Refactor for authorization sanity

app/controllers/suppliers/application_controller.rb

@@ -2,23 +2,26 @@ module Suppliers
   class ApplicationController < ::ApplicationController
     before_action :setup_employee_and_supplier!
     load_and_authorize_resource
-    attr_reader :current_supplier, :employee_settings
-    helper_method :current_supplier, :employee_settings
+    attr_reader :current_supplier
+    helper_method :current_supplier
     layout 'supplier/app'
 
     rescue_from 'RestClient::Conflict' do |e|
       #binding.pry
     end
     rescue_from CanCan::AccessDenied do |exception|
-      render json: {}, status: :forbidden
+      respond_to do |format|
+        format.html { redirect_to root_path, alert: 'Action forbidden'}
+        format.json { render json: {}, status: :forbidden }
+      end
     end
 
     def setup_employee_and_supplier!
       authenticate_employee!
       find_current_supplier!
       return unless current_supplier.present?
-      @employee_settings = current_supplier.employee_settings.for_employee( current_employee )
-      @current_ability = ::Ability.new(@employee_settings)
+      current_employee.enrich_with_settings current_supplier.settings_for(current_employee)
+      @current_ability = ::Ability.new( current_employee )
     end
 
 

app/controllers/suppliers/lists_controller.rb

@@ -142,6 +142,19 @@ module Suppliers
         format.json { head :no_content }
       end
     end
+    # POST /supplier/lists/1/close
+    def close
+      @list = List.find_by_supplier_id_and_id(current_supplier.id, params[:id])
+      @list.close!
+      head :ok
+    end
+
+    # POST /supplier/lists/1/mark_helped
+    def mark_helped
+      @list = List.find_by_supplier_id_and_id(current_supplier.id, params[:id])
+      @list.mark_helped!
+      head :ok
+    end
 
     private
 

app/controllers/suppliers/orders_controller.rb

@@ -27,5 +27,19 @@ module Suppliers
         format.json { render json: @order }
       end
     end
+    # POST /orders/1/mark_in_process
+    def mark_in_process
+      @order = Order.find_by_supplier_id_and_id!(current_supplier.id, params[:id])
+      @order.is_being_processed!
+      head :ok
+    end
+
+    # POST /orders/1/is_delivered
+    def mark_delivered
+      @order = Order.find_by_supplier_id_and_id(current_supplier.id, params[:id])
+      @order.is_delivered!
+      render nothing: true
+    end
+
   end
 end