/packages_controller.rb

@@ -3,6 +3,7 @@
 ##
 class PackagesController < ApplicationController
   load_and_authorize_resource
+
   before_action :set_package, only: %i[show edit update destroy activate deactivate]
 
   # GET /packages

app/controllers/sal3_batch_requests_batches_controller.rb

@@ -1,6 +1,7 @@
 # Controller to handle the SAL3 Batch Requests landing page
 class Sal3BatchRequestsBatchesController < ApplicationController
-  load_and_authorize_resource
+  load_and_authorize_resource param_method: :sal3_batch_requests_batch_params
+
   has_scope :pullmon
   has_scope :pulltues
   has_scope :pullwed
@@ -27,7 +28,7 @@ def create
     if @sal3_batch_requests_batch.save
       array_of_item_ids = @sal3_batch_requests_batch.parse_bc_file
       begin
-        Sal3BatchRequestBcs.create_sal3_request(array_of_item_ids, bcs_params(@sal3_batch_requests_batch))
+        Sal3BatchRequestsBc.create_sal3_request(array_of_item_ids, bcs_params(@sal3_batch_requests_batch))
       rescue ActiveRecord::RecordNotUnique
         flash[:warning] = 'Batch with unique barcodes already requested.'
       end

app/controllers/sal3_batch_request_bcs_controller.rb → app/controllers/sal3_batch_requests_bcs_controller.rb

@@ -1,7 +1,9 @@
 # Controller to handle the request to view the barcodes for Sal3 batch requests
-class Sal3BatchRequestBcsController < ApplicationController
+class Sal3BatchRequestsBcsController < ApplicationController
+  authorize_resource
+
   def show
     @sal3_batch_requests_batch = Sal3BatchRequestsBatch.find(params[:id])
-    @sal3_batch_request_bcs = Sal3BatchRequestBcs.barcodes(params[:id])
+    @sal3_batch_requests_bcs = Sal3BatchRequestsBc.barcodes(params[:id])
   end
 end

app/controllers/shelf_selection_reports_controller.rb

@@ -2,6 +2,8 @@
 # Controller to handle the shelf selection report
 ###
 class ShelfSelectionReportsController < ApplicationController
+  load_and_authorize_resource param_method: :shelf_selection_report_params
+
   include SymphonyCgi
   after_action only: :create do
     submit_shelf_selection(shelf_selection_report_params)

app/controllers/test_packages_controller.rb

@@ -2,7 +2,7 @@
 # Package controller for eloader to query records on LTRXDEV2
 ##
 class TestPackagesController < ApplicationController
-  load_and_authorize_resource
+  load_and_authorize_resource param_method: :test_package_params
 
   def show
     redirect_to new_package_path(package_id: test_package_params)

app/controllers/transfer_items_controller.rb

@@ -1,6 +1,7 @@
 # Controller for the withdrawal of items from the database
 class TransferItemsController < ApplicationController
-  load_and_authorize_resource
+  load_and_authorize_resource param_method: :transfer_item_params
+
   def new
     @transfer_item = TransferItem.new
   end

app/controllers/uni_updates_batches_controller.rb

@@ -1,5 +1,7 @@
 # Controller to show and destroy UniUpdatesBatches
 class UniUpdatesBatchesController < ApplicationController
+  load_and_authorize_resource
+
   def show
     @uni_updates_batch = UniUpdatesBatch.find_by(batch_id: params[:id])
   end

app/controllers/userload_reruns_controller.rb

@@ -1,6 +1,6 @@
 # Controller for the Userload rerun form
 class UserloadRerunsController < ApplicationController
-  load_and_authorize_resource
+  load_and_authorize_resource param_method: :userload_rerun_params
 
   # GET /userload_reruns/new
   def new

app/controllers/vnd_runlogs_controller.rb

@@ -3,5 +3,6 @@
 ##
 class VndRunlogsController < ApplicationController
   load_and_authorize_resource
+
   def recent() end
 end

app/models/ability.rb

@@ -6,6 +6,7 @@ def initialize(current_user)
     current_user ||= AuthorizedUser.new
     assign_staff_specified_permission(current_user)
     assign_staff_manage_permission(current_user)
+    assign_management_reports_permissions(current_user)
     assign_staff_create_permission(current_user)
     assign_staff_read_permission(current_user)
     assign_admin_permission(current_user)
@@ -18,6 +19,9 @@ def initialize(current_user)
 
   def assign_basic_permission
     can :manage, Ckey2bibframe
+    can :read, UniUpdatesErrors
+    can :read, UniUpdMhldError
+    can :read, BatchRecordUpdate
   end
 
   def assign_user_permission
@@ -38,16 +42,32 @@ def assign_staff_create_permission(current_user)
 
   def assign_staff_read_permission(current_user)
     can :read, EdiInvoice if /Y/.match?(current_user.edi_inv_view)
+    can :read, EdiErrorReport if /Y/.match?(current_user.edi_inv_view)
     can :read, Package if /A|Y/.match?(current_user.package_manage)
     can :read, PackageFile if /A|Y/.match?(current_user.package_manage)
+    can :read, Sal3BatchRequestsBc if /A|Y/.match?(current_user.sal3_batch_req)
   end
 
   def assign_staff_manage_permission(current_user)
     can :manage, AccessionNumberUpdate if /A|Y/.match?(current_user.accession_number)
     can :manage, EdiInvoice if /A|Y/.match?(current_user.edi_inv_manage)
     can :manage, EdiErrorReport if /A|Y/.match?(current_user.edi_inv_manage)
     can :manage, LobbytrackReport if /A|Y/.match? current_user.lobbytrack_report
-    can :manage, ManagementReport if /A|Y/.match?(current_user.mgt_rpts)
+  end
+
+  def assign_management_reports_permissions(current_user)
+    return unless /A|Y/.match?(current_user.mgt_rpts)
+
+    can :manage, CirculationStatisticsReport
+    can :manage, EdiInvLine
+    can :manage, EdiLin
+    can :manage, EncumbranceReport
+    can :manage, EndowedFundsReport
+    can :manage, ExpenditureReport
+    can :manage, ExpendituresWithCircStatsReport
+    can :manage, ManagementReport
+    can :manage, Sal3BatchRequestsBatch
+    can :manage, ShelfSelectionReport
   end
 
   def assign_admin_permission(current_user)
@@ -72,6 +92,7 @@ def assign_batch_permission
     can :manage, ChangeHomeLocation
     can :manage, WithdrawItem
     can :manage, TransferItem
+    can :manage, UniUpdatesBatch
   end
 
   def dev_test_env?

app/models/sal3_batch_requests_batch.rb

@@ -15,10 +15,10 @@ class Sal3BatchRequestsBatch < ApplicationRecord
                         on: %i(create update)
   validate :batch_pullday_present
 
-  has_many :sal3_batch_request_bcs, foreign_key: 'batch_id',
-                                    class_name: 'Sal3BatchRequestBcs',
-                                    dependent: :destroy,
-                                    inverse_of: false
+  has_many :sal3_batch_requests_bcs, foreign_key: 'batch_id',
+                                     class_name: 'Sal3BatchRequestBcs',
+                                     dependent: :destroy,
+                                     inverse_of: false
 
   before_validation :checkbox_zeros_to_nil
   after_create :set_num_bcs

app/models/sal3_batch_request_bcs.rb → app/models/sal3_batch_requests_bc.rb

@@ -1,7 +1,7 @@
 ###
 #  Class to connect to the UNI_UPDATES table in Symphony
 ###
-class Sal3BatchRequestBcs < ApplicationRecord
+class Sal3BatchRequestsBc < ApplicationRecord
   self.table_name = 'sal3_batch_requests_bcs'
   self.primary_key = 'batch_id'
   belongs_to :sal3_batch_requests_batch, foreign_key: 'batch_id',
@@ -13,7 +13,7 @@ def self.create_sal3_request(array_of_item_ids, sal3_batch_request)
     array_of_item_ids.each do |item_id|
       hashes_for_updates << hash_for_update(item_id, sal3_batch_request)
     end
-    Sal3BatchRequestBcs.create(hashes_for_updates)
+    Sal3BatchRequestsBc.create(hashes_for_updates)
   end
 
   def self.hash_for_update(item_id, sal3_batch_request)
@@ -28,6 +28,6 @@ def self.hash_for_update(item_id, sal3_batch_request)
   end
 
   def self.barcodes(item_id)
-    Sal3BatchRequestBcs.joins(:sal3_batch_requests_batch).where(batch_id: item_id)
+    Sal3BatchRequestsBc.joins(:sal3_batch_requests_batch).where(batch_id: item_id)
   end
 end

app/views/batch_record_updates/index.html.erb

@@ -3,10 +3,9 @@
 <% end %>
 <div class="home-page-section">
   <h1>Batch Record Updates</h1>
-  <% if current_user %>
   <h3>What would you like to do? </h3>
   <div class="panel-group" id="accordion" role="tablist" aria-multiselectable="true">
-    <% if /[AY]/ === current_user.unicorn_updates %>
+    <% if current_user && /[AY]/ === current_user.unicorn_updates %>
      <div class="panel panel-default">
        <div class="panel-heading" role="tab" id="headingOne">
          <h4 class="panel-title">
@@ -61,7 +60,3 @@
 <div class="btn-group">
   <%= main_menu_button %>
 </div>
-<% else %>
-<p><%= link_to "Please login", root_path %></p>
-<% end %>
-</div>

app/views/edi_invoices/menu.html.erb

@@ -15,6 +15,8 @@
             <%= render partial: 'edi_updates_menu' %>
           </div>
         </div>
+      <% end %>
+      <% if can? :read, EdiInvoice %>
       <div class="panel panel-default">
         <div class="panel-heading" role="tab" id="headingThree">
           <h4 class="panel-title link">