Authorization fails using nested resources in CanCan

0
votes

I have a model Group and a model Person. A Person belongs_to a Group and a Group has_many People. They are nested resources. According to this page it should be sufficient to authorize in the PeopleController with the following:

load_and_authorize_resource :group
load_and_authorize_resource :person, :through => :group

I have specifically not added an Ability to manage a Person directly, but it's implied that that shouldn't be necessary because it gets authorized through the Group. Authorization works correctly on Group models, but fails on the Person.

I'm able to work around the issue by adding this Ability:

can :manage, Person, :group => { :user_id => user.id }

But again, the documentation says that although it's a "good idea" to do this (why?) it shouldn't be necessary for the authorization to work.

I'd appreciate any help you could offer!

1
ruby-on-railsdevisecancan

1 Answers

0
votes

I recommend you define the abilities with blocks.

can :manage, Person do |person|
  person.group.user_id == user.id
end

This work better to me than defining the abilities with hashes in nested resources. try!