ruby-on-rails-3 - CanCan不能授权嵌套资源

Question

我有一个 Ticket 模型和一个 TicketReply 模型:

class Ticket < ActiveRecord::Base
  has_many :replies, :class_name => "TicketReply"
end

class TicketReply < ActiveRecord::Base
  belongs_to :ticket, :class_name => "Ticket"
end

这是我的能力列表:

class Ability
  include CanCan::Ability

  def initialize(user)    
    can :manage, Ticket,      :userid => user.id
    can :manage, TicketReply, :ticket => { :userid => user.id }
  end
end

最后是我的 TicketRepliesController:

class TicketRepliesController < AuthorizedController
  load_and_authorize_resource :ticket
  load_and_authorize_resource :ticket_reply, :through => :ticket

  def create
    if @ticket_reply.valid?
      # ...
    else
     # ...
    end
  end
end

但是，每次我尝试创建票证回复时，都会收到一条未经授权的消息:“您无权访问此页面。”。

编辑 : 我可以访问 Ticket本身很好通过 TicketsController .

知道我缺少什么吗？

Answer 1

在 Controller new 和 create Action 中，您需要将您的新工单记录与 current_user 连接起来

class TicketRepliesController < AuthorizedController
  ... whatever code you have

  protected

  # override to do the wireing
  def build_resource
    resource = super
    resource.userid = current_user.id # wired!
    resource
  end
end

现在 CanCan 将看到链接并允许!