close #142

app/controllers/admin/education/teachers_controller.rb

@@ -12,11 +12,13 @@ class Admin::Education::TeachersController < Admin::Education::ApplicationContro
   end
 
   def edit
+    authorize!(:manage, :all)
     breadcrumb
     add_breadcrumb t('edit')
   end
 
   def update
+    authorize!(:manage, :all)
     if @teacher.update(teacher_params)
       redirect_to admin_education_teacher_path(@teacher), notice: t('admin.successfully_updated_html', model: @teacher.to_s)
     else

app/models/ability.rb

@@ -33,20 +33,22 @@ class Ability
   def teacher
     can :manage, University::Person, user_id: @user.id
     cannot :create, University::Person
-    can :read, Education::Program, university_id: @user.university_id
+    can [:read, :children], Education::Program, university_id: @user.university_id
     can :read, University::Role, university_id: @user.university_id
     can :manage, University::Person::Involvement, person_id: @user.person&.id
     can :read, University::Person::Involvement, university_id: @user.university_id
   end
 
   def program_manager
+    managed_programs_ids = @user.programs_to_manage.pluck(:education_program_id)
     can :manage, University::Person, university_id: @user.university_id
-    can :manage, Education::Program, university_id: @user.university_id
-    can :manage, University::Role, university_id: @user.university_id
-    can :manage, University::Person::Involvement, university_id: @user.university_id
+    can :manage, Education::Program, id: managed_programs_ids
+    can [:read, :children], Education::Program, university_id: @user.university_id
+    cannot :create, Education::Program
+    can :manage, University::Role, target_type: "Education::Program", target_id: managed_programs_ids
+    can :manage, University::Person::Involvement, target_type: "Education::Program", target_id: managed_programs_ids
     can :read, Communication::Website, university_id: @user.university_id
     can :manage, Communication::Website::Post, university_id: @user.university_id
-
   end
 
   def admin
@@ -65,6 +67,7 @@ class Ability
     can :manage, Communication::Website::Imported::Post, university_id: @user.university_id
     can :manage, Education::School, university_id: @user.university_id
     can :manage, Education::Program, university_id: @user.university_id
+    can :manage, :all_programs # needed to prevent program_manager to access specific global screens
     can :manage, Research::Journal, university_id: @user.university_id
     can :manage, Research::Journal::Article, university_id: @user.university_id
     can :manage, Research::Journal::Volume, university_id: @user.university_id

app/views/admin/education/programs/show/_roles.html.erb

 <div class="float-end">
-  <%= link_to t('education.manage_roles'),
+  <% if !current_user.program_manager? || current_user.programs_to_manage.pluck(:education_program_id).include?(@program.id) %>
+    <%= link_to t('education.manage_roles'),
               admin_education_program_roles_path(program_id: @program.id),
               class: button_classes if can?(:update, University::Role) %>
+  <% end %>
 </div>
 <h3 class="h5"><%= Education::Program.human_attribute_name('roles') %></h3>
 <% if @roles.any? %>

app/views/admin/education/programs/show/_teachers.html.erb

 <div class="float-end">
-  <%= link_to t('education.manage_teachers'),
+  <% if !current_user.program_manager? || current_user.programs_to_manage.pluck(:education_program_id).include?(@program.id) %>
+    <%= link_to t('education.manage_teachers'),
               admin_education_program_teachers_path(program_id: @program.id),
               class: button_classes if can?(:update, University::Person::Involvement) %>
+  <% end %>
 </div>
 <h3 class="h5"><%= Education::Program.human_attribute_name('teachers') %></h3>
 <% if @teacher_involvements.any? %>

app/views/admin/education/teachers/_involvement_fields.html.erb

@@ -15,7 +15,9 @@
           <%= f.input :description, label: false, placeholder: University::Person::Involvement.human_attribute_name('description'), wrapper: false %>
         </div>
         <div class="col-2">
-          <%= link_to_remove_association '<i class="fas fa-trash"></i>'.html_safe, f, class: 'btn btn-sm btn-danger' %>
+          <%= link_to_remove_association '<i class="fas fa-trash"></i>'.html_safe,
+                                         f,
+                                         class: 'btn btn-sm btn-danger' %>
         </div>
       </div>
     </div>

app/views/admin/education/teachers/show.html.erb

@@ -44,5 +44,5 @@
 <% end %>
 
 <% content_for :action_bar_right do %>
-  <%= link_to t('education.manage_programs'), edit_admin_education_teacher_path(@teacher), class: button_classes if can?(:manage, University::Person::Involvement) %>
+  <%= link_to t('education.manage_programs'), edit_admin_education_teacher_path(@teacher), class: button_classes if can?(:manage, :all) %>
 <% end %>