Merge branch 'master' of https://github.com/ZeusWPI/Tap into mobile

app/controllers/application_controller.rb

@@ -2,7 +2,7 @@ class ApplicationController < ActionController::Base
   protect_from_forgery with: :exception
 
   rescue_from CanCan::AccessDenied do |exception|
-    redirect_to root_path, flash: { error: exception.message }
+    redirect_to root_path, flash: { error: message_for(exception) }
   end
 
   def after_sign_in_path_for(resource)
@@ -12,4 +12,14 @@ class ApplicationController < ActionController::Base
   def after_sign_up_path_for(resource)
     root_path
   end
+
+  private
+
+  def message_for exception
+    if exception.subject.class == Order && [:new, :create].include?(exception.action)
+      "Betaal uw fucking schulden!"
+    else
+      exception.message
+    end
+  end
 end

app/models/ability.rb

@@ -17,7 +17,7 @@ class Ability
 
   def initialize_koelkast
     can :manage, Order do |order|
-      !order.try(:user).try(:private)
+      !order.try(:user).try(:private) && order.try(:user).try(:balance).try(:>, -500)
     end
     can :quickpay, User
   end
@@ -26,7 +26,7 @@ class Ability
     can :read, :all
     can :manage, User, id: user.id
     can :create, Order do |order|
-      order.user == user
+      order.user == user && user.try(:balance).try(:>, -500)
     end
     can :destroy, Order do |order|
       order.try(:user) == user && order.deletable

app/views/users/_sidebar.html.haml

@@ -12,8 +12,8 @@
     %li.list-group-item
       %strong Products ordered
       %span.badge= @user.products_group_by_id.map(&:count).sum
-    - if can? :create, @user.orders.build
-      %li.list-group-item= link_to "Place new order", new_user_order_path(@user), class: "btn btn-default btn-block"
+    -# - if can? :create, @user.orders.build
+    %li.list-group-item= link_to "Place new order", new_user_order_path(@user), class: "btn btn-default btn-block"
   = render 'errors', object: @user
   - if can? :edit, @user
     %ul.list-group