Geek asks and answers

Inherited Resources and CanCan 3 Nesting Levels

I have a problem with 3 levels of nesting models in CanCan in combination with Inherited Resources. I read that we should nest everything up to two levels, but I had to put everything under the model account, and now I tried to do it in CanCan:

load_and_authorize_resource :account
load_and_authorize_resource :project, :through => :account
load_and_authorize_resource :model, :through => :project

This gives me the @account variable, which has the @project value, for example, it rewrites this. @project is what it should be, and @model too. Is this a mistake of mine, CanCan's, Inherited Resources, or just CanCan does not support 3 levels of nesting? Also, I am doing this in IR for ModelController.

belongs_to :account, :finder => :find_by_name! do
  belongs_to :project, :finder => :find_by_name!
end

Another weird thing is when I remove a part load_and_from the CanCan definition. It works then, but I read that it can be dangerous not to use the part load.

Is it possible to use only, authorize_resourceor should I do something with CanCan?

+3
source share
1 answer

Your authority was correct, as far as I can tell.

CanCan developer gem ryan posted what it should look like: https://github.com/ryanb/cancan/issues/127#issuecomment-364475

It means your

load_and_authorize_resource :account
load_and_authorize_resource :project, :through => :account
load_and_authorize_resource :model, :through => :project

will end in such a block (here: create an action. For other actions, there must be the last permission and @model change):

@account = Account.find(params[:account_id])
authorize! :read, @account
@project = @account.projects.find(params[:project_id])
authorize! :read, @project
@model = @project.models.build
authorize! :new, @model

I hope this answer can help developers look for cancan nested authorization :-).

source: https://github.com/ryanb/cancan/issues/127#issuecomment-364475

ps: incorrect behavior for / accounts / 1 / projects / 2 / models / new:

load_and_authorize_resource :project
load_and_authorize_resource :model, :through => :project

,

@project = Project.find(params [: project_id]) [...]

, '1'. , "2" "1".

+2

More articles:


All Articles