CanCan :read 和 [:index, :show] 之间的区别吗？

发布于 2024-10-21 17:38:47 字数 1387 浏览 2 评论 0原文

根据所有文档， :read 操作是 :index 和 :show 的别名：

alias_action :index, show, :to => :read

但是，请考虑以下具有嵌套资源的场景：

resources :posts
  resources :comments
end

如果我这样定义能力：

# ability.rb
can :read, Post
can :show, Comment

# comments_controller.rb
load_and_authorize_resource :organization, :find_by => :permalink
load_and_authorize_resource :membership, :through => :organization

事情按预期进行。但是，如果我将 :read 操作更改为 [:index, :show]：

# ability.rb
can [:index, :show], Post
can :show, Comment

# comments_controller.rb
load_and_authorize_resource :organization, :find_by => :permalink
load_and_authorize_resource :membership, :through => :organization

我无权访问 /posts/:post_id/comments、/posts /:post_id/comments/:id 等。但是，我仍然可以访问 posts_controller 的 :index 和 :show代码>.

如果这些行为的行为不同，它们怎么可能是“别名”呢？

在我的摆弄中，我还遇到了以下情况。将 load_and_authorize_resource 更改为以下允许的访问权限：

# ability.rb
can [:index, :show], Post
can :show, Comment

# comments_controller.rb
load__resource :organization, :find_by => :permalink
load_and_authorize_resource :membership, :through => :organization

有人可以解释一下这里发生了什么吗？

原文

According to all documentation, the :read action is aliased to both :index and :show:

alias_action :index, show, :to => :read

However, consider the following scenario with nested resources:

resources :posts
  resources :comments
end

If I define abilities like this:

# ability.rb
can :read, Post
can :show, Comment

# comments_controller.rb
load_and_authorize_resource :organization, :find_by => :permalink
load_and_authorize_resource :membership, :through => :organization

things work as expected. However, if I change the :read action to [:index, :show]:

# ability.rb
can [:index, :show], Post
can :show, Comment

# comments_controller.rb
load_and_authorize_resource :organization, :find_by => :permalink
load_and_authorize_resource :membership, :through => :organization

I am unauthorized to access /posts/:post_id/comments, /posts/:post_id/comments/:id, etc. I still, however, can access both :index and :show for the posts_controller.

How is possible that these actions are "aliased", if they behave differently?

In my fiddling, I also came across the following. Changing load_and_authorize_resource to the following allowed access:

# ability.rb
can [:index, :show], Post
can :show, Comment

# comments_controller.rb
load__resource :organization, :find_by => :permalink
load_and_authorize_resource :membership, :through => :organization

Can someone explain what's going on here?

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

趁年轻赶紧闹 2024-10-28 17:38:47

我将此作为问题发布在 GitHub 上。瑞安回应如下：

:index 和 :show 操作
指向 :read 操作。但是当
CanCan授权其父资源
直接使用 :read 操作
这就是您看到此行为的原因。
我认为这引起了混乱
之前，所以我会改变内部
永远不要使用 :read 的行为
直接行动。而不是一个
:parent 资源我将其更改为
使用 :show 和
我将使用默认的 accessible_by
:index 而不是 :read。谢谢
让我注意到这一点。