diff --git a/app/models/miq_product_feature.rb b/app/models/miq_product_feature.rb index 664467b65b6..6ca37597a81 100644 --- a/app/models/miq_product_feature.rb +++ b/app/models/miq_product_feature.rb @@ -1,8 +1,10 @@ class MiqProductFeature < ApplicationRecord - SUPER_ADMIN_FEATURE = "everything".freeze + SUPER_ADMIN_FEATURE = "everything".freeze REPORT_ADMIN_FEATURE = "miq_report_superadmin".freeze REQUEST_ADMIN_FEATURE = "miq_request_approval".freeze - TENANT_ADMIN_FEATURE = "rbac_tenant".freeze + MY_TASKS_FEATURE = "miq_task_my_ui".freeze + ALL_TASKS_FEATURE = "miq_task_all_ui".freeze + TENANT_ADMIN_FEATURE = "rbac_tenant".freeze acts_as_tree diff --git a/app/models/miq_user_role.rb b/app/models/miq_user_role.rb index 8b32942da41..d8e67c9a5b7 100644 --- a/app/models/miq_user_role.rb +++ b/app/models/miq_user_role.rb @@ -112,6 +112,10 @@ def tenant_admin_user? allows?(:identifier => MiqProductFeature::TENANT_ADMIN_FEATURE) end + def only_my_user_tasks? + !allows?(:identifier => MiqProductFeature::ALL_TASKS_FEATURE) && allows?(:identifier => MiqProductFeature::MY_TASKS_FEATURE) + end + def report_admin_user? allows?(:identifier => MiqProductFeature::REPORT_ADMIN_FEATURE) end diff --git a/app/models/user.rb b/app/models/user.rb index f7835468e36..9bbb6cfd5da 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -34,7 +34,7 @@ class User < ApplicationRecord delegate :miq_user_role, :current_tenant, :get_filters, :has_filters?, :get_managed_filters, :get_belongsto_filters, :to => :current_group, :allow_nil => true - delegate :super_admin_user?, :request_admin_user?, :self_service?, :limited_self_service?, :report_admin_user?, + delegate :super_admin_user?, :request_admin_user?, :self_service?, :limited_self_service?, :report_admin_user?, :only_my_user_tasks?, :to => :miq_user_role, :allow_nil => true validates_presence_of :name, :userid diff --git a/spec/models/miq_user_role_spec.rb b/spec/models/miq_user_role_spec.rb index 5e735a9f8ad..5540f018b23 100644 --- a/spec/models/miq_user_role_spec.rb +++ b/spec/models/miq_user_role_spec.rb @@ -222,6 +222,8 @@ let(:tenant_admin_role) { FactoryBot.create(:miq_user_role, :features => MiqProductFeature::TENANT_ADMIN_FEATURE) } let(:report_admin_role) { FactoryBot.create(:miq_user_role, :features => MiqProductFeature::REPORT_ADMIN_FEATURE) } let(:request_admin_role) { FactoryBot.create(:miq_user_role, :features => MiqProductFeature::REQUEST_ADMIN_FEATURE) } + let(:report_only_my_tasks) { FactoryBot.create(:miq_user_role, :features => MiqProductFeature::MY_TASKS_FEATURE) } + let(:report_only_all_tasks) { FactoryBot.create(:miq_user_role, :features => MiqProductFeature::ALL_TASKS_FEATURE) } let(:regular_role) { FactoryBot.create(:miq_user_role) } describe "#super_admin_user?" do @@ -238,6 +240,20 @@ end end + describe "#only_my_user_tasks?" do + it "detects access limited to only the current users tasks" do + expect(report_only_my_tasks).to be_only_my_user_tasks + end + + it "detects access not limited to only the current users tasks" do + expect(report_only_all_tasks).not_to be_only_my_user_tasks + end + + it "detects no access to tasks" do + expect(regular_role).not_to be_only_my_user_tasks + end + end + describe "#report_admin_user?" do it "detects super admin" do expect(super_admin_role).to be_report_admin_user