Prior to this commit many of the policy methods were of the form:
```
def create?
edit?
end
```
The above works, but introduces a place for code drift.
We can shorten this to:
```
alias create? edit?
```
This helps keep the policy methods compact and scannable. All things
authorization policy related should create narrow surface areas. By
hand-crafting methods, it is easier for "slippage" to occur.
Another advantage of `alias` is it's use is reflected in API
documentation. With alias you need only write documentinig comments for
one method and the doc generators will relate the alias and the original
method.
If you "hand craft" a method using explicit delegation, the API
documentation won't pick up that two methods are aliases.
Further, I believe we should be moving towards parity between the
GET/POST/PUT methods that are related (e.g. the create/new pair and the
update/edit pair). This is not the case, as we "silently" suspend
folks. As we move through the [authorization work][1], we will start
hiding the links/buttons when a user can't take the action.
Related to #16483 and #16523
[1]:https://github.com/orgs/forem/projects/46
* Removes code behind new_admin_members feature flag
* Removes components/admin/users/tools/* and the tools components
* Removes unused /admin/users/tools/* controllers, comments, and routes
* Removes New Member View-related E2E and RSpec specs
* Remove admin_users_tools.rb frin spec/support/shared_examples/
* Removes remaining component-related specs
* Removes the view_component gem and test helper
* Resolve merge conflicts in Admin::UsersController
* Removes the view_component gem, as it is no longer used
* Removes view_component from Gemfile.lock
As written in the comments, we're looking at making the smallest change
to deliver on the feature. The other goal is to move from our
`user.admin?` paradigm towards leveraging Pundit policies.
If we need to move beyond Pundit, it will be easier once we've moved
all of our `user.something_something?` to policy questions. And please
note, I don't know if we'll move past pundit.
See [Authorization System: use case 1-1 project][1] for details on the
project.
Closes#16483
[1]:https://github.com/orgs/forem/projects/46/views/1
This is the least effort I can presently think of to allow for us to
reprocess user article's and handle the scenario in which the user may
have once had permission to the liquid tag but no longer.
This DI is not something I imagine using, but may highlight a better
approach for liquid tag permissions.
Related to #12146 and #16460
Observed the (beneficial) wayback machine was sending this user agent
string when making archive requests, but has been reporting 403's when
interacting with DEV recently.
Prior to this commit, the admin could delete the post but were blocked
by the "delete confirm". The blocker was because we scoped the finding
of an article to the current user.
With this commit, the admin should be able to confirm the deletion of an
article.
Closes#16461
* init
* .
* partials
* few extras
* revert indicators in favor of separate PR
* stuff
* .
* stuff
* whoops
* .
* .
* .
* .
* opacity
* partial
* cosmetics
* move actions to a partial
* whoopsy
* Added an @admin alias for the frontend and removed the @admin-controllers alias.
* Added modal support for admin user actions.
* Added modal support for more parts of the user admin.
* pills
* pills
* pills
* Added optional chaining for when the overview panel isn't loaded.
* styling updates
* fix
* modals
* pass size
* tags
* .
* balance modal
* comment
* fixes
* Improved modal trigger implementation.
* Removed default value for dataset.
* Moved prevent default to after modal trigger check so forms still submit.
* Update app/views/admin/users/widgets/_credits.html.erb
Co-authored-by: Julianna Tetreault <32834804+juliannatetreault@users.noreply.github.com>
* Update app/views/admin/users/reports/_index.html.erb
* Apply suggestions from code review
* Apply suggestions from code review
* Update app/views/admin/users/actions/_export.html.erb
* Update app/views/admin/users/widgets/_tag_moderation.html.erb
* Update app/views/admin/users/actions/_merge.html.erb
* Removed <AdminUserActionsModal /> component as it wasn't necessary.
* Fixed duplicate ID errors detected by Axe.
* Redirects to the Show page rather than the Edit page
* Adjusts quotations within _social_accounts.html.erb
* Ensures that Learn More links open in new tab
* updates with latests and greatest
* .
* fixes
* wip. Fixed some issues in the credits form.
* Changed Subtract to Remove for credits dropdown.
* Cleaned up the edits form.
* Wraps functionality in feature flag and calls #set_user_details
* Wraps /admin/users/show.html.erb in feature flag
* wip: Got credit params form working.
* empty select
* responsiveness
* empty commiit
* Updates redirects in spec and controller to show rather than edit
* Updates tag moderation copy in Admin Member Detail View
* Now the note is saved when changing credits.
* Fixed label for attributes as it was affecting writing tests and a11y.
* Removes unused index.js component
* Refactored credit params.
* chore: move method under private and update comment
* verified email responsiveness
* better opacity variables
* better org logo
* indicators
* refactor the credits method
Co-authored-by: Nick Taylor <nick@dev.to>
Co-authored-by: Nick Taylor <nick@iamdeveloper.com>
Co-authored-by: Julianna Tetreault <32834804+juliannatetreault@users.noreply.github.com>
Co-authored-by: Nick Taylor <nick@forem.com>
Co-authored-by: Ridhwana <ridhwana.khan16@gmail.com>
* Remove system test for editing draft posts
This behavior is checked in the cypress tests in
publishingFlows/publishOrSavePost.spec.js
* Copy original regression test back into cypress check
The system spec was checking that after attempting to save as draft,
when seeing an error, editing and saving as draft was permitted.
Replicate that behavior in the existing cypress test that checks invalid
markdown raises error, specifying that replacing the content and
saving succeeds (and stays in draft status).
* Show image-upload errors on /admin/advanced/tools
* Simplify error handling
This also makes the error message consistent with the rest of the admin
validation errors, so it's probably better even if it doesn't look as
flashy.
* Remove obsolete clearTimeout call
We aren't setting this timer anymore
* remove IE6 XHR support
IE7 and later support XMLHttpRequest natively, and most of the rest of
the code base uses fetch() which may not work in any version of IE
Drop the conditional here in the assumption that this would only be
the first of many problems for a user with an unsupported browser.
* figuring things out
* working both ways for issues PRs except disc and PRreview
* working on repo urls
* complete implementation and check specs
* resolve Travis failures
* resolving travis failures
* Fix VCR cassette
* fix regexs
Co-authored-by: Jamie Gaskins <jgaskins@hey.com>
