Class: Ability

Inherits:
Object
  • Object
show all
Includes:
CanCan::Ability
Defined in:
app/models/ability.rb

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(user, application, resource_klass = nil) ⇒ Ability

The ability class is used by CanCan to authorize create/read/update/delete access to resources. Permissions are defined for each application in config/initializers/applications.rb The roles table is on hqAdmin and HQSSO, so roles can be added/modified/assigned there. When a user logs in, it will collect their roles, serialize the associated permissions, and cassy will send them with the extra_attributes to be stored as a hash in the users.permissions field. If they have access to everything, the permissions hash will have the key :all, such as:

{:all => :permissions}

This is so that the ability model can immediately see they have all access and tell CanCan, without having to set up and check permissions for individual resources Otherwise it will be a nested structure representing Application/Section/View and look something like:

{
"AgenciesHQ"=>{
  "Advisors"=>{"permissions" => [:read, :create, :update, :delete]},
  "Policies"=>{"permissions" => [:read]},
  ...
},
"CarriersHQ" => {...}
}


32
33
34
35
36
37
38
39
40
41
 
# File 'app/models/ability.rb', line 32

def initialize(user, application, resource_klass = nil)
  @application = application
  @resource_klass = resource_klass && resource_klass.try(:base_class)
  @user = user

  # Set aliases
  ability_aliases!

  authorize_resources!
end

Instance Attribute Details

#application ⇒ Object (readonly)

Returns the value of attribute application.



8
9
10
 
# File 'app/models/ability.rb', line 8

def application
  @application
end

#resource_klass ⇒ Object (readonly)

Returns the value of attribute resource_klass.



8
9
10
 
# File 'app/models/ability.rb', line 8

def resource_klass
  @resource_klass
end

#user ⇒ Object (readonly)

Returns the value of attribute user.



8
9
10
 
# File 'app/models/ability.rb', line 8

def user
  @user
end

Instance Method Details

#safe_params(params) ⇒ Object 



43
44
45
46
47
48
49
50
51
52
53
54
 
# File 'app/models/ability.rb', line 43

def safe_params(params)
  return params unless resource
  params.to_h.each do |attribute, values|
    if /\A(?<association_name>.*)_attributes\z/ =~ attribute && (association = resource_klass.reflect_on_association(association_name)) && nested_resources.include?(find_resource(association.klass.name))
      if association.macro == :has_many
        values.reject! { |_, attribute_values| unsafe_nested_attributes?(attribute_values.to_h, association) }
      else
        params.reject! { |attribute_name, attribute_values| attribute_name == attribute && unsafe_nested_attributes?(attribute_values.to_h, association) }
      end
    end
  end
end