From 995f937eef6ca9d5da4236412cc085f5b163944a Mon Sep 17 00:00:00 2001
From: Jeffrey Hardy <jeff@37signals.com>
Date: Tue, 17 Sep 2024 15:10:18 -0400
Subject: [PATCH] Stub project access control for users

---
 app/controllers/concerns/project_scoped.rb   | 12 ++++++++++
 app/controllers/projects/users_controller.rb | 24 ++++++++++++++++++++
 app/models/user.rb                           |  1 +
 app/views/projects/users/index.html.erb      |  7 ++++++
 config/routes.rb                             |  4 +++-
 5 files changed, 47 insertions(+), 1 deletion(-)
 create mode 100644 app/controllers/concerns/project_scoped.rb
 create mode 100644 app/controllers/projects/users_controller.rb
 create mode 100644 app/views/projects/users/index.html.erb

diff --git a/app/controllers/concerns/project_scoped.rb b/app/controllers/concerns/project_scoped.rb
new file mode 100644
index 000000000..fefceecec
--- /dev/null
+++ b/app/controllers/concerns/project_scoped.rb
@@ -0,0 +1,12 @@
+module ProjectScoped
+  extend ActiveSupport::Concern
+
+  included do
+    before_action :set_project
+  end
+
+  private
+    def set_project
+      @project = Current.user.projects.find(params[:project_id])
+    end
+end
diff --git a/app/controllers/projects/users_controller.rb b/app/controllers/projects/users_controller.rb
new file mode 100644
index 000000000..1eff78578
--- /dev/null
+++ b/app/controllers/projects/users_controller.rb
@@ -0,0 +1,24 @@
+class Projects::UsersController < ApplicationController
+  include ProjectScoped
+
+  before_action :set_user, except: %i[ index ]
+
+  def index
+    @users = @project.users
+  end
+
+  def create
+    @project.accesses.create_or_find_by!(user: @user)
+    redirect_to project_users_url(@project)
+  end
+
+  def destroy
+    @project.accesses.destroy_by(user: @user)
+    redirect_to project_users_url(@project)
+  end
+
+  private
+    def set_user
+      @user = Current.account.users.find(params[:id])
+    end
+end
diff --git a/app/models/user.rb b/app/models/user.rb
index 36ce5cb71..bb9126890 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -9,6 +9,7 @@ class User < ApplicationRecord
 
   has_many :accesses, dependent: :destroy
   has_many :projects, through: :accesses
+  has_many :bubbles, through: :projects
 
   normalizes :email_address, with: ->(value) { value.strip.downcase }
 
diff --git a/app/views/projects/users/index.html.erb b/app/views/projects/users/index.html.erb
new file mode 100644
index 000000000..60e0ac8eb
--- /dev/null
+++ b/app/views/projects/users/index.html.erb
@@ -0,0 +1,7 @@
+<h1>Users on <%= @project.name %></h1>
+
+<ul>
+  <% @users.each do |user| %>
+    <li><%= user.name %> <%= link_to "X", project_user_path(@project, user), data: { turbo_method: :delete } %></li>
+  <% end %>
+</ul>
diff --git a/config/routes.rb b/config/routes.rb
index 54b203fcd..747f37e1f 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -3,7 +3,9 @@ Rails.application.routes.draw do
 
   resource :session
 
-  resources :projects
+  resources :projects do
+    resources :users, controller: "projects/users"
+  end
 
   resources :bubbles do
     resource :image, controller: "bubbles/images"