update authorize

app/controllers/base_crm_controller.rb

@@ -1,9 +1,17 @@
 class BaseCrmController < ActionController::Base
-  include LoginVerification
-  layout "CRM"
+	include LoginVerification
+	layout "CRM"
 
   #before_action :check_installation
   protect_from_forgery with: :exception
 
+  rescue_from CanCan::AccessDenied do |exception|
+  	flash[:warning] = exception.message
+  	redirect_to root_path
+  end
+
+  def current_user
+  	@current_user ||= Employee.find_by_token_session(session[:session_token]) if session[:session_token]
+  end
   
 end

app/controllers/base_oqs_controller.rb

@@ -5,5 +5,13 @@ class BaseOqsController < ActionController::Base
   #before_action :check_installation
   protect_from_forgery with: :exception
 
+  rescue_from CanCan::AccessDenied do |exception|
+  	flash[:warning] = exception.message
+  	redirect_to root_path
+  end
+
+  def current_user
+  	@current_user ||= Employee.find_by_token_session(session[:session_token]) if session[:session_token]
+  end
 
 end

app/controllers/base_report_controller.rb

@@ -5,6 +5,15 @@ class BaseReportController < ActionController::Base
 	#before_action :check_installation
 	protect_from_forgery with: :exception
 
+	rescue_from CanCan::AccessDenied do |exception|
+    flash[:warning] = exception.message
+    redirect_to root_path
+  end
+
+  def current_user
+    @current_user ||= Employee.find_by_token_session(session[:session_token]) if session[:session_token]
+  end
+
 	PERIOD = {
 		"today" => 0,
 		"yesterday" => 1,

app/controllers/crm/bookings_controller.rb

@@ -1,5 +1,5 @@
 class Crm::BookingsController < BaseCrmController
-
+	load_and_authorize_resource
 	def update_booking
         booking = Booking.find(params[:booking_id])
        

app/controllers/crm/customers_controller.rb

@@ -1,4 +1,5 @@
 class Crm::CustomersController < BaseCrmController
+  load_and_authorize_resource except: [:create]
   before_action :set_crm_customer, only: [:show, :edit, :update, :destroy]
 
   # GET /crm/customers

app/controllers/crm/dining_queues_controller.rb

@@ -1,4 +1,5 @@
 class Crm::DiningQueuesController < BaseCrmController
+  load_and_authorize_resource
   before_action :set_dining_queue, only: [:show, :edit, :update, :destroy]
 
   # GET /crm/dining_queues

app/controllers/home_controller.rb

@@ -18,6 +18,12 @@ class HomeController < ApplicationController
       elsif @employee.role == "cashier"
         session[:session_token] = @employee.token_session
         redirect_to origami_root_path
+      elsif @employee.role == "manager"
+        session[:session_token] = @employee.token_session
+        redirect_to dashboard_path
+      elsif @employee.role == "accountant"
+        session[:session_token] = @employee.token_session
+        redirect_to dashboard_path
       else
          render :index
       end

app/controllers/origami/discounts_controller.rb

@@ -1,4 +1,5 @@
 class Origami::DiscountsController < BaseOrigamiController
+  authorize_resource :class => false
 
   #discount page show from origami index with selected order
   def index

app/controllers/origami/moveroom_controller.rb

@@ -1,5 +1,7 @@
 class Origami::MoveroomController < BaseOrigamiController
-
+  
+  authorize_resource :class => false
+  
   def move_dining
     @tables = Table.all.active.order('status desc')
     @rooms = Room.all.active.order('status desc')

app/controllers/origami/movetable_controller.rb

@@ -1,4 +1,6 @@
 class Origami::MovetableController < BaseOrigamiController
+  
+  authorize_resource :class => false
 
   def move_dining
     @tables = Table.all.active.order('status desc')

app/controllers/origami/payments_controller.rb

@@ -1,6 +1,6 @@
 class Origami::PaymentsController < BaseOrigamiController
 
-
+  authorize_resource :class => false
   def index
   end
 

app/controllers/origami/request_bills_controller.rb

@@ -1,5 +1,5 @@
 class Origami::RequestBillsController < BaseOrigamiController
-  load_and_authorize_resource
+
   # Print Request Bill and add to sale tables
   def print
     @sale = Sale.new

app/controllers/print_settings_controller.rb

@@ -1,4 +1,5 @@
 class PrintSettingsController < ApplicationController
+  load_and_authorize_resource except: [:create]
   before_action :set_print_setting, only: [:show, :edit, :update, :destroy]
 
   # GET /print_settings

app/controllers/reports/bksale_items_controller.rb

@@ -1,5 +1,5 @@
-class Reports::SaleItemController < BaseReportController
-	
+class Reports::SaleItemsController < BaseReportController
+	authorize_resource :class => false
   def index
       
       from, to, report_type  = get_date_range_from_params

app/controllers/reports/daily_sales_controller.rb

@@ -0,0 +1,17 @@
+class Reports::DailySalesController < BaseReportController
+  # authorize_resource :class => false
+  def index
+	from, to ,report_type  = get_date_range_from_params
+	@sale_data = Sale.daily_sales_list(from,to)
+	@tax       = SaleTax.get_tax(from,to)
+	respond_to do |format|
+      format.html
+      format.xls
+    end
+  end
+  
+  def show
+  	
+  end
+
+end

app/controllers/reports/daily_salesbk_controller.rb

@@ -1,5 +1,5 @@
-class Reports::DailySaleController < BaseReportController
-
+class Reports::DailySalesController < BaseReportController
+  authorize_resource :class => false
   def index
 	from, to ,report_type  = get_date_range_from_params
 	@sale_data = Sale.daily_sales_list(from,to)

app/controllers/reports/sale_items_controller.rb

@@ -0,0 +1,19 @@
+class Reports::SaleItemsController < BaseReportController
+	# authorize_resource :class => false
+  def index
+      
+      from, to, report_type  = get_date_range_from_params
+
+      @sale_data = Sale.get_by_range_by_saleitems(from,to,Sale::SALE_STATUS_COMPLETED,report_type) 
+
+      respond_to do |format|
+	    format.html
+	    format.xls
+	  end
+  end
+
+  def show
+  	
+  end
+
+end

app/controllers/settings/accounts_controller.rb

@@ -1,4 +1,5 @@
 class Settings::AccountsController < ApplicationController
+  load_and_authorize_resource except: [:create]
   before_action :set_account, only: [:show, :edit, :update, :destroy]
 
   # GET /settings/accounts

app/controllers/settings/cashier_terminals_controller.rb

@@ -1,4 +1,5 @@
 class Settings::CashierTerminalsController < ApplicationController
+  load_and_authorize_resource except: [:create]
   before_action :set_settings_cashier_terminal, only: [:show, :edit, :update, :destroy]
 
   # GET /settings/cashier_terminals

app/controllers/settings/membership_actions_controller.rb

@@ -1,4 +1,5 @@
 class Settings::MembershipActionsController < ApplicationController
+  load_and_authorize_resource except: [:create]
   before_action :set_settings_membership_action, only: [:show, :edit, :update, :destroy]
 
   # GET /settings/membership_actions

app/controllers/settings/membership_settings_controller.rb

@@ -1,4 +1,5 @@
 class Settings::MembershipSettingsController < ApplicationController
+  load_and_authorize_resource except: [:create]
   before_action :set_settings_membership_setting, only: [:show, :edit, :update, :destroy]
 
   # GET /settings/membership_settings

app/controllers/settings/menu_categories_controller.rb

@@ -1,4 +1,5 @@
 class Settings::MenuCategoriesController < ApplicationController
+  load_and_authorize_resource except: [:create]
   before_action :set_settings_menu_category, only: [:show, :edit, :update, :destroy]
   before_action :set_settings_menu, only: [:new]
 

app/controllers/settings/menu_item_attributes_controller.rb

@@ -1,4 +1,5 @@
 class Settings::MenuItemAttributesController < ApplicationController
+  load_and_authorize_resource except: [:create]
   before_action :set_settings_menu_item_attribute, only: [:show, :edit, :update, :destroy]
 
   # GET /settings/menu_item_attributes

app/controllers/settings/menu_item_instances_controller.rb

@@ -1,4 +1,5 @@
 class Settings::MenuItemInstancesController < ApplicationController
+  load_and_authorize_resource except: [:create]
   before_action :set_settings_menu_item_instance, only: [:show, :edit, :update, :destroy]
   before_action :set_settings_menu_item, only: [ :show, :edit, :new, :update]
 

app/controllers/settings/menu_item_options_controller.rb

@@ -1,4 +1,5 @@
 class Settings::MenuItemOptionsController < ApplicationController
+  load_and_authorize_resource except: [:create]
   before_action :set_settings_menu_item_option, only: [:show, :edit, :update, :destroy]
 
   # GET /settings/menu_item_options

app/controllers/settings/menus_controller.rb

@@ -1,4 +1,5 @@
 class Settings::MenusController < ApplicationController
+  load_and_authorize_resource except: [:create]
   before_action :set_settings_menu, only: [:show, :edit, :update, :destroy]
 
   # GET /settings/menus

app/controllers/settings/order_queue_stations_controller.rb

@@ -1,4 +1,5 @@
 class Settings::OrderQueueStationsController < ApplicationController
+  load_and_authorize_resource except: [:create]
   before_action :set_settings_order_queue_station, only: [:show, :edit, :update, :destroy]
 
   # GET /settings/order_queue_stations

app/controllers/settings/payment_method_settings_controller.rb

@@ -1,4 +1,5 @@
 class Settings::PaymentMethodSettingsController < ApplicationController
+  load_and_authorize_resource except: [:create]
   before_action :set_settings_payment_method_setting, only: [:show, :edit, :update, :destroy]
 
   # GET /settings/payment_method_settings

app/controllers/settings/tax_profiles_controller.rb

@@ -1,4 +1,5 @@
 class Settings::TaxProfilesController < ApplicationController
+  load_and_authorize_resource except: [:create]
   before_action :set_settings_tax_profile, only: [:show, :edit, :update, :destroy]
 
   # GET /settings/tax_profiles

app/controllers/settings/zones_controller.rb

@@ -1,4 +1,5 @@
 class Settings::ZonesController < ApplicationController
+  load_and_authorize_resource except: [:create]
   before_action :set_settings_zone, only: [:show, :edit, :update, :destroy]
 
   # GET /settings/zones

app/controllers/transactions/orders_controller.rb

@@ -1,4 +1,5 @@
 class Transactions::OrdersController < ApplicationController
+	load_and_authorize_resource except: [:create]
 	def index
 
 		filter = params[:filter]     

app/controllers/transactions/sales_controller.rb

@@ -1,4 +1,5 @@
 class Transactions::SalesController < ApplicationController
+  load_and_authorize_resource except: [:create]
   before_action :set_transactions_sale, only: [:show, :edit, :update, :destroy]
 
   # GET /transactions/sales