如何允许管理员用户访问客户用户对象导轨

Question

I have a report object that belongs_to a customer(user_type). I have it setup so that the customer is able to grant or remove permission from an admin to see the customers report. I need to know what steps or direction do I need to take to get the reports viewable to the admin user. The admin user should only have the ability to see reports (show) and see an index of reports that they have access to.

I am thinking maybe I should create a new controller but I am not sure if that is correct or how to do another controller tied to an object that already has a controller.

Answer 1

I highly suggest looking into the CanCanCan gem (the continuation of the CanCan gem which is no longer supported). In this way your code would look something like this in the end (you didn't post any code, so I have to make assumptions about your variables and such):

<% if current_user.admin? %>
    <% if can? :view_report, @customer %>
      <!-- Render the report to this admin -->
      <!--  .............................  -->
    <% end %>
<% end %>

And then you would have something like this in your controller to give an admin permission to view the user's report:

def handle_report
  can [:show], Report, :user_id => user.id
  if current_user.admin?
    can :manage, :current_report
  end
end

Again, apologies for guessing the variables.