0

I'm quite new to rails and I'm trying to setup an authorization system that allows me to control which attributes of a model can be modified by a user.

I use declarative_authorization for a role based authorization. This already provides me quite a lot of functionality: restrict what the user can see in the view depending on his roles, which actions he can perform in the controllers and basically also which actions he is allowed to do on the model.

However, I just can't find an answer on how to restrict the actions on specific attributes of a model depending on the role.

Example: A user that has a :guest role is allowed to update certain attributes of a user-account: When he tries to log in with a wrong password, I want to update a specific field of a user-account that will make this account inactive. The :guest role should however never be able to change the nickname of this user account.

I therefore use the "using_access_control" method in my user-model, but this either gives "update" privileges on an account for all attributes or no "update" privilege at all depending on the role.

I understand that "strong_parameters" is a gem that would basically make such functionality available but I have no clue on how to fit both "declarative_authorization" and "strong_parameters" together or how to do it simply with "declarative_authorization".

Can somebody point me to the solution?

Many thanks!

Kalumet
  • 81
  • 7

1 Answers1

-1
Authorization::Maintenance::without_access_control do
  # do something
end

I hope this was helpful.

delitecake
  • 11
  • 3