Improve reader UI (part 2) #10582
Open
Improve reader UI (part 2) #10582
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
…te view logic for delete button visibility
sampoder
reviewed
Jun 13, 2025
manuthecoder
force-pushed
the
improve-reader-ui-part-2
branch
from
df09aaa to
c711c96
Compare
There was a problem hiding this comment.
Look at #10776 for some similar / duplicate fixes that use more policy instead.
app/views/canonical_pending_transactions/_canonical_pending_transaction.html.erb
Outdated
Show resolved
Hide resolved
app/views/canonical_transactions/_canonical_transaction.html.erb
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
This should freeze cards instead of cancel and be in a separate PR please.
Comment on lines
+198
to
+203
| class: "btn bg-error mr1 right" if @invoice.open_v2? && organizer_signed_in?(as: :member) %> | ||
| <%= link_to (@invoice.archived? ? "Un-archive" : "Archive"), | ||
| (@invoice.archived? ? invoice_unarchive_path(@invoice) : invoice_archive_path(@invoice)), | ||
| disabled: !organizer_signed_in?, | ||
| method: :post, | ||
| class: "btn bg-muted" unless @invoice.void_v2? %> | ||
| class: "btn bg-muted" unless @invoice.void_v2? || !organizer_signed_in?(as: :member) %> |
There was a problem hiding this comment.
Can we make policies for these please?
| class OrganizerPositionPolicy < ApplicationPolicy | ||
| def destroy? | ||
| admin_or_contract_signee? | ||
| admin_or_contract_signee? || record.user == user |
There was a problem hiding this comment.
This should probably be in a separate PR since it's not strictly UI related.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This pull request introduces changes to enhance authorization checks and ensure proper role-based access control across policies and views. The updates primarily focus on restricting actions to users with the appropriate roles, such as organizers with at least the
:memberrole, and improving the handling of deletions.Authorization Enhancements:
OrganizerPositionPolicyto allow record owners to destroy positions in addition to admins or contract signees. (app/policies/organizer_position_policy.rb, app/policies/organizer_position_policy.rbL5-R5)ReceiptPolicyto use role-based checks (OrganizerPosition.role_at_least?) for destruction permissions instead of relying on event user inclusion. (app/policies/receipt_policy.rb, app/policies/receipt_policy.rbL6-R6)Role-Based View Access:
organizer_signed_in?(as: :member)) for rendering "Add tag" buttons, links, and modals across multiple views, includingcanonical_pending_transactions,canonical_transactions,employees, andeventsviews. [1] [2] [3] [4] [5] [6] [7]hcb_codes/_invoice.html.erbis restricted to organizers with at least the:memberrole.Improved Deletion Handling:
receipts/_receipt.html.erbto checkpolicy(receipt).destroy?before rendering delete buttons, ensuring only authorized users can delete receipts. [1] [2]