CANCANCAN擁有數據的權限

Question

請問一個問題！

我不知道如何只授予用戶僅更新自己的數據的權限：

ability.rb

elsif user.has_role? :user
  can :update, User, id: user.id
else

user_controller.rb

def update
  a = Ability.new(current_user)
  user = User.find params[:id]
  if a.can? :update, User, id: user.id
  ...

在任何ID上均返回true。

撬動附加數據：

  [3] pry(main)> a = Ability.new(u)
  Role Load (0.7ms)  SELECT `roles`.* FROM `roles` INNER JOIN `users_roles` ON `roles`.`id` = `users_roles`.`role_id` WHERE `users_roles`.`user_id` = 3 AND (((roles.name = 'admin') AND (roles.resource_type IS NULL) AND (roles.resource_id IS NULL)))
  Role Load (0.4ms)  SELECT `roles`.* FROM `roles` INNER JOIN `users_roles` ON `roles`.`id` = `users_roles`.`role_id` WHERE `users_roles`.`user_id` = 3 AND (((roles.name = 'user') AND (roles.resource_type IS NULL) AND (roles.resource_id IS NULL)))
  => #<Ability:0x007f908ba931e8
  @rules=
   [#<CanCan::Rule:0x007f908be9b2b8
     @actions=[:update],
     @base_behavior=true,
     @block=nil,
     @conditions={:id=>3},
     @match_all=false,
     @subjects=
       [User(id: integer, email: string, encrypted_password: string, reset_password_token: string, reset_password_sent_at: datetime, remember_created_at: datetime, sign_in_count: integer, current_sign_in_at: datetime, last_sign_in_at: datetime, current_sign_in_ip: string, last_sign_in_ip: string, created_at: datetime, updated_at: datetime, auth_token: string, name: string, surnames: string)]>],
     @rules_index=
       {User(id: integer, email: string, encrypted_password: string, reset_password_token: string, reset_password_sent_at: datetime, remember_created_at: datetime, sign_in_count: integer, current_sign_in_at: datetime, last_sign_in_at: datetime, current_sign_in_ip: string, last_sign_in_ip: string, created_at: datetime, updated_at: datetime, auth_token: string, name: string, surnames: string)=>
[0]}>
[4] pry(main)> a.can? :update, User, id: 3
 => true
[5] pry(main)> a.can? :update, User, id: 2
 => true

我做錯了什么？

謝謝！

Answer 1

#app/models/ability.rb
class Ability
  include CanCan::Ability

  def initialize(user)
    user ||= User.new # guest user (not logged in)
    if user.has_role? :user
      can :update, User, id: user.id
    else
      can :read, :all
    end
  end
end

#app/controllers/users_controller.rb
class UsersController < ApplicationController
   def update
      @user = User.find params[:id]
      authorize! :update, @user
      ...
   end
end

從文檔 ：

CanCanCan期望控制器中存在current_user方法。

您無需顯式調用Ability ，這可以通過authorize!來完成authorize! 還是can?