search

james2m / canard

Makes role based authorization in Rails really simple. Wraps CanCan and RoleModel up with a smattering of syntactic sugar, some generators and scopes.
MIT License
125 stars 28 forks source link

User abilities don't include guest abilities #9

Open ssexton71 opened 12 years ago

ssexton71 commented 12 years ago

I ended up not using Canard for a recent project because the "additive" nature of abilities does not include guest abilities.

I think the behavior should be, for example: guest, user, manager, admin Instead it is: user, manager, admin

So any abilities defined for guest have to be duplicated in user. Not very DRY. While I realize this is a breaking change, to be perfectly honest, I can't think of any real world examples where a user would be denied from doing something that a guest can do.

james2m commented 12 years ago

Signup and signin pages spring to mind. But point taken. I would consider adding it as a configuration option, but wouldn't want to trade potential DRYness for flexibility. Out of 5 projects I'm using Canard in only 1 would benefit from this. So I see the potential but not at the expense of a limitation. How about;

  acts_as_user roles: [...], prepend_guest: true

With prepend_guest defaulting to false.