Rails 4：如何使用户仅在自己的办公室中查看文件

Question

I am creating a file tracking system whereby users can track the movement from one office to another. I've gotten most of the application to work but presently every user can view all files regardless of where it's in their office, or not because in the file index.

I am using File.all in my file index action. Is there a way I can have a user only view and track files that is only currently in their own office, while the registry officer(admin) can view and track all files?

My relationships between models:

File model

class Nasfile < ActiveRecord::Base
  belongs_to :category
  has_many :trackers, dependent: :destroy


  before_save :file_full_number, :on => [:create, :update] 
    def file_full_number
        if self.file_sub.present?
            self.file_number = [self.file_number , self.file_sub].join('/')
        else
            self.file_number = self.file_number
        end
    end
end

Office Model

class Office < ActiveRecord::Base
  belongs_to :department

  has_many :users
  has_many :received_files,:class_name => 'Tracker', :foreign_key => 'office_sent_to_id'
  has_many :sent_files,:class_name => 'Tracker', :foreign_key => 'office_sent_from_id'


  def self.all_without(excluded)
    where("id NOT IN (?)", excluded)
  end
end

Tracker Model

class Tracker < ActiveRecord::Base
  belongs_to :nasfile

  belongs_to :sender, :foreign_key => :sender_id, class_name: 'User'
  belongs_to :receiver, :foreign_key => :receiver_id, class_name: 'User'
  belongs_to :office_receiving, :foreign_key => :office_sent_to_id, class_name: 'Office'
  belongs_to :office_sending, :foreign_key => :office_sent_from_id, class_name: 'Office'


  before_save :office_sent_to, :on => [:create, :update] 

    def office_sent_to      
        self.office_sent_to_id = self.receiver.office.id        
    end     

end

User model:

class User < ActiveRecord::Base
  # Include default devise modules. Others available are:
  # :confirmable, :lockable, :timeoutable and :omniauthable,:recoverable
  devise :database_authenticatable, :registerable,
         :rememberable, :trackable, :validatable,
         :authentication_keys => [:username], password_length: 6..25

  belongs_to :office
  accepts_nested_attributes_for :office

  has_many :sent_files,:class_name => 'Tracker', :foreign_key => 'sender_id'
  has_many :received_files,:class_name => 'Tracker', :foreign_key => 'receiver_id'

  def email_required?
    false
  end

  def email_changed?
    false
  end

  def self.all_without(excluded)
    where("id NOT IN (?)", excluded)
  end

end

Thanks for the help

Answer 1

Rather than doing

@files = File.all

try to filter the files you include by doing something like:

@files = File.where("office_id = ?", current_user.office_id)

This way, you only get files for the office to which the user belongs.

I don't know how you have your roles set up, but you can add some branching logic to allow registry officers to see all files, regardless of office:

if user.role = "registry officer"
  @files = File.all
else
  @files = File.where("office_id = ?", current_user.office_id)
end