1

My application uses Devise for authentication, CanCanCan for authorization, and RailsAdmin for admin. Currently there are users who are considered "admins" and they can access anything in the application, and there are a couple other types of users who are basically flavors of admins with slightly fewer privileges, all defined in the Ability.rb file.

However, now I need to implement company-level permissions for users. Right now admins have access to any company in the application. Going forward, I need to add the ability for an owner of a company to add/invite a user to their company and give them certain permissions. That user can also potentially belong to other companies in the application with different permissions.

Is this something CanCanCan "can" do? Or is this a job for Pundit? Something else entirely?

All of the tutorials and documentation I see online for CCC and Pundit involve application-wide permissions. But I need more granular control.

For example, my application has hundreds of companies. Each company has a user who is an "owner" and they login each day to look at their earnings information. That owner/user wants to invite Joe Smith to the application so they can also look at the data and make changes. But they don't want Joe Smith to be able to see certain types of data. So we restrict Joe Smith's access to certain data for that company.

This is separate entirely from what I currently use CanCanCan for, which is to set access rights for admins so an admin user can see ANY company's information and make changes globally.

I am curious to know if anyone has encountered this issue before and what they may have used to solve it. I greatly appreciate any advice/wisdom!

pixelcandy
  • 109
  • 6
  • Pretty much everything Pundit can do CanCanCan can also do and vice versa. The main difference is just that CanCanCan is built as a DSL and Pundit just uses OOP. CanCanCan is more approachable but tends to turn into a tangled mess when you need to handle more complex cases and the whole idea of jamming all your authorization logic into a single Ability class is not very good when comes to maintenance. – max Jan 08 '19 at 16:01

1 Answers1

0

Yes it's possible with CanCanCan. You can scope your permissions to specific company_id. Assuming that Admin model has company_id, you can write:

can :manage, Company, :id => admin.company_id
mrzasa
  • 22,895
  • 11
  • 56
  • 94
  • 1
    To add to this, next your users will likely want to manage multiple companies - so you could take the above and change the scope to a range like this `can :manage, Project, group: { id: user.group_ids }` https://github.com/CanCanCommunity/cancancan/wiki/Defining-Abilities – tgmerritt Jan 07 '19 at 22:15