add cancan for authorization

app/views/templates/_submission.html.erb

@@ -38,7 +38,7 @@
         <%= render 'shared/clipboard_copy', text: submit_form_url(slug: submitter.slug), class: 'btn btn-sm btn-neutral text-white md:w-36 flex', icon_class: 'w-6 h-6 text-white', copy_title: 'Copy Link', copy_title_md: 'Copy', copied_title_md: 'Copied' %>
       <% end %>
       <span class="btn btn-outline btn-sm w-20 md:w-24">View</span>
-      <% unless submission.deleted_at? %>
+      <% if !submission.deleted_at? && can?(:destroy, submission) %>
         <%= button_to button_title(title: nil, disabled_with: 'Remov', icon: svg_icon('trash', class: 'w-6 h-6')), submission_path(submission), class: 'btn btn-outline btn-sm', title: 'Delete', method: :delete, data: { turbo_confirm: 'Are you sure?' }, onclick: 'event.stopPropagation()' %>
       <% end %>
     </div>

app/views/templates/_template.html.erb

@@ -15,20 +15,22 @@
     </div>
   </a>
   <div class="absolute top-0 bottom-0 w-0 pt-7 space-y-1.5 hidden md:group-hover:block" style="right: 40px">
-    <% if template.deleted_at? %>
+    <% if template.deleted_at? && can?(:update, template) %>
       <%= button_to template_restore_index_path(template), class: 'btn btn-xs hover:btn-outline bg-base-200 btn-circle' do %>
         <%= svg_icon('rotate', class: 'w-4 h-4 enabled') %>
         <%= svg_icon('loader', class: 'w-4 h-4 animate-spin disabled') %>
       <% end %>
-    <% else %>
+    <% elsif can?(:update, template) %>
       <a href="<%= edit_template_path(template) %>" class="btn btn-xs hover:btn-outline bg-base-200 btn-circle">
         <%= svg_icon('pencil', class: 'w-4 h-4') %>
       </a>
     <% end %>
-    <a href="<%= new_template_path(base_template_id: template.id) %>" data-turbo-frame="modal" class="btn btn-xs hover:btn-outline bg-base-200 btn-circle">
-      <%= svg_icon('copy', class: 'w-4 h-4') %>
-    </a>
-    <% unless template.deleted_at? %>
+    <% if can?(:create, template) %>
+      <a href="<%= new_template_path(base_template_id: template.id) %>" data-turbo-frame="modal" class="btn btn-xs hover:btn-outline bg-base-200 btn-circle">
+        <%= svg_icon('copy', class: 'w-4 h-4') %>
+      </a>
+    <% end %>
+    <% if !template.deleted_at? && can?(:destroy, template) %>
       <%= button_to template_path(template), data: { turbo_confirm: 'Are you sure?' }, method: :delete, class: 'btn btn-xs hover:btn-outline bg-base-200 btn-circle', aria_label: 'Restore' do %>
         <%= svg_icon('trash', class: 'w-4 h-4 enabled') %>
         <%= svg_icon('loader', class: 'w-4 h-4 animate-spin disabled') %>

app/views/templates/_title.html.erb

@@ -6,14 +6,16 @@
     <% end %>
   </h1>
   <div class="flex md:justify-between space-x-2 flex-none">
-    <% unless template.deleted_at? %>
+    <% if !template.deleted_at? && can?(:destroy, template) %>
       <%= button_to button_title(title: 'Remove', disabled_with: 'Removing', icon: svg_icon('trash', class: 'w-6 h-6')), template_path(template), class: 'btn btn-outline btn-sm', method: :delete, data: { turbo_confirm: 'Are you sure?' } %>
     <% end %>
-    <%= link_to new_template_path(base_template_id: template.id), class: 'btn btn-outline btn-sm', data: { turbo_frame: :modal } do %>
-      <%= svg_icon('copy', class: 'w-6 h-6') %>
-      <span>Clone</span>
+    <% if can?(:create, template) %>
+      <%= link_to new_template_path(base_template_id: template.id), class: 'btn btn-outline btn-sm', data: { turbo_frame: :modal } do %>
+        <%= svg_icon('copy', class: 'w-6 h-6') %>
+        <span>Clone</span>
+      <% end %>
     <% end %>
-    <% unless template.deleted_at? %>
+    <% if !template.deleted_at? && can?(:update, template) %>
       <%= link_to edit_template_path(template), class: 'btn btn-outline btn-sm' do %>
         <span class="flex items-center justify-center space-x-2">
           <%= svg_icon('pencil', class: 'w-6 h-6') %>
@@ -21,7 +23,7 @@
         </span>
       <% end %>
     <% end %>
-    <% if template.deleted_at? %>
+    <% if template.deleted_at? && can?(:create, template) %>
       <%= button_to button_title(title: 'Restore', disabled_with: 'Restoring', icon: svg_icon('rotate', class: 'w-6 h-6')), template_restore_index_path(template), class: 'btn btn-outline btn-sm' %>
     <% end %>
   </div>

app/views/templates/show.html.erb

@@ -15,7 +15,7 @@
           <%= render 'shared/clipboard_copy', text: start_form_url(slug: @template.slug), class: 'base-button', icon_class: 'w-6 h-6 text-white', copy_title: 'Copy Share Link', copied_title: 'Copied to Clipboard', copy_title_md: 'Copy', copied_title_md: 'Copied' %>
         </span>
       <% end %>
-      <% if (!@pagy.count.zero? || params[:q].present?) && !@template.deleted_at? %>
+      <% if (!@pagy.count.zero? || params[:q].present?) && !@template.deleted_at? && can?(:create, Submission) %>
         <%= link_to new_template_submission_path(@template), class: 'order-1 btn btn-primary text-base', data: { turbo_frame: 'modal' } do %>
           <%= svg_icon('plus', class: 'w-6 h-6 stroke-2') %>
           <span>Add <span class="hidden md:inline">Recipients</span></span>
@@ -31,7 +31,7 @@
   <% view_archived_html = capture do %>
     <% if @template.submissions.where.not(deleted_at: nil).exists? && !@template.deleted_at? %>
       <div>
-        <a href="<%= template_archived_path(@template) %>" class="link text-sm">View Archived</a>
+        <a href="<%= template_archived_index_path(@template) %>" class="link text-sm">View Archived</a>
       </div>
     <% end %>
   <% end %>
@@ -50,9 +50,11 @@
         <% if @template.deleted_at.blank? && params[:q].blank? %>
           <p class="text-gray-600">Send an invitation to fill and complete the form</p>
           <div class="space-x-2">
-            <%= link_to new_template_submission_path(@template), class: 'base-button mt-6', data: { turbo_frame: 'modal' } do %>
-              <%= svg_icon('plus', class: 'w-6 h-6 stroke-2') %>
-              <span class="mr-1">Add Recipients</span>
+            <% if can?(:create, Submission) %>
+              <%= link_to new_template_submission_path(@template), class: 'base-button mt-6', data: { turbo_frame: 'modal' } do %>
+                <%= svg_icon('plus', class: 'w-6 h-6 stroke-2') %>
+                <span class="mr-1">Add Recipients</span>
+              <% end %>
             <% end %>
             <%= link_to start_form_url(slug: @template.slug), class: 'white-button mt-6', target: '_blank', rel: 'noopener' do %>
               <%= svg_icon('writing', class: 'w-6 h-6') %>