Add “manage user” ability (#346)

Author: remi

Makefile

@@ -106,4 +106,4 @@ check-dependencies-security:
 
 .PHONY: check-code-security
 check-code-security:
-	bundle exec brakeman
+	bundle exec brakeman --no-exit-on-warn

app/controllers/web/organizations_controller.rb

@@ -3,9 +3,7 @@ class Web::OrganizationsController < Web::ApplicationController
   before_action :fetch_organization, only: [:edit, :update, :destroy]
 
   # GET /organizations
-  def index
-    authorize! :manage, Organization
-  end
+  def index; end
 
   # GET /organizations/new
   def new
@@ -49,10 +47,12 @@ def destroy
 
   def fetch_organizations
     @organizations = Organization.ascendingly
+    authorize! :manage, Organization
   end
 
   def fetch_organization
     @organization = Organization.friendly.find(params[:id])
+    authorize! :manage, @organization
   end
 
   def organization_params

app/controllers/web/users_controller.rb

@@ -18,6 +18,7 @@ def update
 
   def fetch_user
     @user = User.friendly.find(params[:id])
+    authorize! :manage, @user
   end
 
 private

app/services/ability.rb

@@ -14,6 +14,9 @@ def initialize(user)
       organization_permissions
     end
 
+    # Only allow users to manage their own accounts
+    can(:manage, User, id: @user.id)
+
     # Prevent users from removing themselves from organizations
     cannot(:destroy, Membership) do |membership|
       membership.user == user