forgeplus/app/controllers/ratings_controller.rb

class RatingsController < ApplicationController
  RATE_TYPE = ["issue"]
  SCORES = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10]

  before_action :require_login

  before_action :check_create_params, :set_relate_object, only: [:create, :index]
  before_action :check_score, only: [:create]

  # GET /ratings
  # GET /ratings.json
  def index
    project = @relate_object.project
    @ratings = 
      if project.manager?(current_user)
        @relate_object.ratings
      else
        @relate_object.ratings.where(rater_id: current_user)
      end

  end


  # POST /ratings
  # POST /ratings.json
  def create
    @rating = @relate_object.ratings.new(rating_params.merge(rater_id: current_user.id))

    @rating.save!
  end


  private
    def set_relate_object
      @relate_object = params[:ratee_type].strip.classify.constantize.find_by(id: params[:ratee_id])

      tip_exception("未发现id为#{params[:ratee_id]}的评分对象") if @relate_object.blank?
      check_user_access!
    end

    def check_create_params
      tip_exception("ratee_type参数有误.") unless RATE_TYPE.include?(params[:ratee_type]&.to_s&.downcase)
      tip_exception("确少ratee_id参数") if params[:ratee_id].blank?

    end

    def check_score
      tip_exception("评分只支持1-10分的整数值")  unless SCORES.include?(params[:score].to_i)
    end

    def check_user_access!
      return if current_user.admin_or_business? || @relate_object.project.all_collaborators.ids.include?(current_user.id)

      tip_exception('您暂时无权限')
    end

    # Only allow a list of trusted parameters through.
    def rating_params
      params.require(:rating).permit(:score, :ratee_id)
    end
end