Simplify some policies

Author: fbacall

app/policies/application_policy.rb

@@ -24,14 +24,10 @@ def index?
 
   def show?
     true
-    # scope.where(:id => record.id).exists?
   end
 
   def create?
-    # Only admin, scraper_user or curator roles can create
-    #@user.has_role?(:admin) or @user.has_role?(:scraper_user) or @user.has_role?(:curator)
-    # Any registered user user can create
-    @user && !@user.role.blank?
+    @user
   end
 
   def new?
@@ -52,19 +48,11 @@ def destroy?
 
   # "manage" isn't actually an action, but the "destroy?" and "update?" policies delegate to this method.
   def manage?
-    @user && @user.is_admin?
-  end
-
-  def request_is_api?(request)
-    return false if request.nil?
-    return ((request.post? or request.put? or request.patch?) and request.format.json?)
+    @user&.is_admin?
   end
 
   def curators_and_admin
-    @user && (
-      @user.has_role?(:curator) ||
-        @user.has_role?(:admin) ||
-        @user.has_role?(:scraper_user))
+    user_has_role?(:curator, :admin, :scraper_user)
   end
 
   def scope
@@ -84,4 +72,20 @@ def resolve
     end
   end
 
+  private
+
+  def request_is_api?
+    !!@request && ((@request.post? || @request.put? || @request.patch?) && @request.format.json?)
+  end
+
+  def scraper?
+    request_is_api? && @user&.has_role?(:scraper_user)
+  end
+
+  # Check if the user has any of the given roles.
+  def user_has_role?(*roles)
+    return false if @user.nil?
+    roles.any? { |r| @user.has_role?(r) }
+  end
+
 end

app/policies/learning_path_policy.rb

@@ -9,7 +9,7 @@ def update?
   end
 
   def manage?
-    curators_and_admin || @user&.has_role?(:learning_path_curator)
+    curators_and_admin || user_has_role?(:learning_path_curator)
   end
 
   def create?

app/policies/learning_path_topic_policy.rb

@@ -5,7 +5,7 @@ def update?
   end
 
   def manage?
-    curators_and_admin || @user&.has_role?(:learning_path_curator)
+    curators_and_admin || user_has_role?(:learning_path_curator)
   end
 
   def create?

app/policies/node_policy.rb

@@ -2,26 +2,11 @@ class NodePolicy < ApplicationPolicy
 
   def create?
     # Only admin, scraper_user, curator or node_curator roles can create
-    @user && (@user.has_role?(:admin) || @user.has_role?(:scraper_user) || @user.has_role?(:curator) || @user.has_role?(:node_curator))
+    user_has_role?(:admin, :curator, :node_curator) || scraper?
   end
 
   def manage?
-    return false unless @user
-    return true if @user.is_admin?
-
-    if request_is_api?(@request) #is this an API action - allow scraper_user roles only
-      if @user.has_role?(:scraper_user) #and @user.is_owner?(@record) # check ownership
-        return true
-      else
-        return false
-      end
-    end
-
-    if @user.has_role?(:curator) || @user.has_role?(:node_curator) || @user.is_owner?(@record)
-      return true
-    else
-      return false
-    end
+    user_has_role?(:admin, :curator, :node_curator) || scraper? || @user&.is_owner?(@record)
   end
 
 end

app/policies/resource_policy.rb

@@ -10,7 +10,7 @@ def create?
   end
 
   def manage?
-    super || (@user && (@user.is_owner?(@record) || (request_is_api?(@request) && @user.has_role?(:scraper_user))))
+    super || (@user&.is_owner?(@record) || scraper?)
   end
 
 end

app/policies/scraped_resource_policy.rb

@@ -3,7 +3,7 @@
 class ScrapedResourcePolicy < ResourcePolicy
 
   def manage?
-    super || (@user && @user.is_curator?) || is_content_provider_editor?
+    super || (@user&.is_curator?) || is_content_provider_editor?
   end
 
   private

app/policies/source_policy.rb

@@ -21,7 +21,7 @@ def create?
   end
 
   def approve?
-    @user && @user.has_role?(:admin)
+    user_has_role?(:admin)
   end
 
   def request_approval?

app/policies/space_policy.rb

@@ -1,7 +1,7 @@
 class SpacePolicy < ApplicationPolicy
 
   def create?
-    @user && @user.has_role?(:admin)
+    @user&.has_role?(:admin)
   end
 
   def edit?
@@ -13,7 +13,7 @@ def update?
   end
 
   def manage?
-    @user && @user.is_admin?
+    @user&.is_admin?
   end
 
 end

app/policies/user_policy.rb

@@ -12,13 +12,13 @@ def show?
 
   def create?
     # Do not allow creations via API and only admin role can create users
-    !request_is_api?(request) && @user && @user.is_admin?
+    !request_is_api? && @user&.is_admin?
   end
 
   def manage?
     # Do not allow updates via API
     # Only admin role can update other users or the users themselves
-    !request_is_api?(request) && (@user && (@user == @record || @user.is_admin?))
+    !request_is_api? && (@user && (@user == @record || @user.is_admin?))
   end
 
   def change_token?