mdarby-restful_acl 2.0.2 → 2.0.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- data/README.textile +1 -1
- data/lib/restful_acl_controller.rb +12 -1
- metadata +1 -1
data/README.textile
CHANGED
@@ -39,7 +39,7 @@ Add this before_filter into any controller that you'd like to restrict access to
|
|
39
39
|
|
40
40
|
h4. Models
|
41
41
|
|
42
|
-
Define a parent resource (if one exists) by using the <b>
|
42
|
+
Define a parent resource (if one exists) by using the <b>logical_parent</b> method, and define the following five methods in the model of every resource you'd like to restrict access to. The five methods can contain anything you'd like so long as they return a boolean true or false. This allows you to define your User's roles any way you wish.
|
43
43
|
|
44
44
|
<pre>
|
45
45
|
class Issue < ActiveRecord::Base
|
@@ -31,7 +31,7 @@ module RestfulAclController
|
|
31
31
|
when "show" then object.is_readable_by(current_user, parent)
|
32
32
|
when "edit", "update" then object.is_updatable_by(current_user, parent)
|
33
33
|
when "destroy" then object.is_deletable_by(current_user, parent)
|
34
|
-
else
|
34
|
+
else check_non_restful_route(current_user, klass, object, parent)
|
35
35
|
end
|
36
36
|
|
37
37
|
rescue NoMethodError => e
|
@@ -45,6 +45,17 @@ module RestfulAclController
|
|
45
45
|
|
46
46
|
private
|
47
47
|
|
48
|
+
def check_non_restful_route(user, klass, object, parent)
|
49
|
+
if object
|
50
|
+
object.is_readable_by(user, parent)
|
51
|
+
elsif klass
|
52
|
+
klass.is_indexable_by(user, parent)
|
53
|
+
else
|
54
|
+
# If all else fails, deny access
|
55
|
+
false
|
56
|
+
end
|
57
|
+
end
|
58
|
+
|
48
59
|
def get_method_from_error(error)
|
49
60
|
error.message.gsub('`', "'").split("'").at(1)
|
50
61
|
end
|