IDEA-330: Add Instructor Permissions for College System Users - Implementation Plan

fluffy-whistling-wilkes.md

IDEA-330: Add Instructor Permissions for College System Users

Context

College system users (e.g., KCTCS kctcsreportingadmin) can access all colleges under their system but get "Access Denied" on the Instructors page. The Courses page and Admin sidebar already work. The root cause is missing Instructor-related CanCanCan permissions in the college_system? block of ability.rb.

Implementation

File: app/models/ability.rb (lines 837-941)

The college_system? block already defines instr_cond = { college: coll_cond } on line 847 but never uses it. Add the following permissions after the existing InstructorCourseDocument read block (around line 857), mirroring the college super admin permissions from lines 498-557:

Instructor core:

can :manage, Instructor, instr_cond
can :manage, InstructorEducation, instr_cond
can :manage, InstructorCourse, course: course_cond

Instructor reviews:

can :create, InstructorReview, instructor: instr_cond
can :manage, InstructorReview, college: coll_cond

Documents:

can [:read, :create, :update, :destroy, :approve], InstructorDocument, college: coll_cond
can [:read, :create, :update, :destroy, :approve], CourseReviewerDocument, college: coll_cond

Upgrade InstructorCourseDocument from read-only to full CRUD+approve. Replace the existing read-only block (lines 854-857) with:

can [:create, :read, :approve, :select_course_review], InstructorCourseDocument do |icd|
  !icd.instructor.archive && !icd.instructor.high_school.archive &&
    icd.instructor.high_school.colleges.joins(:college_systems).exists?("college_systems.id = ?", id)
end

can [:update, :destroy], InstructorCourseDocument do |icd|
  !icd.approved && !icd.instructor.archive && !icd.instructor.high_school.archive &&
    icd.instructor.high_school.colleges.joins(:college_systems).exists?("college_systems.id = ?", id)
end

Course reviewers and deans:

can :manage, CourseReviewer, college: coll_cond
can :manage, Dean, college: coll_cond

Instructor review course actions:

can [:courses, :add_prospective_course_with_defaults, :remove_prospective_course,
     :complete_af_step_and_redirect_back, :prospective_courses, :edit_prospective_course,
     :batch_approve_prospective_courses, :update_prospective_course_and_launch_review], InstructorReviewCourse
can :deans_with_replacement_users, ActiveFlow
can :update_deans_with_replacement_users, ActiveFlow
can :change_term, ActiveFlow
can :update_change_term, ActiveFlow
can :change_participants, ActiveFlow
can :update_change_participants, ActiveFlow

Verification

1. Log in as kctcs_system on dev for any KCTCS college
2. Navigate to Instructors page — should load without Access Denied
3. Verify CRUD on instructors, documents, reviews, deans, course reviewers
4. Run bundle exec rspec spec/models/ability_spec.rb if it exists
5. Run relevant instructor controller specs