Class: HrLite::Role

Inherits:
ApplicationRecord show all
Includes:
Audited
Defined in:
app/models/hr_lite/role.rb

Overview

A named bundle of grants. Roles are DATA — the seeded six are a starting point an install is expected to edit, not a fixed ladder in code.

Constant Summary collapse

EMPLOYEE =

Seeded by name. Employee in particular is load-bearing: it is what a new hire is given so that self-service works on day one.

"Employee".freeze
MANAGER = 
"Manager".freeze
HR = 
"HR".freeze
FINANCE = 
"Finance".freeze
LEADERSHIP = 
"Leadership".freeze
SUPER_ADMIN = 
"Super Admin".freeze

Constants included from Audited

Audited::REDACTED, Audited::SKIPPED_ATTRIBUTES

Instance Method Summary collapse

Instance Method Details

#grant_map ⇒ Object

Every key this role grants, mapped to its scope. The shape the access resolver merges.



27
28
29
 
# File 'app/models/hr_lite/role.rb', line 27

def grant_map
  role_grants.to_h { |grant| [ grant.permission_key, grant.scope ] }
end

#replace_grants!(grants) ⇒ Object

Replaces the whole grant set in one transaction — the roles screen posts the complete picture, so a permission absent from the form is a permission being taken away, not one left alone.



34
35
36
37
38
39
40
41
42
43
44
 
# File 'app/models/hr_lite/role.rb', line 34

def replace_grants!(grants)
  transaction do
    role_grants.destroy_all
    grants.each do |key, scope|
      next if scope.blank? || scope.to_s == "none"

      role_grants.create!(permission_key: Permissions.validate!(key), scope: scope.to_s)
    end
  end
  reload
end

#system? ⇒ Boolean

Returns:

  • (Boolean) 


46
 
# File 'app/models/hr_lite/role.rb', line 46

def system? = self[:system]