inossidabile / protector

Comfortable (seriously) white-list security restrictions for models on a field level
MIT License
270 stars 31 forks source link

Support arrays of actions in can statements #64

Open CyborgMaster opened 9 years ago

CyborgMaster commented 9 years ago

I find myself wanting to define a lot of permissions on both create and update (if a user can create a record with a given field, they most likely are also allowed to update that field. This isn't too bad when it's just a few fields, but I have a complex model that requires the following statements:

            can :create, :name, :photo_file_name,
              :photo_content_type, :photo_file_size, :photo_updated_at, :photo,
              :photo_original_w, :photo_original_h, :photo_box_w, :photo_crop_x,
              :photo_crop_y, :photo_crop_w, :photo_crop_h, :photo_aspect
            can :update, :name, :photo_file_name,
              :photo_content_type, :photo_file_size, :photo_updated_at, :photo,
              :photo_original_w, :photo_original_h, :photo_box_w, :photo_crop_x,
              :photo_crop_y, :photo_crop_w, :photo_crop_h, :photo_aspect

Not only is this very verbose, it's a problem for maintenance as the field list changes.

I've modified the can statement to optionally take an array of actions allowing the previous examples to be completed in one command.

            can [:create, :update], :name, :photo_file_name,
              :photo_content_type, :photo_file_size, :photo_updated_at, :photo,
              :photo_original_w, :photo_original_h, :photo_box_w, :photo_crop_x,
              :photo_crop_y, :photo_crop_w, :photo_crop_h, :photo_aspect
CyborgMaster commented 8 years ago

I just updated the pull request to modify the cannot function in the same manner as can. They both now support an array of actions as the first parameter.