Ruby On Rails Rolify + CanCanCan + Devise允許用戶只編輯他們的帖子

Question

我已經使用Devise + CanCanCan + rolify Tutorial構建了Ruby On Rails應用程序。

這裏是我的Ability型號：

class Ability 
    include CanCan::Ability 

    def initialize(user) 
    user ||= User.new # guest user (not logged in) 
    if user.has_role? :admin 
     can :manage, :all 
    else 
     can :read, :all 
    end 
    end 
end 

我想允許用戶編輯自己的帖子，被別人看的帖子。

我怎麼能做到這一點？

Answer 1

你只需要到user_id傳遞給hash conditions：

#app/models/ability.rb 
class Ability 
    include CanCan::Ability 

    def initialize(user) 
    user ||= User.new # guest user (not logged in) 
    if user.has_role? :admin 
     can :manage, :all 
    else 
     can :manage, Post, user_id: user.id #-> CRUD own posts only 
     can :read, :all #-> read everything 
    end 
    end 
end 

這將允許您使用：

#app/views/posts/index.html.erb 
<%= render @posts %> 

#app/views/posts/_post.html.erb 
<% if can? :read, post %> 
    <%= post.body %> 
    <%= link_to "Edit", edit_post_path(post), if can? :edit, post %> 
<% end %> 

Answer 2

我同意理查德·佩克的答案。但是，我只想指出，不需要爲迎賓用戶（未登錄）提供服務。在實例化新對象（即對象的構造函數）時調用初始化器。

因此，上述能力類可能如下：

#app/models/ability.rb 
class Ability 
include CanCan::Ability 

def initialize(user) 

    if user.has_role? :admin 
    can :manage, :all 
    else 
    can :manage, Post, user_id: user.id #-> CRUD own posts only 
    can :read, :all #-> read everything 
    end 
end 
end