mercredi 1 avril 2015

How object is authenticate through 'declarative_authorization'

I am using declarative_authorization in my app. I am bit confused how declarative_authorization is authenticate the object for the checking the authorization.


For example:


My authorization rule file is like:



role :Teacher do
has_permission_on :results, :to => [:new, :create]
has_permission_on :results, :to => [:show, :edit, :index, :update, :destroy] do
if_attribute :user => is {user}
end
end

class MonitorsController < ApplicationController
def result
@result = Result.find_by_user_id(params[user_id])
end
end


I am displaying the result to teachers only.


In my view:



<% edit_permission = (permitted_to? :show, @results) %>
<% if edit_permission %>
// display results
<% end %>


Problem: Issue is with the @results instance. It always returning false for @results object.


Query: Do we need to use filter_resource_access for authenticating the object. Because in my case I am manually fetching the result object instead of filter_resource_access.


Aucun commentaire:

Enregistrer un commentaire