CanCan，设置嵌套资源？

Question

我有以下模型：

Group (id)
Poll (id, group_id)
PollVote (id, poll_id)

我不想进行深度嵌套，这意味着我不想 /group/:id/poll/:id/poll_vote/:id

我想设置它，所以我的路线：

/group/:id
/poll/:id
/poll/:id/poll_vote/:poll_vote_id

我有 poll工作，但我不知道如何让 PollVote 工作...到目前为止，我有：

class PollVotesController < ApplicationController

  # Authorization w Devise & CanCan
  before_filter :authenticate_user! # Devise, signed in users only
  load_and_authorize_resource :poll # CanCan
  load_and_authorize_resource :poll_vote, :through => :poll

  # We need to pass along the wall
    def current_ability
        @current_ability ||= Ability.new(current_user, @poll.group_id)
    end

然后在能力.rb 中

can [:manage], Poll do |poll|
    This returns TRUE is the user is a group member of the poll
end

我在 PollVotes 中使用什么，让 PollVotes 使用 Poll 检查 CanCan？

谢谢

Answer 1

您尚未向用户显示<->组关联，因此如果 User has_and_belongs_to_many :groups 则：

can :manage, [ Poll ] { |poll| user.groups.include?(poll.group) }

当然，您可能希望将其锁定为仅与用户关联的投票。

编辑 - 以下是限制创建和编辑投票的访问权限的示例：

can :read, PollVote # not needed if you have e.g. can :read, :all
can :create, [ PollVote ] { |poll_vote| user.groups.include?(poll_vote.poll.group) }
can [ :edit, :destroy ], [ PollVote ] { |poll_vote| poll_vote.user_id == user.id }