lib/seek/permissions/policy_based_authorization.rb
def lookup_for_action_and_user action,user_id,projects
          #Study's and Assays have to be treated differently, as they are linked to a project through the investigation'
          if (projects.nil? || (self == Study || self == Assay))
            sql = "select asset_id from #{lookup_table_name} where user_id = #{user_id} and can_#{action}=#{ActiveRecord::Base.connection.quoted_true}"
            ids = ActiveRecord::Base.connection.select_all(sql).collect{|k| k["asset_id"]}
          else
            project_map_table = ["#{self.name.underscore.pluralize}", 'projects'].sort.join('_')
            project_map_asset_id = "#{self.name.underscore}_id"
            project_clause = projects.collect{|p| "#{project_map_table}.project_id = #{p.id}"}.join(" or ")
            sql = "select asset_id,#{project_map_asset_id} from #{lookup_table_name}"
            sql << " inner join #{project_map_table}"
            sql << " on #{lookup_table_name}.asset_id = #{project_map_table}.#{project_map_asset_id}"
            sql << " where #{lookup_table_name}.user_id = #{user_id} and (#{project_clause})"
            sql << " and can_#{action}=#{ActiveRecord::Base.connection.quoted_true}"
            ids = ActiveRecord::Base.connection.select_all(sql).collect{|k| k["asset_id"]}
          end
          default_order.find_all_by_id(ids)
        end
#returns all the authorised items for a given action and optionally a user and set of projects. If user is nil, the items authorised for an
#anonymous user are returned. If one or more projects are provided, then only the assets linked to those projects are included.
# if filter_by_permissions is true, then as well as the authorization the state based permissions will also be applied
returns all the authorised items for a given action and optionally a user and set of projects. If user is nil, the items authorised for an
anonymous user are returned. If one or more projects are provided, then only the assets linked to those projects are included.
if filter_by_permissions is true, then as well as the authorization the state based permissions will also be applied
returns all the authorised items for a given action and optionally a user and set of projects . If user is nil the items authorised for an anonymous user are returned . If one or more projects are provided then only the assets linked to those projects are included . if filter_by_permissions is true then as well as the authorization the state based permissions will also be applied
def lookup_for_action_and_user action,user_id,projects
          if (projects.nil? || (self == Study || self == Assay))
            sql = "select asset_id from #{lookup_table_name} where user_id = #{user_id} and can_#{action}=#{ActiveRecord::Base.connection.quoted_true}"
            ids = ActiveRecord::Base.connection.select_all(sql).collect{|k| k["asset_id"]}
          else
            project_map_table = ["#{self.name.underscore.pluralize}", 'projects'].sort.join('_')
            project_map_asset_id = "#{self.name.underscore}_id"
            project_clause = projects.collect{|p| "#{project_map_table}.project_id = #{p.id}"}.join(" or ")
            sql = "select asset_id,#{project_map_asset_id} from #{lookup_table_name}"
            sql << " inner join #{project_map_table}"
            sql << " on #{lookup_table_name}.asset_id = #{project_map_table}.#{project_map_asset_id}"
            sql << " where #{lookup_table_name}.user_id = #{user_id} and (#{project_clause})"
            sql << " and can_#{action}=#{ActiveRecord::Base.connection.quoted_true}"
            ids = ActiveRecord::Base.connection.select_all(sql).collect{|k| k["asset_id"]}
          end
          default_order.find_all_by_id(ids)
        end
def lookup_for_action_and_user action , user_id , projects if ( projects . nil? || ( self == Study || self == Assay ) ) sql = "select asset_id from #{lookup_table_name} where user_id = #{user_id} and can_#{action}=#{ActiveRecord::Base.connection.quoted_true}" ids = ActiveRecord :: Base . connection . select_all ( sql ) . collect { | k | k [ "asset_id" ] } else project_map_table = [ "#{self.name.underscore.pluralize}" , 'projects' ] . sort . join ( '_' ) project_map_asset_id = "#{self.name.underscore}_id" project_clause = projects . collect { | p | "#{project_map_table}.project_id = #{p.id}" } . join ( " or " ) sql = "select asset_id,#{project_map_asset_id} from #{lookup_table_name}" sql << " inner join #{project_map_table}" sql << " on #{lookup_table_name}.asset_id = #{project_map_table}.#{project_map_asset_id}" sql << " where #{lookup_table_name}.user_id = #{user_id} and (#{project_clause})" sql << " and can_#{action}=#{ActiveRecord::Base.connection.quoted_true}" ids = ActiveRecord :: Base . connection . select_all ( sql ) . collect { | k | k [ "asset_id" ] } end default_order . find_all_by_id ( ids ) end
returns all the authorised items for a given action and optionally a user and set of projects.
returns all the authorised items for a given action and optionally a user and set of projects .
#Study's and Assays have to be treated differently, as they are linked to a project through the investigation'
action
user_id
projects