Rails 3 中的属性级别授权
我正在使用 devise 进行身份验证，并且我正在寻找一个授权框架，可以让我声明编辑权限具体模型属性。
我在我的应用程序中扮演三个不同的角色：教师、家长和学生。学生模型属于家庭。当教师创建学生时，他们可以设置家庭关联。然而，当家长访问学生的编辑页面时，他们不应该能够更改该关联，而只能查看它。
在视图中，很容易根据查看者来更改表单（例如，禁用或不禁用系列选择输入），但精心设计的表单可以解决此问题。我需要的是当有人试图更改他们不允许更改的属性时会引发某种授权异常的东西。
我目前正在查看 declarative_authorization，但它似乎不够细粒度，无法限制对属性的更改，仅模型作为一个整体。
I'm using devise for authentication and I'm looking for an authorization framework that lets me declare edit permissions for specific model attributes.
I have three different roles in my app: Teacher, Parent, and Student. The Student model belongs_to Family. When a Teacher creates a Student, they are able to set the Family association. When a Parent visits the edit page for a Student, however, they should not be able to change that association, only view it.
In the view, it's easy to alter the form depending on who is viewing it (disable or don't disable the family select input, for example) but a crafted form can get around that. What I need is something that will throw some kind of authorization exception when someone tries to change an attribute that they are not allowed to change.
I'm currently looking at declarative_authorization, but it seems it's not fine-grained enough to restrict changes to attributes, only the model as a whole.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我最终使用了新的 MassAssignmentSecurity 功能，尽管它看起来像与accepts_nested_attributes_for结合使用可能效果不太好。
I've ended up using the new MassAssignmentSecurity feature, although it looks like it might not work that great in conjunction with accepts_nested_attributes_for.
我意识到我的答案晚了两年。您需要的是一个足够细粒度的授权框架，这是值得的。
OASIS 的标准 XACML 就提供了这一点。它可以处理任意数量的属性。
请在此处查看我的详细答案： Rails 4 授权 gem
I realize my answer comes 2 years late. For what it's worth what you need is an authorization framework that is fine-grained enough.
XACML, the standard from OASIS provides just that. It can handle any number of attributes.
See my detailed answer here: Rails 4 authorization gem