<commit_before>class AdminAbility
  include CheckBasicAbilities

  def initialize(user = nil)
    @user = User.current ||= user || User.new
    @teams = @user.teams_owned.map(&:id)
    # Define User abilities
    if @user.is_admin?
      global_admin_perms
    else
      extra_perms_for_all_users
      if @user.id
        authenticated_perms
      end
      if @teams.any?
        owner_perms
      end
    end
  end

  private

  def owner_perms
    can :access, :rails_admin
    can :dashboard

    can [:update, :destroy], User, :team_users => { :team_id => @teams, role: ['owner', 'editor', 'journalist', 'contributor'] }

    can :create, Team
    can [:update, :destroy], Team, :id => @teams
    can :create, TeamUser, :team_id => @teams, role: ['owner', 'editor', 'journalist', 'contributor']
    can :update, TeamUser, team_id: @teams
    can :destroy, TeamUser, user_id: @user.id
    cannot :update, TeamUser, team_id: @teams, user_id: @user.id
    can [:create, :update, :destroy], Contact, :team_id => @teams
    can [:create, :update], Project, :team_id => @teams
    can :update, Project, :team_id => @teams, :user_id => @user.id
    can :destroy, Project, :team_id => @teams
    can :export_project, Project, team_id: @teams

    can :create, [Media, Comment, Embed, Link, Claim, Dynamic]
    can :update, [Media, Link, Claim], :user_id => @user.id
    can :update, [Media, Link, Claim], projects: { team: { id: @teams }}
    can [:update, :destroy], [Media, Link, Claim] do |obj|
      (obj.get_team & @teams).any?
    end
    can :update, Embed
    can [:create, :update], [ProjectSource, ProjectMedia], project: { team: { id: @teams }}
    can :destroy, [ProjectMedia, ProjectSource], project: { team: { id: @teams }}
    can [:create, :update, :destroy], [Source, Account], :team_id => @teams
    %w(annotation comment flag status tag embed dynamic task).each do |annotation_type|
      can [:create, :destroy], annotation_type.classify.constantize, ['annotation_type = ?', annotation_type] do |obj|
        (obj.get_team & @teams).any?
      end
    end
    %w(annotation comment flag status embed dynamic task).each do |annotation_type|
      can [:update], annotation_type.classify.constantize, ['annotation_type = ?', annotation_type] do |obj|
        (obj.get_team & @teams).any?
      end
    end
    can [:destroy, :update], [Dynamic, Annotation, Task] do |obj|
      obj.annotator_id.to_i == @user.id
    end
    can [:create, :update, :destroy], DynamicAnnotation::Field do |obj|
      obj.annotation.annotator_id == @user.id
    end
    can :update, [Dynamic, Annotation] do |obj|
      (obj.get_team & @teams).any?
    end
    can :update, DynamicAnnotation::Field do |obj|
      (obj.annotation.get_team & @teams).any?
    end
    can :update, Task, ['annotation_type = ?', 'task'] do |obj|
      before, after = obj.data_change
      changes = (after.to_a - before.to_a).to_h
      (obj.get_team & @teams).any? && changes.keys == ['status']
    end
    can :destroy, PaperTrail::Version do |obj|
      teams = []
      v_obj = obj.item_type.constantize.find(obj.item_id)<commit_msg>Ticket #6239: Admin owners can only see data related to their teams on Admin UI<commit_after>class AdminAbility
  include CheckBasicAbilities

  def initialize(user = nil)
    alias_action :create, :read, :update, :destroy, :to => :crud
    @user = User.current ||= user || User.new
    @teams = @user.teams_owned.map(&:id)
    # Define User abilities
    if @user.is_admin?
      global_admin_perms
    else
      if @user.id
        authenticated_perms
      end
      if @teams.any?
        owner_perms
      end
    end
  end

  private

  def owner_perms
    can :access, :rails_admin
    can :dashboard

    can [:read, :update, :destroy], User, team_users: { team_id: @teams, status: 'member'  }

    can :create, Team
    can [:read, :update, :destroy], Team, :id => @teams
    can :create, TeamUser, :team_id => @teams, role: ['owner', 'editor', 'journalist', 'contributor']
    can [:read, :update], TeamUser, team_id: @teams
    can :destroy, TeamUser, user_id: @user.id
    cannot :update, TeamUser, team_id: @teams, user_id: @user.id
    can [:crud], Contact, team_id: @teams
    can [:create, :read, :update], Project, team_id: @teams
    can :update, Project, team_id: @teams, user_id: @user.id
    can :destroy, Project, team_id: @teams
    can :export_project, Project, team_id: @teams

    can :create, [Media, Comment, Embed, Link, Claim, Dynamic]
    can :update, [Media, Link, Claim], :user_id => @user.id
    can [:read, :update, :destroy], [Media, Link, Claim], projects: { team: { id: @teams }}
    can :update, Embed, annotated: { project: { team: { id: @teams }}}
    can [:crud], [ProjectSource, ProjectMedia], project: { team: { id: @teams }}
    can [:crud], [Source, Account], :team_id => @teams
    %w(annotation comment flag status embed dynamic task).each do |annotation_type|
      can [:crud], annotation_type.classify.constantize, ['annotation_type = ?', annotation_type] do |obj|
        (obj.get_team & @teams).any?
      end
    end
    can [:create, :read, :destroy], Tag, ['annotation_type = ?', 'tag'] do |obj|
      (obj.get_team & @teams).any?
    end
    can [:destroy, :update], [Dynamic, Annotation, Task] do |obj|
      obj.annotator_id.to_i == @user.id
    end
    can [:create, :update, :destroy], DynamicAnnotation::Field do |obj|
      obj.annotation.annotator_id == @user.id
    end
    can :update, [Dynamic, Annotation] do |obj|
      (obj.get_team & @teams).any?
    end
    can :update, DynamicAnnotation::Field do |obj|
      (obj.annotation.get_team & @teams).any?
    end
    can :update, Task, ['annotation_type = ?', 'task'] do |obj|
      before, after = obj.data_change
      changes = (after.to_a - before.to_a).to_h
      (obj.get_team & @teams).any? && changes.keys == ['status']
    end
    can :create, PaperTrail::Version
    can :destroy, PaperTrail::Version do |obj|
      teams = []
      v_obj = obj.item_type.constantize.find(obj.item_id)
{'fraction_non_alphanumeric': 0.14731254147312542, 'fraction_numerical': 0.0006635700066357001, 'mean_word_length': 3.281960227272727, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 19, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6930140', 'n_tokens_mistral': 2088, 'n_tokens_neox': 2048, 'n_words': 570}