diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb index d333cb4e..909b9481 100644 --- a/app/controllers/users_controller.rb +++ b/app/controllers/users_controller.rb @@ -3,8 +3,8 @@ class UsersController < ApplicationController after_action :verify_authorized def index - @users = User.all - authorize User + @users = policy_scope User.all + authorize @users end def show diff --git a/app/policies/user_policy.rb b/app/policies/user_policy.rb index 7223dace..a5c9d263 100644 --- a/app/policies/user_policy.rb +++ b/app/policies/user_policy.rb @@ -6,12 +6,31 @@ class UserPolicy @user = model end + class Scope + def initialize(user, scope) + @user = user + @scope = scope + end + + def resolve + if user.admin? + scope.all + else + scope.where(role: User.roles[:admin]) + end + end + + private + + attr_reader :user, :scope + end + def index? - @current_user.admin? + @current_user.admin? || true end def show? - @current_user.admin? || @current_user == @user + @current_user.admin? || @current_user == @user || @user.admin? end def update? diff --git a/app/views/layouts/_navigation_links.html.erb b/app/views/layouts/_navigation_links.html.erb index 1a277126..90e2af71 100644 --- a/app/views/layouts/_navigation_links.html.erb +++ b/app/views/layouts/_navigation_links.html.erb @@ -2,6 +2,7 @@