Understanding Roles in Rails 3.2 with Rolify

Question

Is there any easy tutorial for roles? I found that Devise is great & easy solution for authorization. And then when it comes to Cancan with Rolify there's a confusion eclipse for beginners like me.

Currently I'm defining roles in ability.rb:

if user.has_role? :admin
  can :manage, :all
else
  can :read, :all
end

And then, in the controller, I'm checking like in this example:

def destroy
 ability = Ability.new(current_user)
 if ability.can? :delete, :all then
   @post = Post.find(params[:id])
   @post.destroy
 end

 respond_to do |format|
   ...
end

My question is - I have a strange feeling the check if ability.can? :delete, :all then is redundant in this example. So is my code ok or I really got it wrong? Thanks

DVG · Answer 1 · 2012-06-01T01:48:03.670

1

It would make more sense to check if they can delete the post in question. An admin may be able to delete anything, but a normal user would only delete content they own.

@post = Post.find(params[:id])
authorize! :delete, @post

I'd also suggest you spend some time reading cancan's documentation, as your code doesn't really match up.

edited Jun 01 '12 at 01:48

answered May 31 '12 at 23:38

DVG

17,392
7
61
88

@DVG But how can valk integrate Rolify with CanCan? – JJD Nov 28 '12 at 12:22

score 0 · Answer 2 · answered Dec 27 '12 at 06:54

I think your "destroy" method can be like:

def destroy
 @post = Post.find(params[:id])
 if can? :delete, @post then 
   @post.destroy
 end

 respond_to do |format|
   ...
end

Because in cancan's doc:

The current user’s permissions can then be checked using the can? and cannot? methods in the view and controller.

Understanding Roles in Rails 3.2 with Rolify

2 Answers2