fix: authorize show controls actions (#1848)

* fix: authorize show controls actions * simplify and rename can_see_the_actions_button? method
avo-hq · Jul 14, 2023 · fb45679 · fb45679
1 parent 9a58ac0
commit fb45679
Show file tree

Hide file tree

Showing 5 changed files with 10 additions and 8 deletions.
diff --git a/app/components/avo/resource_component.rb b/app/components/avo/resource_component.rb
@@ -37,9 +37,7 @@ def can_see_the_destroy_button?
     @resource.authorization.authorize_action(:destroy, raise_exception: false)
   end
 
-  def can_see_the_actions_button?
-    return false if @actions.blank?
-
+  def can_act_on?
     return authorize_association_for(:act_on) if @reflection.present?
 
     @resource.authorization.authorize_action(:act_on, raise_exception: false) && !has_reflection_and_is_read_only

diff --git a/app/components/avo/views/resource_edit_component.html.erb b/app/components/avo/views/resource_edit_component.html.erb
@@ -40,7 +40,7 @@
               <%= t('avo.delete').capitalize %>
             <% end %>
           <% end %>
-          <% if can_see_the_actions_button? %>
+          <% if can_act_on? %>
             <%= render Avo::ActionsComponent.new actions: @actions, resource: @resource, view: @view %>
           <% end %>
           <% if can_see_the_save_button? %>

diff --git a/app/components/avo/views/resource_index_component.html.erb b/app/components/avo/views/resource_index_component.html.erb
@@ -16,7 +16,7 @@
           <%= t('avo.attach_item', item: singular_resource_name).capitalize %>
         <% end %>
       <% end %>
-      <% if can_see_the_actions_button? %>
+      <% if can_act_on? %>
         <%= render Avo::ActionsComponent.new actions: @actions, resource: @resource, view: @view %>
       <% end %>
       <% if can_see_the_create_button? %>

diff --git a/app/components/avo/views/resource_show_component.html.erb b/app/components/avo/views/resource_show_component.html.erb
@@ -39,7 +39,7 @@
                 <%= control.label %>
               <% end %>
             <% end %>
-          <% elsif can_see_the_actions_button? && control.actions_list? %>
+          <% elsif can_act_on? && control.actions_list? %>
             <%= render Avo::ActionsComponent.new actions: @actions, resource: @resource, view: @view, exclude: control.exclude, include: control.include, style: control.style, color: control.color, label: control.label %>
           <% elsif control.edit_button? %>
             <% if @resource.authorization.authorize_action(:edit, raise_exception: false) %>
@@ -55,7 +55,7 @@
               <% end %>
             <% end %>
           <% elsif control.action? %>
-            <% if control.action.visible_in_view(parent_resource: @parent_resource) %>
+            <% if render_action_control?(control.action) %>
               <%= a_link control.path,
                   color: control.color,
                   style: control.style,
@@ -142,7 +142,7 @@
               <%= t('avo.delete').capitalize %>
             <% end %>
           <% end %>
-          <% if can_see_the_actions_button? %>
+          <% if can_act_on? %>
             <%= render Avo::ActionsComponent.new actions: @actions, resource: @resource, view: @view %>
           <% end %>
           <% if @resource.authorization.authorize_action(:edit, raise_exception: false) %>

diff --git a/app/components/avo/views/resource_show_component.rb b/app/components/avo/views/resource_show_component.rb
@@ -45,6 +45,10 @@ def edit_path
     helpers.edit_resource_path(model: @resource.model, resource: @resource, **args)
   end
 
+  def render_action_control?(action)
+    can_act_on? && action.visible_in_view(parent_resource: @parent_resource)
+  end
+
   private
 
   # In development and test environments we shoudl show the invalid field errors