1 files changed, 18 insertions, 8 deletions
diff --git a/app/models/role.rb b/app/models/role.rb
index 3ca4f92a1..870bbe945 100644
--- a/app/models/role.rb
+++ b/app/models/role.rb
@@ -198,11 +198,14 @@ class Role < ApplicationRecord
   # action can be:
   # * a parameter-like Hash (eg. :controller => 'projects', :action => 'edit')
   # * a permission Symbol (eg. :edit_project)
-  def allowed_to?(action)
+  # scope can be:
+  # * an array of permissions which will be used as filter (logical AND)
+
+  def allowed_to?(action, scope=nil)
     if action.is_a? Hash
-      allowed_actions.include? "#{action[:controller]}/#{action[:action]}"
+      allowed_actions(scope).include? "#{action[:controller]}/#{action[:action]}"
     else
-      allowed_permissions.include? action
+      allowed_permissions(scope).include? action
     end
   end
 
@@ -298,13 +301,20 @@ class Role < ApplicationRecord
 
   private
 
-  def allowed_permissions
-    @allowed_permissions ||= permissions + Redmine::AccessControl.public_permissions.collect {|p| p.name}
+  def allowed_permissions(scope = nil)
+    scope = scope.sort if scope.present? # to maintain stable cache keys
+    @allowed_permissions ||= {}
+    @allowed_permissions[scope] ||= begin
+      unscoped = permissions + Redmine::AccessControl.public_permissions.collect {|p| p.name}
+      scope.present? ? unscoped & scope : unscoped
+    end
   end
 
-  def allowed_actions
-    @actions_allowed ||=
-      allowed_permissions.inject([]) do |actions, permission|
+  def allowed_actions(scope = nil)
+    scope = scope.sort if scope.present? # to maintain stable cache keys
+    @actions_allowed ||= {}
+    @actions_allowed[scope] ||=
+      allowed_permissions(scope).inject([]) do |actions, permission|
         actions += Redmine::AccessControl.allowed_actions(permission)
       end.flatten
   end