From a7830deb00805b1d10d6d7ca4834a0505e0769db Mon Sep 17 00:00:00 2001
From: Mark Cottman-Fields <qut.bioacoustics.research+mark@gmail.com>
Date: Tue, 8 Jan 2013 17:45:09 +1000
Subject: [PATCH] Work done on server-side API. Removed all html rendering from
 controllers. Implemented CanCan for permissions. Have not yet written caned
 queries/scopes for permissions.

modified:   Gemfile.lock
modified:   app/assets/javascripts/angular/controllers/sites.js
modified:   app/assets/templates/projects_list.html

modified:   app/controllers/analysis_items_controller.rb
modified:   app/controllers/analysis_jobs_controller.rb
modified:   app/controllers/analysis_scripts_controller.rb
modified:   app/controllers/api/sessions_controller.rb
modified:   app/controllers/application_controller.rb
modified:   app/controllers/audio_events_controller.rb
modified:   app/controllers/audio_recordings_controller.rb
modified:   app/controllers/bookmarks_controller.rb
modified:   app/controllers/home_controller.rb
modified:   app/controllers/permissions_controller.rb
modified:   app/controllers/photos_controller.rb
modified:   app/controllers/progresses_controller.rb
modified:   app/controllers/projects_controller.rb
modified:   app/controllers/saved_searches_controller.rb
modified:   app/controllers/sites_controller.rb
modified:   app/controllers/tags_controller.rb
modified:   app/controllers/users_controller.rb
-- removed html rendering

modified:   app/models/ability.rb
-- added skeleton for checking database to get permissions.
modified:   app/models/permission.rb

modified:   config/initializers/devise.rb
-- added a custom FailureApp
new file:   lib/RestFailureApp.rb
-- added this to try to get rid of redirects to /security/sign_in
---
 .../javascripts/angular/controllers/sites.js  |  3 +-
 app/assets/templates/projects_list.html       |  2 +
 app/controllers/analysis_items_controller.rb  | 14 ++----
 app/controllers/analysis_jobs_controller.rb   | 14 ++----
 .../analysis_scripts_controller.rb            | 14 ++----
 app/controllers/api/sessions_controller.rb    |  2 +
 app/controllers/application_controller.rb     | 17 +++++--
 app/controllers/audio_events_controller.rb    | 13 ++----
 .../audio_recordings_controller.rb            | 14 ++----
 app/controllers/bookmarks_controller.rb       | 14 ++----
 app/controllers/home_controller.rb            |  3 ++
 app/controllers/permissions_controller.rb     | 30 ++++++-------
 app/controllers/photos_controller.rb          | 25 +++--------
 app/controllers/progresses_controller.rb      | 14 ++----
 app/controllers/projects_controller.rb        | 19 +++-----
 app/controllers/saved_searches_controller.rb  | 14 ++----
 app/controllers/sites_controller.rb           | 16 ++-----
 app/controllers/tags_controller.rb            | 14 ++----
 app/controllers/users_controller.rb           | 13 ++----
 app/models/ability.rb                         | 44 ++++++++++++++++++-
 app/models/permission.rb                      |  2 +
 lib/RestFailureApp.rb                         | 15 +++++++
 22 files changed, 141 insertions(+), 175 deletions(-)
 create mode 100644 lib/RestFailureApp.rb

diff --git a/app/assets/javascripts/angular/controllers/sites.js b/app/assets/javascripts/angular/controllers/sites.js
index 98f1261a..ffd6c649 100644
--- a/app/assets/javascripts/angular/controllers/sites.js
+++ b/app/assets/javascripts/angular/controllers/sites.js
@@ -38,8 +38,7 @@ function SiteCtrl($scope, $resource, $routeParams, Project, Site, AudioRecording
     $scope.delete = function() {
         var doit = confirm("Are you sure you want to delete this site (id {0})?".format(this.site.id));
         if (doit) {
-            siteResource.remove();
-
+            siteResource.remove(this.site.id, function(){ console.log('success')}, function(){ console.log('error')});
         }
     };
 
diff --git a/app/assets/templates/projects_list.html b/app/assets/templates/projects_list.html
index 64e95adc..aaa8bc9e 100644
--- a/app/assets/templates/projects_list.html
+++ b/app/assets/templates/projects_list.html
@@ -3,6 +3,8 @@ <h2>Projects</h2>
 
     <p>Projects are a collection of sites that have a common goal.</p>
 
+    <p><a href="/projects/new">new Project</a></p>
+
     <ul class="item-list">
         <li ng-repeat="project in projects">
             <div class="item-text">
diff --git a/app/controllers/analysis_items_controller.rb b/app/controllers/analysis_items_controller.rb
index a5c17b37..51351f7e 100644
--- a/app/controllers/analysis_items_controller.rb
+++ b/app/controllers/analysis_items_controller.rb
@@ -5,7 +5,6 @@ def index
     @analysis_items = AnalysisItem.all
 
     respond_to do |format|
-      format.html # index.html.erb
       format.json { render json: @analysis_items }
     end
   end
@@ -16,7 +15,6 @@ def show
     @analysis_item = AnalysisItem.find(params[:id])
 
     respond_to do |format|
-      format.html # show.html.erb
       format.json { render json: @analysis_item }
     end
   end
@@ -27,15 +25,14 @@ def new
     @analysis_item = AnalysisItem.new
 
     respond_to do |format|
-      format.html # new.html.erb
       format.json { render json: @analysis_item }
     end
   end
 
   # GET /analysis_items/1/edit
-  def edit
-    @analysis_item = AnalysisItem.find(params[:id])
-  end
+  #def edit
+  #  @analysis_item = AnalysisItem.find(params[:id])
+  #end
 
   # POST /analysis_items
   # POST /analysis_items.json
@@ -44,10 +41,8 @@ def create
 
     respond_to do |format|
       if @analysis_item.save
-        format.html { redirect_to @analysis_item, notice: 'Analysis item was successfully created.' }
         format.json { render json: @analysis_item, status: :created, location: @analysis_item }
       else
-        format.html { render action: "new" }
         format.json { render json: @analysis_item.errors, status: :unprocessable_entity }
       end
     end
@@ -60,10 +55,8 @@ def update
 
     respond_to do |format|
       if @analysis_item.update_attributes(params[:analysis_item])
-        format.html { redirect_to @analysis_item, notice: 'Analysis item was successfully updated.' }
         format.json { head :no_content }
       else
-        format.html { render action: "edit" }
         format.json { render json: @analysis_item.errors, status: :unprocessable_entity }
       end
     end
@@ -76,7 +69,6 @@ def destroy
     @analysis_item.destroy
 
     respond_to do |format|
-      format.html { redirect_to analysis_items_url }
       format.json { head :no_content }
     end
   end
diff --git a/app/controllers/analysis_jobs_controller.rb b/app/controllers/analysis_jobs_controller.rb
index 33dbedae..6c600c34 100644
--- a/app/controllers/analysis_jobs_controller.rb
+++ b/app/controllers/analysis_jobs_controller.rb
@@ -5,7 +5,6 @@ def index
     @analysis_jobs = AnalysisJob.all
 
     respond_to do |format|
-      format.html # index.html.erb
       format.json { render json: @analysis_jobs }
     end
   end
@@ -16,7 +15,6 @@ def show
     @analysis_job = AnalysisJob.find(params[:id])
 
     respond_to do |format|
-      format.html # show.html.erb
       format.json { render json: @analysis_job }
     end
   end
@@ -27,15 +25,14 @@ def new
     @analysis_job = AnalysisJob.new
 
     respond_to do |format|
-      format.html # new.html.erb
       format.json { render json: @analysis_job }
     end
   end
 
   # GET /analysis_jobs/1/edit
-  def edit
-    @analysis_job = AnalysisJob.find(params[:id])
-  end
+  #def edit
+  #  @analysis_job = AnalysisJob.find(params[:id])
+  #end
 
   # POST /analysis_jobs
   # POST /analysis_jobs.json
@@ -44,10 +41,8 @@ def create
 
     respond_to do |format|
       if @analysis_job.save
-        format.html { redirect_to @analysis_job, notice: 'Analysis job was successfully created.' }
         format.json { render json: @analysis_job, status: :created, location: @analysis_job }
       else
-        format.html { render action: "new" }
         format.json { render json: @analysis_job.errors, status: :unprocessable_entity }
       end
     end
@@ -60,10 +55,8 @@ def update
 
     respond_to do |format|
       if @analysis_job.update_attributes(params[:analysis_job])
-        format.html { redirect_to @analysis_job, notice: 'Analysis job was successfully updated.' }
         format.json { head :no_content }
       else
-        format.html { render action: "edit" }
         format.json { render json: @analysis_job.errors, status: :unprocessable_entity }
       end
     end
@@ -76,7 +69,6 @@ def destroy
     @analysis_job.destroy
 
     respond_to do |format|
-      format.html { redirect_to analysis_jobs_url }
       format.json { head :no_content }
     end
   end
diff --git a/app/controllers/analysis_scripts_controller.rb b/app/controllers/analysis_scripts_controller.rb
index 7a151fbb..251a440f 100644
--- a/app/controllers/analysis_scripts_controller.rb
+++ b/app/controllers/analysis_scripts_controller.rb
@@ -5,7 +5,6 @@ def index
     @analysis_scripts = AnalysisScript.all
 
     respond_to do |format|
-      format.html # index.html.erb
       format.json { render json: @analysis_scripts }
     end
   end
@@ -16,7 +15,6 @@ def show
     @analysis_script = AnalysisScript.find(params[:id])
 
     respond_to do |format|
-      format.html # show.html.erb
       format.json { render json: @analysis_script }
     end
   end
@@ -27,15 +25,14 @@ def new
     @analysis_script = AnalysisScript.new
 
     respond_to do |format|
-      format.html # new.html.erb
       format.json { render json: @analysis_script }
     end
   end
 
   # GET /analysis_scripts/1/edit
-  def edit
-    @analysis_script = AnalysisScript.find(params[:id])
-  end
+  #def edit
+  #  @analysis_script = AnalysisScript.find(params[:id])
+  #end
 
   # POST /analysis_scripts
   # POST /analysis_scripts.json
@@ -44,10 +41,8 @@ def create
 
     respond_to do |format|
       if @analysis_script.save
-        format.html { redirect_to @analysis_script, notice: 'Analysis script was successfully created.' }
         format.json { render json: @analysis_script, status: :created, location: @analysis_script }
       else
-        format.html { render action: "new" }
         format.json { render json: @analysis_script.errors, status: :unprocessable_entity }
       end
     end
@@ -60,10 +55,8 @@ def update
 
     respond_to do |format|
       if @analysis_script.update_attributes(params[:analysis_script])
-        format.html { redirect_to @analysis_script, notice: 'Analysis script was successfully updated.' }
         format.json { head :no_content }
       else
-        format.html { render action: "edit" }
         format.json { render json: @analysis_script.errors, status: :unprocessable_entity }
       end
     end
@@ -76,7 +69,6 @@ def destroy
     @analysis_script.destroy
 
     respond_to do |format|
-      format.html { redirect_to analysis_scripts_url }
       format.json { head :no_content }
     end
   end
diff --git a/app/controllers/api/sessions_controller.rb b/app/controllers/api/sessions_controller.rb
index 76315942..ce632778 100644
--- a/app/controllers/api/sessions_controller.rb
+++ b/app/controllers/api/sessions_controller.rb
@@ -1,4 +1,6 @@
 class Api::SessionsController < Devise::SessionsController
+  skip_authorization_check :only => [:ping]
+
 
 =begin
   e.g.
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index d0efaf29..f1f2b4eb 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -2,14 +2,23 @@ class ApplicationController < ActionController::Base
   before_filter :authenticate_user!
   protect_from_forgery
 
-  # CanCan permisisons
-  # https://github.com/ryanb/cancan
-  #check_authorization
+  ## CanCan permisisons
+  ## https://github.com/ryanb/cancan
+
+  ##Automatically does the following:
+  ##@product = Product.find(params[:id])
+  ##authorize! :discontinue, @product
+  ## ----------------------------------
+
+  #check_authorization :unless => :devise_controller?
+  #load_and_authorize_resource  :unless => :devise_controller?
   rescue_from CanCan::AccessDenied do |exception|
-    #redirect_to root_url, :alert => exception.message
+    ##redirect_to root_url, :alert => exception.message
     render :json => Api::SessionsController.forbidden_info(current_user).to_json, :status => :forbidden
   end
 
+  # end CanCan permissions
+
   # userstamp
   include Userstamp
 
diff --git a/app/controllers/audio_events_controller.rb b/app/controllers/audio_events_controller.rb
index 051e5a73..633a0d12 100644
--- a/app/controllers/audio_events_controller.rb
+++ b/app/controllers/audio_events_controller.rb
@@ -53,7 +53,6 @@ def show
     @audio_event = AudioEvent.includes(:audio_event_tags).find(params[:id])
 
     respond_to do |format|
-      format.html # show.html.erb
       format.json { render json: @audio_event }
     end
   end
@@ -64,16 +63,15 @@ def new
     @audio_event = AudioEvent.new
 
     respond_to do |format|
-      format.html # new.html.erb
       format.json { render json: @audio_event }
     end
   end
 
   # GET /audio_events/1/edit
-  def edit
-    @audio_event =
-        AudioEvent.find(params[:id]).include(:audio_event_tags)
-  end
+  #def edit
+  #  @audio_event =
+  #      AudioEvent.find(params[:id]).include(:audio_event_tags)
+  #end
 
   # POST /audio_events
   # POST /audio_events.json
@@ -102,10 +100,8 @@ def update
 
     respond_to do |format|
       if @audio_event.update_attributes(params[:audio_event])
-        format.html { redirect_to @audio_event, notice: 'Audio event was successfully updated.' }
         format.json { head :no_content }
       else
-        format.html { render action: "edit" }
         format.json { render json: @audio_event.errors, status: :unprocessable_entity }
       end
     end
@@ -118,7 +114,6 @@ def destroy
     @audio_event.destroy
 
     respond_to do |format|
-      format.html { redirect_to audio_events_url }
       format.json { head :no_content }
     end
   end
diff --git a/app/controllers/audio_recordings_controller.rb b/app/controllers/audio_recordings_controller.rb
index 13e65cf3..dded65a0 100644
--- a/app/controllers/audio_recordings_controller.rb
+++ b/app/controllers/audio_recordings_controller.rb
@@ -5,7 +5,6 @@ def index
     @audio_recordings = AudioRecording.all
 
     respond_to do |format|
-      format.html # index.html.erb
       format.json { render json: @audio_recordings }
     end
   end
@@ -16,7 +15,6 @@ def show
     @audio_recording = AudioRecording.find(params[:id])
 
     respond_to do |format|
-      format.html # show.html.erb
       format.json { render json: @audio_recording }
     end
   end
@@ -27,15 +25,14 @@ def new
     @audio_recording = AudioRecording.new
 
     respond_to do |format|
-      format.html # new.html.erb
       format.json { render json: @audio_recording }
     end
   end
 
   # GET /audio_recordings/1/edit
-  def edit
-    @audio_recording = AudioRecording.find(params[:id])
-  end
+  #def edit
+  #  @audio_recording = AudioRecording.find(params[:id])
+  #end
 
   # POST /audio_recordings
   # POST /audio_recordings.json
@@ -44,10 +41,8 @@ def create
 
     respond_to do |format|
       if @audio_recording.save
-        format.html { redirect_to @audio_recording, notice: 'Audio recording was successfully created.' }
         format.json { render json: @audio_recording, status: :created, location: @audio_recording }
       else
-        format.html { render action: "new" }
         format.json { render json: @audio_recording.errors, status: :unprocessable_entity }
       end
     end
@@ -60,10 +55,8 @@ def update
 
     respond_to do |format|
       if @audio_recording.update_attributes(params[:audio_recording])
-        format.html { redirect_to @audio_recording, notice: 'Audio recording was successfully updated.' }
         format.json { head :no_content }
       else
-        format.html { render action: "edit" }
         format.json { render json: @audio_recording.errors, status: :unprocessable_entity }
       end
     end
@@ -76,7 +69,6 @@ def destroy
     @audio_recording.destroy
 
     respond_to do |format|
-      format.html { redirect_to audio_recordings_url }
       format.json { head :no_content }
     end
   end
diff --git a/app/controllers/bookmarks_controller.rb b/app/controllers/bookmarks_controller.rb
index c249a308..33509b5d 100644
--- a/app/controllers/bookmarks_controller.rb
+++ b/app/controllers/bookmarks_controller.rb
@@ -5,7 +5,6 @@ def index
     @bookmarks = Bookmark.all
 
     respond_to do |format|
-      format.html # index.html.erb
       format.json { render json: @bookmarks }
     end
   end
@@ -16,7 +15,6 @@ def show
     @bookmark = Bookmark.find(params[:id])
 
     respond_to do |format|
-      format.html # show.html.erb
       format.json { render json: @bookmark }
     end
   end
@@ -27,15 +25,14 @@ def new
     @bookmark = Bookmark.new
 
     respond_to do |format|
-      format.html # new.html.erb
       format.json { render json: @bookmark }
     end
   end
 
   # GET /bookmarks/1/edit
-  def edit
-    @bookmark = Bookmark.find(params[:id])
-  end
+  #def edit
+  #  @bookmark = Bookmark.find(params[:id])
+  #end
 
   # POST /bookmarks
   # POST /bookmarks.json
@@ -44,10 +41,8 @@ def create
 
     respond_to do |format|
       if @bookmark.save
-        format.html { redirect_to @bookmark, notice: 'Bookmark was successfully created.' }
         format.json { render json: @bookmark, status: :created, location: @bookmark }
       else
-        format.html { render action: "new" }
         format.json { render json: @bookmark.errors, status: :unprocessable_entity }
       end
     end
@@ -60,10 +55,8 @@ def update
 
     respond_to do |format|
       if @bookmark.update_attributes(params[:bookmark])
-        format.html { redirect_to @bookmark, notice: 'Bookmark was successfully updated.' }
         format.json { head :no_content }
       else
-        format.html { render action: "edit" }
         format.json { render json: @bookmark.errors, status: :unprocessable_entity }
       end
     end
@@ -76,7 +69,6 @@ def destroy
     @bookmark.destroy
 
     respond_to do |format|
-      format.html { redirect_to bookmarks_url }
       format.json { head :no_content }
     end
   end
diff --git a/app/controllers/home_controller.rb b/app/controllers/home_controller.rb
index 149c96ee..46410f24 100644
--- a/app/controllers/home_controller.rb
+++ b/app/controllers/home_controller.rb
@@ -1,6 +1,9 @@
 class HomeController < ApplicationController
   skip_before_filter :authenticate_user!
   skip_authorization_check :only => [:index]
+  skip_authorize_resource :only => [:index]
+  skip_load_resource :only => [:index]
+
   def index
 
 
diff --git a/app/controllers/permissions_controller.rb b/app/controllers/permissions_controller.rb
index 7db5715d..8870795b 100644
--- a/app/controllers/permissions_controller.rb
+++ b/app/controllers/permissions_controller.rb
@@ -5,7 +5,6 @@ def index
     @permissions = Permission.all
 
     respond_to do |format|
-      format.html # index.html.erb
       format.json { render json: @permissions }
     end
   end
@@ -16,7 +15,6 @@ def show
     @permission = Permission.find(params[:id])
 
     respond_to do |format|
-      format.html # show.html.erb
       format.json { render json: @permission }
     end
   end
@@ -27,15 +25,14 @@ def new
     @permission = Permission.new
 
     respond_to do |format|
-      format.html # new.html.erb
       format.json { render json: @permission }
     end
   end
 
   # GET /permissions/1/edit
-  def edit
-    @permission = Permission.find(params[:id])
-  end
+  #def edit
+  #  @permission = Permission.find(params[:id])
+  #end
 
   # POST /permissions
   # POST /permissions.json
@@ -44,10 +41,8 @@ def create
 
     respond_to do |format|
       if @permission.save
-        format.html { redirect_to @permission, notice: 'Permission was successfully created.' }
         format.json { render json: @permission, status: :created, location: @permission }
       else
-        format.html { render action: "new" }
         format.json { render json: @permission.errors, status: :unprocessable_entity }
       end
     end
@@ -56,16 +51,18 @@ def create
   # PUT /permissions/1
   # PUT /permissions/1.json
   def update
-    @permission = Permission.find(params[:id])
+    #@permission = Permission.find(params[:id])
+    #
+    #respond_to do |format|
+    #  if @permission.update_attributes(params[:permission])
+    #    format.json { head :no_content }
+    #  else
+    #    format.json { render json: @permission.errors, status: :unprocessable_entity }
+    #  end
+    #end
 
     respond_to do |format|
-      if @permission.update_attributes(params[:permission])
-        format.html { redirect_to @permission, notice: 'Permission was successfully updated.' }
-        format.json { head :no_content }
-      else
-        format.html { render action: "edit" }
-        format.json { render json: @permission.errors, status: :unprocessable_entity }
-      end
+      format.json { head :bad_request }
     end
   end
 
@@ -76,7 +73,6 @@ def destroy
     @permission.destroy
 
     respond_to do |format|
-      format.html { redirect_to permissions_url }
       format.json { head :no_content }
     end
   end
diff --git a/app/controllers/photos_controller.rb b/app/controllers/photos_controller.rb
index a4918aa6..cbf8f450 100644
--- a/app/controllers/photos_controller.rb
+++ b/app/controllers/photos_controller.rb
@@ -5,7 +5,6 @@ def index
     @photos = Photo.all
 
     respond_to do |format|
-      format.html # index.html.erb
       format.json { render json: @photos }
     end
   end
@@ -16,7 +15,6 @@ def show
     @photo = Photo.find(params[:id])
 
     respond_to do |format|
-      format.html # show.html.erb
       format.json { render json: @photo }
     end
   end
@@ -25,23 +23,19 @@ def show
   # GET /photos/new.json
   def new
     @photo = Photo.new
-	
-	@all_sites = Site.all
-	@all_projects = Project.all
-	
+
     respond_to do |format|
-      format.html # new.html.erb
       format.json { render json: @photo }
     end
   end
 
   # GET /photos/1/edit
-  def edit
-    @photo = Photo.find(params[:id])
-	
-	@all_sites = Site.all
-	@all_projects = Project.all
-  end
+  #def edit
+  #  @photo = Photo.find(params[:id])
+  #
+  #@all_sites = Site.all
+  #@all_projects = Project.all
+  #end
 
   # POST /photos
   # POST /photos.json
@@ -50,10 +44,8 @@ def create
 
     respond_to do |format|
       if @photo.save
-        format.html { redirect_to @photo, notice: 'Photo was successfully created.' }
         format.json { render json: @photo, status: :created, location: @photo }
       else
-        format.html { render action: "new" }
         format.json { render json: @photo.errors, status: :unprocessable_entity }
       end
     end
@@ -66,10 +58,8 @@ def update
 
     respond_to do |format|
       if @photo.update_attributes(params[:photo])
-        format.html { redirect_to @photo, notice: 'Photo was successfully updated.' }
         format.json { head :no_content }
       else
-        format.html { render action: "edit" }
         format.json { render json: @photo.errors, status: :unprocessable_entity }
       end
     end
@@ -82,7 +72,6 @@ def destroy
     @photo.destroy
 
     respond_to do |format|
-      format.html { redirect_to photos_url }
       format.json { head :no_content }
     end
   end
diff --git a/app/controllers/progresses_controller.rb b/app/controllers/progresses_controller.rb
index 4ebd295f..dee36ad3 100644
--- a/app/controllers/progresses_controller.rb
+++ b/app/controllers/progresses_controller.rb
@@ -5,7 +5,6 @@ def index
     @progresses = Progress.all
 
     respond_to do |format|
-      format.html # index.html.erb
       format.json { render json: @progresses }
     end
   end
@@ -16,7 +15,6 @@ def show
     @progress = Progress.find(params[:id])
 
     respond_to do |format|
-      format.html # show.html.erb
       format.json { render json: @progress }
     end
   end
@@ -27,15 +25,14 @@ def new
     @progress = Progress.new
 
     respond_to do |format|
-      format.html # new.html.erb
       format.json { render json: @progress }
     end
   end
 
   # GET /progresses/1/edit
-  def edit
-    @progress = Progress.find(params[:id])
-  end
+  #def edit
+  #  @progress = Progress.find(params[:id])
+  #end
 
   # POST /progresses
   # POST /progresses.json
@@ -44,10 +41,8 @@ def create
 
     respond_to do |format|
       if @progress.save
-        format.html { redirect_to @progress, notice: 'Progress was successfully created.' }
         format.json { render json: @progress, status: :created, location: @progress }
       else
-        format.html { render action: "new" }
         format.json { render json: @progress.errors, status: :unprocessable_entity }
       end
     end
@@ -60,10 +55,8 @@ def update
 
     respond_to do |format|
       if @progress.update_attributes(params[:progress])
-        format.html { redirect_to @progress, notice: 'Progress was successfully updated.' }
         format.json { head :no_content }
       else
-        format.html { render action: "edit" }
         format.json { render json: @progress.errors, status: :unprocessable_entity }
       end
     end
@@ -76,7 +69,6 @@ def destroy
     @progress.destroy
 
     respond_to do |format|
-      format.html { redirect_to progresses_url }
       format.json { head :no_content }
     end
   end
diff --git a/app/controllers/projects_controller.rb b/app/controllers/projects_controller.rb
index aeff0704..64d112b7 100644
--- a/app/controllers/projects_controller.rb
+++ b/app/controllers/projects_controller.rb
@@ -1,12 +1,12 @@
 class ProjectsController < ApplicationController
 
+
   # GET /projects
   # GET /projects.json
   def index
     @projects = Project.all
 
     respond_to do |format|
-      format.html # index.html.erb
       format.json { render json: @projects }
     end
   end
@@ -17,7 +17,6 @@ def show
     @project = Project.find(params[:id])
 
     respond_to do |format|
-      format.html # show.html.erb
       format.json { render json: @project }
     end
   end
@@ -27,19 +26,18 @@ def show
   def new
     @project = Project.new
     @project.sites.build
-    @all_sites = Site.all
+    #@all_sites = Site.all
 
     respond_to do |format|
-      format.html # new.html.erb
       format.json { render json: @project }
     end
   end
 
   # GET /projects/1/edit
-  def edit
-    @project = Project.find(params[:id])
-	@all_sites = Site.all
-  end
+  #def edit
+  #  @project = Project.find(params[:id])
+  #@all_sites = Site.all
+  #end
 
   # POST /projects
   # POST /projects.json
@@ -48,10 +46,8 @@ def create
 
     respond_to do |format|
       if @project.save
-        format.html { redirect_to @project, notice: 'Project was successfully created.' }
         format.json { render json: @project, status: :created, location: @project }
       else
-        format.html { render action: "new" }
         format.json { render json: @project.errors, status: :unprocessable_entity }
       end
     end
@@ -69,10 +65,8 @@ def update
 	
     respond_to do |format|
       if @project.update_attributes(params[:project])
-        format.html { redirect_to @project, notice: 'Project was successfully updated.' }
         format.json { head :no_content }
       else
-        format.html { render action: "edit" }
         format.json { render json: @project.errors, status: :unprocessable_entity }
       end
     end
@@ -85,7 +79,6 @@ def destroy
     @project.destroy
 
     respond_to do |format|
-      format.html { redirect_to projects_url }
       format.json { head :no_content }
     end
   end
diff --git a/app/controllers/saved_searches_controller.rb b/app/controllers/saved_searches_controller.rb
index 0a14efa0..457b1d60 100644
--- a/app/controllers/saved_searches_controller.rb
+++ b/app/controllers/saved_searches_controller.rb
@@ -5,7 +5,6 @@ def index
     @saved_searches = SavedSearch.all
 
     respond_to do |format|
-      format.html # index.html.erb
       format.json { render json: @saved_searches }
     end
   end
@@ -16,7 +15,6 @@ def show
     @saved_search = SavedSearch.find(params[:id])
 
     respond_to do |format|
-      format.html # show.html.erb
       format.json { render json: @saved_search }
     end
   end
@@ -27,15 +25,14 @@ def new
     @saved_search = SavedSearch.new
 
     respond_to do |format|
-      format.html # new.html.erb
       format.json { render json: @saved_search }
     end
   end
 
   # GET /saved_searches/1/edit
-  def edit
-    @saved_search = SavedSearch.find(params[:id])
-  end
+  #def edit
+  #  @saved_search = SavedSearch.find(params[:id])
+  #end
 
   # POST /saved_searches
   # POST /saved_searches.json
@@ -44,10 +41,8 @@ def create
 
     respond_to do |format|
       if @saved_search.save
-        format.html { redirect_to @saved_search, notice: 'Saved search was successfully created.' }
         format.json { render json: @saved_search, status: :created, location: @saved_search }
       else
-        format.html { render action: "new" }
         format.json { render json: @saved_search.errors, status: :unprocessable_entity }
       end
     end
@@ -60,10 +55,8 @@ def update
 
     respond_to do |format|
       if @saved_search.update_attributes(params[:saved_search])
-        format.html { redirect_to @saved_search, notice: 'Saved search was successfully updated.' }
         format.json { head :no_content }
       else
-        format.html { render action: "edit" }
         format.json { render json: @saved_search.errors, status: :unprocessable_entity }
       end
     end
@@ -76,7 +69,6 @@ def destroy
     @saved_search.destroy
 
     respond_to do |format|
-      format.html { redirect_to saved_searches_url }
       format.json { head :no_content }
     end
   end
diff --git a/app/controllers/sites_controller.rb b/app/controllers/sites_controller.rb
index 43f2a235..c74def91 100644
--- a/app/controllers/sites_controller.rb
+++ b/app/controllers/sites_controller.rb
@@ -5,7 +5,6 @@ def index
     @sites = Site.all
 
     respond_to do |format|
-      format.html # index.html.erb
       format.json { render json: @sites }
     end
   end
@@ -13,10 +12,9 @@ def index
   # GET /sites/1
   # GET /sites/1.json
   def show
-    @site =Site.find(params[:id])
+    @site = Site.find(params[:id])
 
     respond_to do |format|
-      format.html # show.html.erb
       format.json { render json: @site }
     end
   end
@@ -27,15 +25,14 @@ def new
     @site = Site.new
 
     respond_to do |format|
-      format.html # new.html.erb
       format.json { render json: @site }
     end
   end
 
   # GET /sites/1/edit
-  def edit
-    @site = Site.find(params[:id])
-  end
+  #def edit
+  #  @site = Site.find(params[:id])
+  #end
 
   # POST /sites
   # POST /sites.json
@@ -44,10 +41,8 @@ def create
 
     respond_to do |format|
       if @site.save
-        format.html { redirect_to @site, notice: 'Site was successfully created.' }
         format.json { render json: @site, status: :created, location: @site }
       else
-        format.html { render action: "new" }
         format.json { render json: @site.errors, status: :unprocessable_entity }
       end
     end
@@ -60,10 +55,8 @@ def update
 
     respond_to do |format|
       if @site.update_attributes(params[:site])
-        format.html { redirect_to @site, notice: 'Site was successfully updated.' }
         format.json { head :no_content }
       else
-        format.html { render action: "edit" }
         format.json { render json: @site.errors, status: :unprocessable_entity }
       end
     end
@@ -76,7 +69,6 @@ def destroy
     @site.destroy
 
     respond_to do |format|
-      format.html { redirect_to sites_url }
       format.json { head :no_content }
     end
   end
diff --git a/app/controllers/tags_controller.rb b/app/controllers/tags_controller.rb
index d142ed99..5a066b3e 100644
--- a/app/controllers/tags_controller.rb
+++ b/app/controllers/tags_controller.rb
@@ -5,7 +5,6 @@ def index
     @tags = Tag.all
 
     respond_to do |format|
-      format.html # index.html.erb
       format.json { render json: @tags }
     end
   end
@@ -16,7 +15,6 @@ def show
     @tag = Tag.find(params[:id])
 
     respond_to do |format|
-      format.html # show.html.erb
       format.json { render json: @tag }
     end
   end
@@ -27,15 +25,14 @@ def new
     @tag = Tag.new
 
     respond_to do |format|
-      format.html # new.html.erb
       format.json { render json: @tag }
     end
   end
 
   # GET /tags/1/edit
-  def edit
-    @tag = Tag.find(params[:id])
-  end
+  #def edit
+  #  @tag = Tag.find(params[:id])
+  #end
 
   # POST /tags
   # POST /tags.json
@@ -44,10 +41,8 @@ def create
 
     respond_to do |format|
       if @tag.save
-        format.html { redirect_to @tag, notice: 'Tag was successfully created.' }
         format.json { render json: @tag, status: :created, location: @tag }
       else
-        format.html { render action: "new" }
         format.json { render json: @tag.errors, status: :unprocessable_entity }
       end
     end
@@ -60,10 +55,8 @@ def update
 
     respond_to do |format|
       if @tag.update_attributes(params[:tag])
-        format.html { redirect_to @tag, notice: 'Tag was successfully updated.' }
         format.json { head :no_content }
       else
-        format.html { render action: "edit" }
         format.json { render json: @tag.errors, status: :unprocessable_entity }
       end
     end
@@ -76,7 +69,6 @@ def destroy
     @tag.destroy
 
     respond_to do |format|
-      format.html { redirect_to tags_url }
       format.json { head :no_content }
     end
   end
diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index dcf538d3..407b3f7b 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -5,7 +5,6 @@ def index
     @users = User.all
 
     respond_to do |format|
-      format.html # index.html.erb
       format.json { render json: @users }
     end
   end
@@ -16,7 +15,6 @@ def show
     @user = User.find(params[:id])
 
     respond_to do |format|
-      format.html # show.html.erb
       format.json { render json: @user }
     end
   end
@@ -27,15 +25,14 @@ def new
     @user = User.new
 
     respond_to do |format|
-      format.html # new.html.erb
       format.json { render json: @user }
     end
   end
 
   # GET /users/1/edit
-  def edit
-    @user = User.find(params[:id])
-  end
+  #def edit
+  #  @user = User.find(params[:id])
+  #end
 
   # POST /users
   # POST /users.json
@@ -44,10 +41,8 @@ def create
 
     respond_to do |format|
       if @user.save
-        format.html { redirect_to @user, notice: 'User was successfully created.' }
         format.json { render json: @user, status: :created, location: @user }
       else
-        format.html { render action: "new" }
         format.json { render json: @user.errors, status: :unprocessable_entity }
       end
     end
@@ -60,10 +55,8 @@ def update
 
     respond_to do |format|
       if @user.update_attributes(params[:user])
-        format.html { redirect_to @user, notice: 'User was successfully updated.' }
         format.json { head :no_content }
       else
-        format.html { render action: "edit" }
         format.json { render json: @user.errors, status: :unprocessable_entity }
       end
     end
diff --git a/app/models/ability.rb b/app/models/ability.rb
index 5ff4ec54..8a5638d7 100644
--- a/app/models/ability.rb
+++ b/app/models/ability.rb
@@ -1,13 +1,53 @@
 class Ability
   include CanCan::Ability
 
+  allowed_permission_types = %w(Project)
+
   def initialize(user)
 
-    a = user
+    # The can method is used to define permissions and requires two arguments.
+    # The first one is the action you're setting the permission for, the second one
+    # is the class of object you're setting it on.
+
+
+
+    user ||= User.new # guest user (not logged in)
+    if user.admin?
+      can :manage, :all
+    else
+      # https://github.com/ryanb/cancan/wiki/Abilities-in-Database
+      can do |level, permissionable_type, permissionable_item|
+        user.permissions.find_all_by_level(aliases_for_action(level)).any? do |permission|
+
+          permission_type = permissionable_type.to_s
+
+          if user.id.blank?
+            # I think this will catch guest users
+          end
+
+          if permission_type != 'Project'
+            # use the Permission model to find the applicable Project id permission to use
+
+            permission_type = 'Project'
+          end
+
+          types_match = permission.permissionable_type == permissionable_type.to_s
+
+          id_missing = permissionable_item.blank? || permission.permissionable_id.blank?
+          ids_match = id_missing ? true : permission.permissionable_id == permissionable_item.id
+
+          #permission.permissionable_type == permissionable_type.to_s &&
+          #    (permissionable_id.blank? || permission.permissionable_id.nil? || permission.permissionable_id == permissionable_id.id)
+
+          types_match && ids_match
+        end
+      end
+    end
+
 
     # Define abilities for the passed in user here. For example:
     #
-    #   user ||= User.new # guest user (not logged in)
+    #
     #   if user.admin?
     #     can :manage, :all
     #   else
diff --git a/app/models/permission.rb b/app/models/permission.rb
index 9b603833..63b0fe0e 100644
--- a/app/models/permission.rb
+++ b/app/models/permission.rb
@@ -36,4 +36,6 @@ def anonymous?
     self.user.nil?
   end
 
+  # scopes
+
 end
diff --git a/lib/RestFailureApp.rb b/lib/RestFailureApp.rb
new file mode 100644
index 00000000..3e3adb22
--- /dev/null
+++ b/lib/RestFailureApp.rb
@@ -0,0 +1,15 @@
+class RestFailureApp < Devise::FailureApp
+  def respond
+    if request.format
+      json_failure
+    else
+      super
+    end
+  end
+
+  def json_failure
+    self.status = 401
+    self.content_type = 'application/json'
+    self.response_body = "{'error' : 'authentication error'}"
+  end
+end
\ No newline at end of file