Protect Routes

lib/atomic/accounts.ex

@@ -266,7 +266,9 @@ defmodule Atomic.Accounts do
   """
   def get_user_by_session_token(token) do
     {:ok, query} = UserToken.verify_session_token_query(token)
+
     Repo.one(query)
+    |> Repo.preload(:organizations)
   end
 
   @doc """
@@ -424,4 +426,11 @@ defmodule Atomic.Accounts do
     |> Course.changeset(attrs)
     |> Repo.insert()
   end
+
+  @doc """
+  Gets the user's organizations
+  """
+  def get_user_organizations(user) do
+    Repo.all(Ecto.assoc(user, :organizations))
+  end
 end

lib/atomic/accounts/user.ex

@@ -10,7 +10,7 @@ defmodule Atomic.Accounts.User do
   alias Atomic.Uploaders.ProfilePicture
 
   @required_fields ~w(email password role name)a
-  @optional_fields ~w(course_id)a
+  @optional_fields ~w(course_id default_organization_id)a
 
   @roles ~w(admin student)a
 
@@ -20,6 +20,7 @@ defmodule Atomic.Accounts.User do
     field :password, :string, virtual: true, redact: true
     field :hashed_password, :string, redact: true
     field :confirmed_at, :naive_datetime
+    belongs_to :default_organization, Organization
 
     belongs_to :course, Course
     field :profile_picture, ProfilePicture.Type

lib/atomic/activities.ex

@@ -22,6 +22,18 @@ defmodule Atomic.Activities do
     |> Repo.all()
   end
 
+  def list_activities_by_organization_id(organization_id, opts) do
+    activities =
+      Activity
+      |> apply_filters(opts)
+      |> join(:inner, [a], d in assoc(a, :departments))
+      |> where([a, d], d.organization_id == ^organization_id)
+      |> select([a, _d], a)
+      |> Repo.all()
+
+    activities
+  end
+
   @doc """
   Gets a single activity.
 
@@ -41,6 +53,14 @@ defmodule Atomic.Activities do
     |> Repo.preload(preloads)
   end
 
+  def get_activity_organizations!(activity, _preloads \\ []) do
+    departments = Map.get(activity, :departments, [])
+
+    organization_ids = Enum.map(departments, & &1.organization_id)
+
+    organization_ids
+  end
+
   alias Atomic.Activities.Enrollment
 
   def is_participating?(activity_id, user_id) do
@@ -389,6 +409,19 @@ defmodule Atomic.Activities do
     Repo.all(Speaker)
   end
 
+  @doc """
+  Returns the list of speakers belonging to an organization.
+
+  ## Examples
+
+      iex> list_speakers_by_organization_id(99d7c9e5-4212-4f59-a097-28aaa33c2621)
+      [%Speaker{}, ...]
+
+  """
+  def list_speakers_by_organization_id(id) do
+    Repo.all(from s in Speaker, where: s.organization_id == ^id)
+  end
+
   def get_speakers(nil), do: []
 
   def get_speakers(ids) do

lib/atomic/activities/speaker.ex

@@ -5,18 +5,25 @@ defmodule Atomic.Activities.Speaker do
   use Atomic.Schema
   alias Atomic.Activities.Activity
   alias Atomic.Activities.ActivitySpeaker
+  alias Atomic.Organizations.Organization
+
+  @required_fields ~w(name bio organization_id)a
 
   schema "speakers" do
     field :bio, :string
     field :name, :string
+
     many_to_many :activities, Activity, join_through: ActivitySpeaker, on_replace: :delete
+
+    belongs_to :organization, Organization, on_replace: :delete_if_exists
+
     timestamps()
   end
 
   @doc false
   def changeset(speaker, attrs) do
     speaker
-    |> cast(attrs, [:name, :bio])
-    |> validate_required([:name, :bio])
+    |> cast(attrs, @required_fields)
+    |> validate_required(@required_fields)
   end
 end

lib/atomic/departments.ex

@@ -21,6 +21,19 @@ defmodule Atomic.Departments do
     Repo.all(Department)
   end
 
+  @doc """
+  Returns the list of departments belonging to an organization.
+
+  ## Examples
+
+      iex> list_departments_by_organization_id(99d7c9e5-4212-4f59-a097-28aaa33c2621)
+      [%Department{}, ...]
+
+  """
+  def list_departments_by_organization_id(id) do
+    Repo.all(from d in Department, where: d.organization_id == ^id)
+  end
+
   def get_departments(nil), do: []
 
   def get_departments(ids) do

lib/atomic/organizations.ex

@@ -168,6 +168,13 @@ defmodule Atomic.Organizations do
     |> Repo.exists?()
   end
 
+  def get_role(user_id, organization_id) do
+    Membership
+    |> where([m], m.user_id == ^user_id and m.organization_id == ^organization_id)
+    |> Repo.one()
+    |> Map.get(:role)
+  end
+
   @doc """
   Gets a single membership.
 
@@ -255,6 +262,24 @@ defmodule Atomic.Organizations do
     end
   end
 
+  @doc """
+  Returns all roles bigger or equal to the given role.
+
+  ## Examples
+
+      iex> roles_bigger_than_or_equal(:member)
+      [:member, :admin, :owner]
+
+  """
+  def roles_bigger_than_or_equal(role) do
+    case role do
+      :follower -> [:follower, :member, :admin, :owner]
+      :member -> [:member, :admin, :owner]
+      :admin -> [:admin, :owner]
+      :owner -> [:owner]
+    end
+  end
+
   @doc """
   Returns the list of users organizations.
 

lib/atomic/partnerships.ex

@@ -21,6 +21,19 @@ defmodule Atomic.Partnerships do
     Repo.all(Partner)
   end
 
+  @doc """
+  Returns the list of partnerships belonging to an organization.
+
+  ## Examples
+
+      iex> list_partnerships_by_organization_id(99d7c9e5-4212-4f59-a097-28aaa33c2621)
+      [%Partner{}, ...]
+
+  """
+  def list_partnerships_by_organization_id(id) do
+    Repo.all(from p in Partner, where: p.organization_id == ^id)
+  end
+
   @doc """
   Gets a single partner.
 

lib/atomic/partnerships/partner.ex

@@ -7,7 +7,7 @@ defmodule Atomic.Partnerships.Partner do
   alias Atomic.Organizations.Organization
   alias Atomic.Uploaders
 
-  @required_fields ~w(name description)a
+  @required_fields ~w(name description organization_id)a
 
   @optional_fields []
 

lib/atomic_web/controllers/user_auth.ex

@@ -6,6 +6,7 @@ defmodule AtomicWeb.UserAuth do
   import Phoenix.Controller
 
   alias Atomic.Accounts
+  alias Atomic.Organizations
   alias AtomicWeb.Router.Helpers, as: Routes
 
   # Make the remember me cookie valid for 60 days.
@@ -31,12 +32,27 @@ defmodule AtomicWeb.UserAuth do
     token = Accounts.generate_user_session_token(user)
     user_return_to = get_session(conn, :user_return_to)
 
-    conn
-    |> renew_session()
-    |> put_session(:user_token, token)
-    |> put_session(:live_socket_id, "users_sessions:#{Base.url_encode64(token)}")
-    |> maybe_write_remember_me_cookie(token, params)
-    |> redirect(to: user_return_to || signed_in_path(conn))
+    case user.default_organization_id do
+      nil ->
+        conn
+        |> renew_session()
+        |> put_session(:user_token, token)
+        |> put_session(:live_socket_id, "users_sessions:#{Base.url_encode64(token)}")
+        |> maybe_write_remember_me_cookie(token, params)
+        |> redirect(to: user_return_to || signed_in_path(conn))
+
+      _ ->
+        conn
+        |> renew_session()
+        |> put_session(:user_token, token)
+        |> put_session(
+          :current_organization,
+          Organizations.get_organization!(user.default_organization_id)
+        )
+        |> put_session(:live_socket_id, "users_sessions:#{Base.url_encode64(token)}")
+        |> maybe_write_remember_me_cookie(token, params)
+        |> redirect(to: user_return_to || signed_in_path(conn))
+    end
   end
 
   defp maybe_write_remember_me_cookie(conn, token, %{"remember_me" => "true"}) do
@@ -94,7 +110,9 @@ defmodule AtomicWeb.UserAuth do
   def fetch_current_user(conn, _opts) do
     {user_token, conn} = ensure_user_token(conn)
     user = user_token && Accounts.get_user_by_session_token(user_token)
-    assign(conn, :current_user, user)
+
+    conn
+    |> assign(:current_user, user)
   end
 
   defp ensure_user_token(conn) do

lib/atomic_web/exceptions.ex

@@ -0,0 +1,4 @@
+defmodule AtomicWeb.MismatchError do
+  defexception message: "The provided parameters have no relation in the database.",
+               plug_status: 404
+end

lib/atomic_web/live/activity_live/edit.ex

@@ -10,13 +10,19 @@ defmodule AtomicWeb.ActivityLive.Edit do
   end
 
   @impl true
-  def handle_params(%{"id" => id} = _params, _url, socket) do
-    {:noreply,
-     socket
-     |> assign(:page_title, gettext("Edit Activity"))
-     |> assign(
-       :activity,
-       Activities.get_activity!(id, [:activity_sessions, :speakers, :departments])
-     )}
+  def handle_params(%{"organization_id" => organization_id, "id" => id} = _params, _url, socket) do
+    activity =
+      Activities.get_activity!(id, preloads: [:activity_sessions, :departments, :speakers])
+
+    organizations = Activities.get_activity_organizations!(activity)
+
+    if organization_id in organizations do
+      {:noreply,
+       socket
+       |> assign(:page_title, gettext("Edit Activity"))
+       |> assign(:activity, activity)}
+    else
+      raise AtomicWeb.MismatchError
+    end
   end
 end

lib/atomic_web/live/activity_live/edit.html.heex

@@ -1,3 +1,3 @@
 <div id="atomic-edit" phx-update="ignore">
-  <.live_component module={AtomicWeb.ActivityLive.FormComponent} id={@activity.id} title={@page_title} action={@live_action} activity={@activity} return_to={Routes.activity_show_path(@socket, :show, @activity)} />
+  <.live_component module={AtomicWeb.ActivityLive.FormComponent} id={@activity.id} organization={@current_organization} title={@page_title} action={@live_action} activity={@activity} return_to={Routes.activity_show_path(@socket, :show, @current_organization, @activity)} />
 </div>

lib/atomic_web/live/activity_live/form_component.ex

@@ -7,25 +7,35 @@ defmodule AtomicWeb.ActivityLive.FormComponent do
 
   @impl true
   def mount(socket) do
-    departments = Departments.list_departments()
-    speakers = Activities.list_speakers()
-
     {:ok,
      socket
-     |> assign(:departments, departments)
-     |> assign(:speakers, speakers)}
+     |> assign(:departments, [])
+     |> assign(:speakers, [])}
   end
 
   @impl true
   def update(%{activity: activity} = assigns, socket) do
+    departments = Departments.list_departments_by_organization_id(assigns.organization.id)
+    speakers = Activities.list_speakers_by_organization_id(assigns.organization.id)
     changeset = Activities.change_activity(activity)
 
     {:ok,
      socket
      |> assign(assigns)
+     |> assign(:departments, departments)
+     |> assign(:speakers, speakers)
      |> assign(:changeset, changeset)}
   end
 
+  @impl true
+  def update(%{"organization_id" => organization_id}, socket) do
+    departments = Departments.list_departments_by_organization_id(organization_id)
+
+    {:ok,
+     socket
+     |> assign(:departments, departments)}
+  end
+
   @impl true
   def handle_event("validate", %{"activity" => activity_params}, socket) do
     changeset =

lib/atomic_web/live/activity_live/index.ex

@@ -5,8 +5,8 @@ defmodule AtomicWeb.ActivityLive.Index do
   alias Atomic.Activities.Activity
 
   @impl true
-  def mount(_params, _session, socket) do
-    {:ok, assign(socket, :activities, list_activities())}
+  def mount(params, _session, socket) do
+    {:ok, assign(socket, :activities, list_activities(params["organization_id"]))}
   end
 
   @impl true
@@ -37,10 +37,10 @@ defmodule AtomicWeb.ActivityLive.Index do
     activity = Activities.get_activity!(id)
     {:ok, _} = Activities.delete_activity(activity)
 
-    {:noreply, assign(socket, :activies, list_activities())}
+    {:noreply, assign(socket, :activies, list_activities(socket.assigns.current_organization.id))}
   end
 
-  defp list_activities do
-    Activities.list_activities(preloads: [:activity_sessions])
+  defp list_activities(organization_id) do
+    Activities.list_activities_by_organization_id(organization_id, preloads: [:activity_sessions])
   end
 end

lib/atomic_web/live/activity_live/index.html.heex

@@ -22,11 +22,11 @@
         <td><%= activity.maximum_entries %></td>
 
         <td>
-          <span><%= live_redirect("Show", to: Routes.activity_show_path(@socket, :show, activity)) %></span>
+          <span><%= live_redirect("Show", to: Routes.activity_show_path(@socket, :show, @current_organization, activity)) %></span>
         </td>
       </tr>
     <% end %>
   </tbody>
 </table>
 
-<span><%= live_patch("New Activity", to: Routes.activity_new_path(@socket, :new)) %></span>
+<span><%= live_patch("New Activity", to: Routes.activity_new_path(@socket, :new, @current_organization)) %></span>

lib/atomic_web/live/activity_live/new.html.heex

@@ -1,3 +1,3 @@
 <div id="atomic-new" phx-update="ignore">
-  <.live_component module={AtomicWeb.ActivityLive.FormComponent} id={:new} title={@page_title} action={@live_action} activity={@activity} return_to={Routes.activity_index_path(@socket, :index)} />
+  <.live_component module={AtomicWeb.ActivityLive.FormComponent} id={:new} organization={@current_organization} title={@page_title} action={@live_action} activity={@activity} return_to={Routes.activity_index_path(@socket, :index, @current_organization)} />
 </div>