refactor: Renames user roles, improves security

commit 1daa943
Author: Peter Kos <[email protected]>
Date:   Sun Sep 20 02:57:01 2020 -0400

    Organizers have same overview page access as direc

commit cdf57b6
Author: Peter Kos <[email protected]>
Date:   Sun Sep 20 02:56:41 2020 -0400

    Volunteers are redirected to checkin route

commit 3f2a30c
Merge: b5ad3b8 d87269d
Author: Chris Baudouin, Jr <[email protected]>
Date:   Sun Sep 20 00:30:03 2020 -0400

    Merge branch '2.0' into hm-242

commit b5ad3b8
Author: Jeremy Rudman <[email protected]>
Date:   Sat Sep 19 21:03:08 2020 -0400

    fix(sidebar): fixed UI problems for diffrent roles

    removed the duplicate checkin button for orginizers and had checkin page defaut to be highlighted for volenteers

commit 057e3aa
Merge: 971dd0a 69e8d6e
Author: Chris Baudouin, Jr <[email protected]>
Date:   Mon Sep 14 16:43:59 2020 -0400

    Merge branch '2.0' into hm-242

commit 971dd0a
Author: Chris Baudouin, Jr <[email protected]>
Date:   Mon Sep 14 16:37:18 2020 -0400

    refactor: Increases funciton clarity

commit 711aeea
Author: Chris Baudouin, Jr <[email protected]>
Date:   Mon Sep 14 16:35:56 2020 -0400

    refactor: Increases funciton clarity

commit 19f1926
Author: Chris Baudouin, Jr <[email protected]>
Date:   Sat Sep 12 00:46:52 2020 -0400

    fix: Hound issues v1

commit c3d44f0
Merge: 2ab8865 a767446
Author: Chris Baudouin, Jr <[email protected]>
Date:   Sat Sep 12 00:32:30 2020 -0400

    Merge branch '2.0' into hm-242

commit 2ab8865
Author: Chris Baudouin, Jr <[email protected]>
Date:   Sat Sep 12 00:29:43 2020 -0400

    refactor: Cleans tests, improves coverage

commit 59d54ed
Merge: 274787f cb16869
Author: Chris Baudouin, Jr <[email protected]>
Date:   Mon Sep 7 00:11:19 2020 -0400

    Merge branch '2.0' into hm-242

commit 274787f
Author: Chris Baudouin, Jr <[email protected]>
Date:   Sun Sep 6 23:59:27 2020 -0400

    refactor: Renames event_tracking to Volunteer

commit 873e43c
Author: Chris Baudouin, Jr <[email protected]>
Date:   Sun Sep 6 23:48:29 2020 -0400

    refactor: Renames admin_limited_access to Organizer

commit f592750
Author: Chris Baudouin, Jr <[email protected]>
Date:   Sun Sep 6 19:38:54 2020 -0400

    refactor: Changes admin to director

Author: peterkos

app/assets/javascripts/manage/lib/setupDataTables.js

@@ -36,7 +36,7 @@ var setupDataTables = function () {
     ],
   });
 
-  $('.datatable.admins').DataTable({
+  $('.datatable.staff').DataTable({
     order: [2, 'asc'],
     columns: [
       { orderable: true, data: 'id', visible: false },

app/controllers/manage/application_controller.rb

@@ -1,27 +1,30 @@
 class Manage::ApplicationController < ApplicationController
   before_action :logged_in
-  before_action :require_admin_or_limited_admin
-  before_action :limit_write_access_to_admins, only: ["edit", "update", "new", "create", "destroy", "deliver", "merge", "perform_merge", "toggle_bus_captain", "duplicate", "update_acc_status", "send_update_email", "live_preview"]
+  before_action :require_director_or_organizer_or_volunteer
+  before_action :limit_write_access_to_directors, only: ["edit", "update", "new", "create", "destroy", "deliver", "merge", "perform_merge", "toggle_bus_captain", "duplicate", "update_acc_status", "send_update_email", "live_preview"]
   skip_before_action :verify_authenticity_token, if: :json_request?
 
   def logged_in
     authenticate_user!
   end
 
-  def require_full_admin
-    return redirect_to root_path unless current_user.try(:admin?)
+  def require_director
+    return redirect_to manage_checkins_path if current_user.volunteer?
+    return redirect_to manage_root_path if current_user.organizer?
+    return redirect_to root_path unless current_user.try(:director?)
   end
 
-  def require_admin_or_limited_admin
-    return redirect_to root_path unless current_user.try(:admin?) || current_user.try(:admin_limited_access?)
+  def require_director_or_organizer
+    return redirect_to manage_checkins_path if current_user.volunteer?
+    return redirect_to root_path unless current_user.organizing_staff?
   end
 
-  def require_admin_or_limited_admin_or_event_tracking
-    redirect_to root_path unless current_user.try(:admin?) || current_user.try(:admin_limited_access?) || current_user.try(:event_tracking?)
+  def require_director_or_organizer_or_volunteer
+    redirect_to root_path unless current_user.staff?
   end
 
-  def limit_write_access_to_admins
-    redirect_to url_for(controller: controller_name, action: :index) unless current_user.try(:admin?)
+  def limit_write_access_to_directors
+    redirect_to url_for(controller: controller_name, action: :index) unless current_user.try(:director?)
   end
 
   def json_request?

app/controllers/manage/configs_controller.rb

@@ -1,5 +1,5 @@
 class Manage::ConfigsController < Manage::ApplicationController
-  before_action :limit_access_admin
+  before_action :require_director
   before_action :get_config, only: [:edit, :update, :update_only_css_variables]
 
   respond_to :html, :json
@@ -69,7 +69,4 @@ def get_config
     end
   end
 
-  def limit_access_admin
-    redirect_to root_path unless current_user.admin?
-  end
 end

app/controllers/manage/dashboard_controller.rb

@@ -1,6 +1,5 @@
 class Manage::DashboardController < Manage::ApplicationController
-  skip_before_action :require_admin_or_limited_admin
-  before_action :require_admin_or_limited_admin
+  before_action :require_director_or_organizer
 
   def index
   end

app/controllers/manage/data_exports_controller.rb

@@ -1,6 +1,5 @@
 class Manage::DataExportsController < Manage::ApplicationController
-  skip_before_action :require_admin_or_limited_admin
-  before_action :require_full_admin
+  before_action :require_director
 
   before_action :set_data_export, only: [:destroy]
 

app/controllers/manage/messages_controller.rb

@@ -1,7 +1,8 @@
 class Manage::MessagesController < Manage::ApplicationController
+  before_action :require_director_or_organizer
   before_action :set_message, only: [:show, :edit, :update, :destroy, :deliver, :preview, :duplicate]
   before_action :check_message_access, only: [:edit, :update, :destroy]
-  before_action :limit_template_access_to_admins, only: [:template, :template_preview, :template_update, :template_replace_with_default]
+  before_action :limit_template_access_to_directors, only: [:template, :template_preview, :template_update, :template_replace_with_default]
 
   respond_to :html, :json
 
@@ -106,9 +107,9 @@ def template_replace_with_default
 
   private
 
-  def limit_template_access_to_admins
+  def limit_template_access_to_directors
     # From Manage::ApplicationController
-    limit_write_access_to_admins
+    limit_write_access_to_directors
   end
 
   def message_params

app/controllers/manage/stats_controller.rb

@@ -1,4 +1,5 @@
 class Manage::StatsController < Manage::ApplicationController
+  before_action :require_director_or_organizer
 
   respond_to :html, :json
 

app/controllers/manage/trackable_events_controller.rb

@@ -1,9 +1,6 @@
 class Manage::TrackableEventsController < Manage::ApplicationController
-  skip_before_action :require_admin_or_limited_admin
-  before_action :require_admin_or_limited_admin_or_event_tracking
-
   before_action :set_trackable_event, only: [:show, :edit, :update, :destroy]
-  before_action :scope_limited_admin_access, only: [:edit, :update, :destroy]
+  before_action :scope_organizer_access, only: [:edit, :update, :destroy]
 
   respond_to :html, :json
 
@@ -81,13 +78,13 @@ def trackable_event_params
     params.require(:trackable_event).permit(:band_id, :trackable_tag_id)
   end
 
-  # Permit limited-access admins (overrides Manage::ApplicationController#limit_write_access_to_admins)
-  def limit_write_access_to_admins
+  # Permit limited-access directors (overrides Manage::ApplicationController#limit_write_access_to_directors)
+  def limit_write_access_to_directors
   end
 
-  # If the user isn't a full admin, scope changes only to those they created
-  def scope_limited_admin_access
-    return if current_user.admin? || @trackable_event.blank? || @trackable_event.user.blank?
+  # If the user isn't a director, scope changes only to those they created
+  def scope_organizer_access
+    return if current_user.director? || @trackable_event.blank? || @trackable_event.user.blank?
     redirect_to manage_trackable_events_path, notice: 'You may not view events you did not create.' if @trackable_event.user != current_user
   end
 end

app/controllers/manage/trackable_tags_controller.rb

@@ -1,7 +1,4 @@
 class Manage::TrackableTagsController < Manage::ApplicationController
-  skip_before_action :require_admin_or_limited_admin
-  before_action :require_admin_or_limited_admin_or_event_tracking
-
   before_action :set_trackable_tag, only: [:show, :edit, :update, :destroy]
 
   respond_to :html, :json

app/controllers/manage/users_controller.rb

@@ -1,19 +1,19 @@
 class Manage::UsersController < Manage::ApplicationController
-  before_action :require_full_admin
+  before_action :require_director
   before_action :find_user, only: [:show, :edit, :update, :destroy]
 
   respond_to :html, :json
 
   def index
-    respond_with(:manage, User.where(role: [:admin, :admin_limited_access, :event_tracking]))
+    respond_with(:manage, User.where(role: [:director, :organizer, :volunteer]))
   end
 
   def user_datatable
     render json: UserDatatable.new(params, view_context: view_context)
   end
 
-  def admin_datatable
-    render json: AdminDatatable.new(params, view_context: view_context)
+  def staff_datatable
+    render json: StaffDatatable.new(params, view_context: view_context)
   end
 
   def show