declarative_authorization的包含性和遺傳資源

我有安裝declarative_authorization和inherited_resources寶石Rails3中的應用。讓我告訴你，從我的應用程序的一些代碼：declarative_authorization的包含性和遺傳資源

class Blog < ActiveRecord::Base 
    has_many :posts 
    has_many :memberships, :class_name => "BlogMembership" 

    has_many :subscribers, :through => :memberships, :source => :user, :conditions => "blog_memberships.membership_type = #{BlogMembership::SUBSCRIBER} or blog_memberships.membership_type = #{BlogMembership::AUTHOR} or blog_memberships.membership_type = #{BlogMembership::MODERATOR}" 
    has_many :authors, :through => :memberships, :source => :user, :conditions => "blog_memberships.membership_type = #{BlogMembership::AUTHOR} or blog_memberships.membership_type = #{BlogMembership::MODERATOR}" 
    has_many :moderators, :through => :memberships, :source => :user, :conditions => "blog_memberships.membership_type = #{BlogMembership::MODERATOR}" 
end 


class Post < ActiveRecord::Base 
    belongs_to :blog, :counter_cache => true 
    belongs_to :author, :class_name => "User", :foreign_key => "user_id" 
end 


class BlogMembership < ActiveRecord::Base 
    belongs_to :user 
    belongs_to :blog 

    # Membership types: 
    SUBSCRIBER = 0 
    AUTHOR = 1 
    MODERATOR = 2 
end

我的授權規則：

authorization do 
    role :guest do 
    description "Not logged in users and users not assigned to any group" 

    ##### Blogs and Posts 
    has_permission_on :blogs, :to => [ :read, :list ] 

    has_permission_on :posts, :to => [ :read, :feed ] 
    has_permission_on :posts, :to => :flag if User.current 
    end 

    role :admin do 
    description "Administrators" 
    has_omnipotence # Can manage all 
    end 

    role :moderator do 
    description "Blog moderators" 

    includes [ :guest, :blogger ] 

    has_permission_on :posts, :to => :manage do 
     if_attribute :blog => { :moderators => contains { user } } 
    end 
    end 

    role :blogger do 
    description "Blog authors" 

    includes :guest 
    has_permission_on :posts, :to => :create do 
     if_attribute :blog => { :authors => contains { user } } 
    end 
    has_permission_on :posts, :to => :manage do 
     if_attribute :author => is { user } 
    end 
    end 
end 

privileges do 
    # default privilege hierarchies to facilitate RESTful Rails apps 
    privilege :manage, :includes => [:create, :read, :update, :delete] 
    privilege :read, :includes => [:index, :show] 
    privilege :create, :includes => :new 
    privilege :update, :includes => :edit 
    privilege :delete, :includes => :destroy 
end

在帖子

/index.html.haml我使用

- if permitted_to? :create, :posts 
    .button.add-post 
    = link_to "New post", new_resource_path

，並在我的posts_controller

class PostsController < InheritedResources::Base 
    respond_to :html 

    belongs_to :blog 
    filter_access_to :all 
end

看起來不錯，但確實ñ逾時工作:(

測試用戶有主持人與主持人對博客的一個成員的作用，但沒有第二個博客的任何成員。

隨着下面的規則，並與主持人角色的任何用戶代碼可以在任何博客創建帖子。

你能告訴我請 - 我需要改變只允許博客作者和主持人對他們的博客，但不發帖子到其他博客？

來源

2011-02-17 Alexey Poimtsev

不那麼優雅的方式，但我解決它與以下：

在posts_controller更改訪問過濾器：

filter_resource_access：nested_in =>：博客
添加方法Posts控制器

保護

DEF new_post_for_collection @post = Blog.find（PARAMS [：blog_id]）posts.new 端
變化index.html.haml
- 如果permitted_to。？：創建，@post .button.add-後 =的link_to 「新帖」，new_resource_path

來源

2011-02-21 21:09:30

declarative_authorization的包含性和遺傳資源

回答

相關問題