inossidabile / protector

Comfortable (seriously) white-list security restrictions for models on a field level
MIT License
270 stars 31 forks source link

custom association permissions #10

Closed anazar closed 11 years ago

anazar commented 11 years ago

I want to be able to set permissions based on a joining table.

so...

Post.restrict!(current_user).joins(:category)

In this situation the current user doesn't have direct access to category but can get category through Post. How would I accomplish this? It's applying the default category scope and I don't see a way to make it conditional based on the joining table.

inossidabile commented 11 years ago

http://stackoverflow.com/questions/17542532/how-to-restrict-model-based-on-association-using-protector/17542533