policy updates

Author: jaspermayone

app/controllers/admin/users_controller.rb

@@ -31,15 +31,23 @@ def index
     def show
       authorize @user
 
-      @enrollments_by_term = @user.enrollments
-                                  .includes({ course: [ :faculties, :term, meeting_times: { rooms: :building } ] })
-                                  .joins(course: :term)
-                                  .order("terms.year DESC, terms.season DESC")
-                                  .group_by { |e| e.course.term }
-
-      @oauth_credentials = @user.oauth_credentials
-                                .includes(:google_calendar)
-                                .order(created_at: :desc)
+      @enrollments_by_term = if policy(@user).view_enrollments?
+                               @user.enrollments
+                                    .includes({ course: [ :faculties, :term, meeting_times: { rooms: :building } ] })
+                                    .joins(course: :term)
+                                    .order("terms.year DESC, terms.season DESC")
+                                    .group_by { |e| e.course.term }
+                             else
+                               {}
+                             end
+
+      @oauth_credentials = if policy(@user).view_oauth_credentials?
+                             @user.oauth_credentials
+                                  .includes(:google_calendar)
+                                  .order(created_at: :desc)
+                           else
+                             []
+                           end
 
       @friends = @user.friends.to_a
       @incoming_requests = @user.incoming_friend_requests.includes(:requester).to_a

app/policies/enrollment_policy.rb

@@ -1,15 +1,15 @@
 # frozen_string_literal: true
 
 class EnrollmentPolicy < ApplicationPolicy
-  def index?   = admin?
-  def show?    = owner_of_record? || admin?
+  def index?   = super_admin?
+  def show?    = owner_of_record? || super_admin?
   def create?  = owner_of_record? || super_admin?
   def update?  = owner_of_record? || super_admin?
   def destroy? = owner_of_record? || can_perform_destructive_action?
 
   class Scope < ApplicationPolicy::Scope
     def resolve
-      user&.admin_access? ? scope.all : scope.where(user_id: user&.id)
+      (user&.super_admin? || user&.owner?) ? scope.all : scope.where(user_id: user&.id)
     end
   end
 end

app/policies/user_policy.rb

@@ -13,7 +13,7 @@ def force_calendar_sync?       = super_admin?
   def manage_friendships?        = super_admin?
 
   def view_user_details?         = show?
-  def view_oauth_credentials?    = admin?
+  def view_oauth_credentials?    = super_admin?
   def manage_oauth_credentials?  = super_admin?
   def view_enrollments?          = super_admin?
   def view_calendar_sync_info?   = admin?