diff --git a/app/assets/templates/admin/calendar/calendar.html.erb b/app/assets/templates/admin/calendar/calendar.html.erb index 6c7de429a..efe0832cc 100644 --- a/app/assets/templates/admin/calendar/calendar.html.erb +++ b/app/assets/templates/admin/calendar/calendar.html.erb @@ -45,7 +45,7 @@
-
+
- @@ -64,7 +64,7 @@ {{ showMachines(training) }} {{ training.nb_total_places }} -
+
diff --git a/app/assets/templates/shared/header.html.erb b/app/assets/templates/shared/header.html.erb index 9c9f27c36..a06cb1ea8 100644 --- a/app/assets/templates/shared/header.html.erb +++ b/app/assets/templates/shared/header.html.erb @@ -40,8 +40,8 @@
  • {{ 'app.public.common.my_events' }}
  • {{ 'app.public.common.my_invoices' }}
  • {{ 'app.public.common.my_wallet' }}
  • -
  • -
  • {{ 'app.public.common.help' }}
  • +
  • +
  • {{ 'app.public.common.help' }}
  • {{ 'app.public.common.sign_out' | translate }}
  • diff --git a/app/controllers/api/trainings_controller.rb b/app/controllers/api/trainings_controller.rb index e7ef567f9..c0ba04b19 100644 --- a/app/controllers/api/trainings_controller.rb +++ b/app/controllers/api/trainings_controller.rb @@ -41,7 +41,8 @@ class API::TrainingsController < API::ApiController end head :no_content - elsif @training.update(training_params) + elsif current_user.admin? && @training.update(training_params) + # only admins can fully update a training, not managers render :show, status: :ok, location: @training else render json: @training.errors, status: :unprocessable_entity diff --git a/app/policies/training_policy.rb b/app/policies/training_policy.rb index d41cb5ff1..585f1d7b5 100644 --- a/app/policies/training_policy.rb +++ b/app/policies/training_policy.rb @@ -1,3 +1,6 @@ +# frozen_string_literal: true + +# Check the access policies for API::TrainingsController class TrainingPolicy < ApplicationPolicy class Scope < Scope def resolve @@ -5,17 +8,19 @@ class TrainingPolicy < ApplicationPolicy end end - %w(create update).each do |action| - define_method "#{action}?" do - user.admin? - end + def create + user.admin? + end + + def update? + user.admin? || user.manager? end def destroy? - user.admin? and record.destroyable? + user.admin? && record.destroyable? end def availabilities? - user.admin? + user.admin? || user.manager? end end