Use cancancan to authorize user_preference_controller

[rails.git] / app / models / ability.rb

diff --git a/app/models/ability.rb b/app/models/ability.rb
index 897316691328fc8d673ace7001cbda2f73aa3473..6a61eeff30b75e16690133fddfad0de51e364866 100644 (file)
--- a/app/models/ability.rb
+++ b/app/models/ability.rb
@@ -7,8 +7,19 @@ class Ability
     can :index, :site
     can [:permalink, :edit, :help, :fixthemap, :offline, :export, :about, :preview, :copyright, :key, :id, :welcome], :site
 
+    can [:list, :rss, :view, :comments], DiaryEntry
+
     if user
       can :weclome, :site
+
+      can [:create, :edit, :comment, :subscribe, :unsubscribe], DiaryEntry
+
+      can [:read, :read_one], UserPreference if has_capability?(token, :allow_read_prefs)
+      can [:update, :update_one, :delete_one], UserPreference if has_capability?(token, :allow_write_prefs)
+
+      if user.administrator?
+        can [:hide, :hidecomment], [DiaryEntry, DiaryComment]
+      end
     end
     # Define abilities for the passed in user here. For example:
     #