ruby-on-rails - CanCanCan 仅显示用户所属的模型实例

Question

我目前正在使用 设计、CanCan 和 Rolify 处理我的 rails 应用程序的身份验证和授权，我很难理解如何做到这一点，以便 user只能:show和 :update 的模型的特定实例用户 属于(也就是我的 user 有一个 client_id 列，而不是相反)。

我定义的更新部分 Abilities.rb为 user与 :client角色，工作正常，即如果 current_user.client_id = 3那么他只能更新一个客户端 Client.id = 3 ，但是，同一用户可以看到 Client 的任何实例模型，我似乎无法理解如何限制它。

Ability.rb

...
if user.has_role? :client
  can [:read, :update], [Property, Order], client_id: user.client_id
  can [:read, :update], Owner
  can :create, [Property, Order, Owner]
  can :manage, User, id: user.id
  can [:show, :update], Client, id: user.client_id
end
...

每个用户都没有 index所有 Clients ，所以经过研究我改变了 can [:read, :update], Client, ..至 :show但用户仍然可以看到另一个 clients但 :update如果它工作正常，那么我真的很茫然。过去几个小时一直在谷歌上搜索并通读了所有 CanCan 文档，我承认它可能已解决，但我无法弄清楚。

我试过从 Controller 端限制它，如下所示，但这也不起作用:

external/clients_controller.rb

class External::ClientsController < ApplicationController
  load_and_authorize_resource
  before_filter :client_only

  def index
    @clients = Client.paginate(page: params[:page], per_page: 15)
  end

  def show
    @clients = Client.find(params[:id])
    @client_users = User.where(client_id: params[:id])
    @client_orders = Order.where(client_id: params[:id]).includes(:property, :owners)
    can? :show, @clients
  end

  def edit
    @clients = Client.find(params[:id])
    respond_to do |format|
      format.html { @clients.save }
      format.js
    end
  end

  def update
    @clients = Client.find(params[:id])
    @clients.update_attributes(client_params)
    respond_to do |format|
      format.html { if @clients.save
                      flash[:success] = "Client Updated Successfully"
                      redirect_to client_path(@clients)
                    else
                      render 'edit'
                    end
      }
      format.js
    end
  end

  private

  def client_params
    params.require(:client).permit(:uuid, :company, :first_name, :last_name, :phone, :email, :address1, :address2, :city, :state, :zip, :notes)
  end

  def client_only
    redirect_to root_path unless current_user.is_client?
  end

end

因此，如果有人能帮助我完全理解 CanCan 如何处理模型实例的基于角色的授权，那么我将不胜感激。提前致谢!

更新代码

删除所有 @client实例加载于 external/clients_controller.rb

class External::ClientsController < ApplicationController
  load_and_authorize_resource
  before_filter :client_only

  def show
    @client_users = User.where(client_id: params[:id])
    @client_orders = Order.where(client_id: params[:id]).includes(:property, :owners).paginate(page: params[:page], per_page: 15).order("order_number DESC")
  end

  def edit
    respond_to do |format|
      format.html
      format.js
    end
  end

  def update
    if params[:client][:state].blank?
      params[:client][:state] = @client.try(:state)
    end
    @client.update_attributes(client_params)
    respond_to do |format|
      format.html { if @client.save
                      flash[:success] = "Client Updated Successfully"
                      redirect_to external_client_path(@client)
                    else
                      render 'edit'
                    end
      }
      format.js
    end
  end

  private

  def client_params
    params.require(:client).permit(:uuid, :company, :first_name, :last_name, :phone, :email, :address1, :address2, :city, :state, :zip, :notes)
  end

  def client_only
    redirect_to root_path unless current_user.is_client?
  end

end

全ability.rb

class Ability
  include CanCan::Ability

  def initialize(user)  
    alias_action :show, :to => :view
    alias_action :open_external_orders, :completed_external_orders, :to => :client_order_views

    user ||= User.new
    if user.has_role? :admin
      can :manage, :all
      can :assign_roles, User
    else
      can :read, :all
    end

    if user.has_role? :executive
      can :manage, [Property, Deed, Mortgage, Order, Owner, Client, AttachedAsset, User]
      cannot :assign_roles, User
    end

    if user.has_role? :management
      can :manage, [Property, Deed, Mortgage, Order, Owner, Client, AttachedAsset]
      can :read, User
      can :manage, User, id: user.id
      cannot :destroy, [Property, Order, Client, User]
    end

    if user.has_role? :analyst
      can :manage, [Property, Deed, Mortgage, Order, Owner, Client, AttachedAsset]
      can :manage, User, id: user.id
      cannot :destroy, [Property, Order, Client, User]
    end

    if user.has_role? :it
      can :manage, [Property, Deed, Mortgage, Order, Owner, Client, AttachedAsset]
      can :manage, User, id: user.id
      can :read, User
      cannot :destroy, [Property, Order, Client, User]
    end

    if user.has_role? :client
      can [:read, :update], Client, id: user.client_id
      can [:read, :update, :client_order_views], [Property, Order], client_id: user.client_id
      can [:read, :update], Owner
      can :create, [Property, Order, Owner]
      can :manage, User, id: user.id
    end
  end
end

Answer 1

CanCanCan 使用“增加权限”。
每条规则都可以增加前一条。

如果你写:

can :show, User
can :edit, User

这两个权限将被加入，您将能够显示和编辑用户。

在您的 ability.rb 中，您正在定义 can :read, :all您授予读取(显示和索引)所有对象的权限。

我建议你按照“增加权限”的概念来编写你的能力文件。这意味着您不会开始定义管理员的能力，而是在最后定义管理员需要的能力，添加到您已经提供给每个人的能力中。