FMFR-1306 - Refactor ability so roles match better

app/models/ability.rb

@@ -4,20 +4,21 @@ class Ability
  def initialize(user)
  user ||= User.new # guest user (not logged in)
  cannot :manage, :all
- if user.has_role? :ccs_admin
- can :manage, :all
- else
- admin_tool_specific_auth(user)
- service_specific_auth(user)
- fm_supplier_specific_auth(user)
- allow_list_specific_auth(user)
+
+ if user.has_role?(:fm_access)
+ service_buyer_specific_auth(user)
+ service_supplier_specific_auth(user)
+ service_admin_specific_auth(user)
  end
+
+ allow_list_specific_auth(user)
+ super_admin_specific_auth(user)
  end
 
  private
 
- def service_specific_auth(user)
- return unless user.has_role?(:buyer) && user.has_role?(:fm_access)
+ def service_buyer_specific_auth(user)
+ return unless user.has_role?(:buyer)
 
  can :read, FacilitiesManagement
  can :manage, FacilitiesManagement::RM3830::Procurement, user_id: user.id
@@ -26,24 +27,26 @@ def service_specific_auth(user)
  can :manage, FacilitiesManagement::Building, user_id: user.id
  end
 
- def admin_tool_specific_auth(user)
- return unless user.has_role?(:fm_access) && user.has_role?(:ccs_employee)
+ def service_supplier_specific_auth(user)
+ return unless user.has_role?(:supplier)
+
+ can :read, FacilitiesManagement::RM3830::SupplierDetail
+ can :manage, FacilitiesManagement::RM3830::ProcurementSupplier, supplier: user.supplier_detail
+ end
+
+ def service_admin_specific_auth(user)
+ return unless user.has_role?(:ccs_employee)
 
  can :read, :all
  can :manage, FacilitiesManagement::Admin
+ end
 
+ def super_admin_specific_auth(user)
  return unless user.has_role?(:ccs_developer)
 
  can :manage, FacilitiesManagement::Framework
  end
 
- def fm_supplier_specific_auth(user)
- return unless user.has_role?(:fm_access) && user.has_role?(:supplier)
-
- can :read, FacilitiesManagement::RM3830::SupplierDetail
- can :manage, FacilitiesManagement::RM3830::ProcurementSupplier, supplier: user.supplier_detail
- end
-
  def allow_list_specific_auth(user)
  return unless user.has_role?(:allow_list_access)