Comments (9)
authorize_action_for
and authorize_actions_for
are the controller methods that check permissions and redirect to 403 if an unauthorized action is being attempted. Are you using one or both of those? (You can refer to https://github.com/nathanl/authority#controllers and read the example controller code)
from authority.
Hmm no, how would i use this in an AdminController that gets inherited by all other namespaced admin controllers?
I dont have a resource or an instance in the AdminController but would like toapply a generic can?(:login_to_admin) function that gets checked there so that any namespaced controller that inherits from AdminController automatically gets this authorization applied.
Is this possible ?
from authority.
authorize_actions_for
can take the name of a method to call instead of a class.
For example, maybe in AdminController you can say: authorize_actions_for :admin_resource
and have the subclass controllers defined an admin_resource
method to return the class they work with.
from authority.
The problem is i want to authorize just the namespaced controllers, not the Model they work with. Meaning, /venues/show/3 is OK, but /admin/venues/shows/3 is NOT for certain roles.
Is there a way to just call a generic can? method from authorizes_actions_for ?
or is it better to use your method and do authorizes_actions_for :admin_access
and then
def admin_access
current_user.can?(:login_to_admin)
end
from authority.
another thought, i wonder if in the admin controllers (versus the normal ones) i could override the CRUD methods to use the adminable action so index => :admin, create => :admin, etc. This way every method would call adminable_by?(user)
from authority.
OK i think i found the easiest way, just one snag. I created a new ability called admin that is adminable
Then i can do something like this in the namespaced controllers
authority_actions :index => 'admin'
I am trying to do this globally but it doesnt work, only authority_actions :index => 'admin' works.
authorize_actions_for :admin_resource, :actions => {:index => :admin } doesnt work. Any ideas ?
from authority.
Hmmm. Two things:
- There's no reason why
authorize_actions_for
shouldn't be able to map controller actions ifauthority_actions
can, because that's what it calls: https://github.com/nathanl/authority/blob/master/lib/authority/controller.rb#L33 - Neither of these methods is global; they are both for the controller they're used in. For a global change, you'd need to change
config.authority_action_map
in yourconfig/initializers/authority.rb
.
from authority.
Yea i realized that after I posted. When putting authorized_actions_for in the admin_controller it didnt get executed b/c the controller class name didnt match via inheritance.
Not sure if there is an easier way, but I ended up just adding one line to each of the inherited controllers, dont see a way to do this globally, outside of allowing multiple authority_action_maps (maybe I will submit a patch !)
authorize_actions_for MyModel, :actions => {:index => 'admin', :show => 'admin', :new => 'admin', :create => 'admin', :edit => 'admin', :update => 'admin', :destroy => 'admin' }
Then in ApplicationAuthorizer just define adminable_by? and seems to work great.
Is this the best way ?
from authority.
Sorry for my slow response.
Yes, I think what you're doing is fine. The controller action map is not inherited, as you've seen; each controller copies the one from the configuration and modifies its own copy as you direct it to.
Short of making these changes inheritable somehow, you might DRY your code up a bit by defining a macro on your common parent controller:
def self.require_admin_for_standard_actions_on(model_name)
authorize_actions_for model_name, :actions => {:index => 'admin', :show => 'admin', :new => 'admin', :create => 'admin', :edit => 'admin', :update => 'admin', :destroy => 'admin' }
end
Then you could just do require_admin_for_standard_actions_on Widget
in the WidgetsController
.
from authority.
Related Issues (20)
- authorize_action_for: wrong number of arguments when using Sequel gem HOT 11
- How can I silence Authority.logger in test environment? HOT 6
- Should be usable outside of Rails
- controller action that involves data from multiple resources HOT 4
- Update authorization flow diagram HOT 1
- Issue with rails 4.2.5.1 HOT 2
- Is it possible to define multiple authorizers for a single method? HOT 2
- Allow custom opts in `authorize_actions_for`
- Log all authorization attempts? HOT 5
- Authorization with Rails Admin Gem HOT 3
- Could we use authority with active model serializer ? HOT 1
- Anyone have a good implementation of Authority with JSONAPI::Resources? HOT 1
- undefined method can for custom action HOT 2
- Controller action authorization not checked unless specifically adding authorize_actions_for HOT 3
- authority can method not working
- help with ensure_authorization_performed HOT 2
- Help with maintenance? HOT 10
- Instance level rules should rely on instance level default HOT 5
- The workflow for multiple controllers working with one model. HOT 2
- Use of :all_actions and :actions simultaneously HOT 4
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from authority.