inossidabile / protector

Comfortable (seriously) white-list security restrictions for models on a field level
MIT License
270 stars 31 forks source link

Self-aware conditions #43

Closed asiniy closed 10 years ago

asiniy commented 10 years ago

Why we need to pass second argument in block? Maybe, it will be better to fetch self object from object through other way, like:

  protect do |user|
    if user
      if model.try(:id) == user.id   # Checks belonging keeping possible nil in mind
        can :update, %w(title text)         # Allow authors to modify posts
      end
    end
  end

instead of current

  protect do |user, article|
    if user
      if article.try(:user_id) == user.id   # Checks belonging keeping possible nil in mind
        can :update, %w(title text)         # Allow authors to modify posts
      end
    end
  end

i.e. carrierwave have a method naming model which can be used in their processing blocks

inossidabile commented 10 years ago

I can't see any purpose to break the BC. It's just a matter of taste and I'd rather stay with what we currently have.

asiniy commented 10 years ago

How can I make a restriction for smth.like that:

    @contractor = Contractor.restrict!(current_user).find(params[:id])

How can I work with restriction to this product?

inossidabile commented 10 years ago

What exactly are you trying to achieve?

asiniy commented 10 years ago

I want to restrict user access to some contractors.

inossidabile commented 10 years ago

Ok. Use the code that you provided. Read README for better examples. Can you please explain what you want explicitly? How is it even connected to the way we use to reference entity?

I can't read your mind.

asiniy commented 10 years ago

There is a controller:

@contractor = Contractor.restrict!(current_accreditation).find(params[:contractor_id])
@contractor.accreditations.create!(options)

So, I want to restrict Contractor accreditation based on contractor itself.

For now, works something like that:

@contractor = Contractor.restrict!(current_accreditation, Contractor.find(:contractor_id)).find(params[:contractor_id])
@contractor.accreditations.create!(options)

ЗЫ. Можно мне по-русски, я по-английски не очень?

asiniy commented 10 years ago

Is anybody here?

inossidabile commented 10 years ago

restrict! does not accept second argument. It appears automatically during the restriction of a single entiy. Just use it.

asiniy commented 10 years ago

Yes, I understood it for now. Regards!