康康能力：允許具有角色角色create_user的站點管理員創建或注冊新的devise用戶

Question

對於該應用程序，我正在嘗試使用cancan / cancancan來實現job_code樣式訪問，並進行設計和發布。

只有具有job_code：create_user的站點管理員才能創建新用戶

以下是代碼：

class RegistrationsController < Devise::RegistrationsController 
    before_filter :check_permissions, :only => [ :new, :create, :cancel ] 
    skip_before_filter :require_no_authentication 

    def check_permissions
        authorize! :create, resource
    end
end

class Ability
  include CanCan::Ability

  def initialize(user)
     alias_action :create, :read, :update, :destroy, :to => :crud

     if user.has_role? :create_user 
        can :create, User
     end

     if user.has_role? :create_annoucement
       can :create, Announcement
     end
  end
end

在routes.rb中，我有

devise_for :users ,:controllers => { :registrations => "registrations" }, :path_names => {:sign_in => "login", :sign_out => "logout"}, :path => "account"

應用控制器

class ApplicationController < ActionController::Base
    # Prevent CSRF attacks by raising an exception.
    # For APIs, you may want to use :null_session instead.
    protect_from_forgery with: :exception
    before_action :authenticate_user!
    check_authorization unless: :devise_controller?
    before_filter :set_start_time if Rails.env.development?
    before_action :configure_permitted_parameters, if: :devise_controller?

    rescue_from CanCan::AccessDenied do |exception|
      #https://github.com/ryanb/cancan/wiki/Devise
        if current_user.nil?
            session[:next] = request.fullpath
            puts session[:next]
            redirect_to new_user_session_path, :alert => "You have to log in to continue."
        else
          render file: "#{Rails.root}/public/403", formats: [:html], status: 403, layout: false
        end
    end

    def set_start_time
        @start_time = Time.now.usec
    end

    def configure_permitted_parameters
            #devise_parameter_sanitizer.for(:sign_in) { |u| u.permit(:name, :email) }
        devise_parameter_sanitizer.for(:sign_up) { |u| u.permit(:first_name, :last_name, :email, :password, :password_confirmation) }
          devise_parameter_sanitizer.for(:account_update) { |u| u.permit(:first_name, :last_name, :email, :password, :password_confirmation, :current_password, :user_manual) }
      end

end

當我使用時，abilities.rb中的以下代碼

if user.has_role? :create_user 
        can :create, :all
end

它工作完美 。 我需要進入“用戶注冊”頁面

但是，當我有這段代碼時

if user.has_role? :create_user 
   can :create, User
end

它說拒絕訪問（403頁）

我有一個很難弄清楚，我應該怎么用的，而不是用戶 can :create, User

Answer 1

我必須添加:read以及:create權限來訪問新的/創建操作，然后解析:read訪問