1 # Redmine - project management software
2 # Copyright (C) 2006-2011 Jean-Philippe Lang
3 #
4 # This program is free software; you can redistribute it and/or
5 # modify it under the terms of the GNU General Public License
6 # as published by the Free Software Foundation; either version 2
7 # of the License, or (at your option) any later version.
8 #
9 # This program is distributed in the hope that it will be useful,
10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 # GNU General Public License for more details.
13 #
14 # You should have received a copy of the GNU General Public License
15 # along with this program; if not, write to the Free Software
16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
17
18 class Role < ActiveRecord::Base
19 # Built-in roles
20 BUILTIN_NON_MEMBER = 1
21 BUILTIN_ANONYMOUS = 2
22
23 ISSUES_VISIBILITY_OPTIONS = [
24 ['all', :label_issues_visibility_all],
25 ['default', :label_issues_visibility_public],
26 ['own', :label_issues_visibility_own]
27 ]
28
29 named_scope :sorted, {:order => 'builtin, position'}
30 named_scope :givable, { :conditions => "builtin = 0", :order => 'position' }
31 named_scope :builtin, lambda { |*args|
32 compare = 'not' if args.first == true
33 { :conditions => "#{compare} builtin = 0" }
34 }
35
36 before_destroy :check_deletable
37 has_many :workflows, :dependent => :delete_all do
38 def copy(source_role)
39 Workflow.copy(nil, source_role, nil, proxy_owner)
40 end
41 end
42
43 has_many :member_roles, :dependent => :destroy
44 has_many :members, :through => :member_roles
45 acts_as_list
46
47 serialize :permissions, Array
48 attr_protected :builtin
49
50 validates_presence_of :name
51 validates_uniqueness_of :name
52 validates_length_of :name, :maximum => 30
53 validates_inclusion_of :issues_visibility,
54 :in => ISSUES_VISIBILITY_OPTIONS.collect(&:first),
55 :if => lambda {|role| role.respond_to?(:issues_visibility)}
56
57 def permissions
58 read_attribute(:permissions) || []
59 end
60
61 def permissions=(perms)
62 perms = perms.collect {|p| p.to_sym unless p.blank? }.compact.uniq if perms
63 write_attribute(:permissions, perms)
64 end
65
66 def add_permission!(*perms)
67 self.permissions = [] unless permissions.is_a?(Array)
68
69 permissions_will_change!
70 perms.each do |p|
71 p = p.to_sym
72 permissions << p unless permissions.include?(p)
73 end
74 save!
75 end
76
77 def remove_permission!(*perms)
78 return unless permissions.is_a?(Array)
79 permissions_will_change!
80 perms.each { |p| permissions.delete(p.to_sym) }
81 save!
82 end
83
84 # Returns true if the role has the given permission
85 def has_permission?(perm)
86 !permissions.nil? && permissions.include?(perm.to_sym)
87 end
88
89 def <=>(role)
90 role ? position <=> role.position : -1
91 end
92
93 def to_s
94 name
95 end
96
97 def name
98 case builtin
99 when 1; l(:label_role_non_member, :default => read_attribute(:name))
100 when 2; l(:label_role_anonymous, :default => read_attribute(:name))
101 else; read_attribute(:name)
102 end
103 end
104
105 # Return true if the role is a builtin role
106 def builtin?
107 self.builtin != 0
108 end
109
110 # Return true if the role is a project member role
111 def member?
112 !self.builtin?
113 end
114
115 # Return true if role is allowed to do the specified action
116 # action can be:
117 # * a parameter-like Hash (eg. :controller => 'projects', :action => 'edit')
118 # * a permission Symbol (eg. :edit_project)
119 def allowed_to?(action)
120 if action.is_a? Hash
121 allowed_actions.include? "#{action[:controller]}/#{action[:action]}"
122 else
123 allowed_permissions.include? action
124 end
125 end
126
127 # Return all the permissions that can be given to the role
128 def setable_permissions
129 setable_permissions = Redmine::AccessControl.permissions - Redmine::AccessControl.public_permissions
130 setable_permissions -= Redmine::AccessControl.members_only_permissions if self.builtin == BUILTIN_NON_MEMBER
131 setable_permissions -= Redmine::AccessControl.loggedin_only_permissions if self.builtin == BUILTIN_ANONYMOUS
132 setable_permissions
133 end
134
135 # Find all the roles that can be given to a project member
136 def self.find_all_givable
137 find(:all, :conditions => {:builtin => 0}, :order => 'position')
138 end
139
140 # Return the builtin 'non member' role. If the role doesn't exist,
141 # it will be created on the fly.
142 def self.non_member
143 find_or_create_system_role(BUILTIN_NON_MEMBER, 'Non member')
144 end
145
146 # Return the builtin 'anonymous' role. If the role doesn't exist,
147 # it will be created on the fly.
148 def self.anonymous
149 find_or_create_system_role(BUILTIN_ANONYMOUS, 'Anonymous')
150 end
151
152 private
153
154 def allowed_permissions
155 @allowed_permissions ||= permissions + Redmine::AccessControl.public_permissions.collect {|p| p.name}
156 end
157
158 def allowed_actions
159 @actions_allowed ||= allowed_permissions.inject([]) { |actions, permission| actions += Redmine::AccessControl.allowed_actions(permission) }.flatten
160 end
161
162 def check_deletable
163 raise "Can't delete role" if members.any?
164 raise "Can't delete builtin role" if builtin?
165 end
166
167 def self.find_or_create_system_role(builtin, name)
168 role = first(:conditions => {:builtin => builtin})
169 if role.nil?
170 role = create(:name => name, :position => 0) do |r|
171 r.builtin = builtin
172 end
173 raise "Unable to create the #{name} role." if role.new_record?
174 end
175 role
176 end
177 end