CanCan for shared view

Question

I am using cancan for authorization. I have a shared view which need authorize depending on which controller it is.

The problem is: I have shared partial (description.rhtml) and it is used by two different models (Product and Orders). So when some one go to

www.example.com/product/1 - description section shows description about product www.example.com/order/1 - description section shows description about order

This description section has edit button on it so the user can edit it but the condition is

the user must be owner of the product when on product/1 page or
owner of order when user is on order/1 page.

My ability class check for

if user is owner or not - depending on product or order controller However on view:
```
if (can? :update, @orders) || (can? :update, @product)
< hide edit button >
end
```
but if can? :update, @orders return true or false, it show or hides edit button depending on that condition only

So my question is how can make use CanCan to tackle this problem

Hope I was clear.

Also -- go back over your old questions and mark the correct answer. 43% is not an acceptable rate. — Jesse Wolgamott
Sorry for not being clear....question is, how can we use cancan for a view (partial) that is shared by two or more controller — Viral
@Viral -- I'm saying you've only accepted answers for 43% of the questions you've asked. That should be 100%. — Jesse Wolgamott
@Jesse I have asked 12 question and from that 5 are unanswered, 1 i have answered and rest i have mark has accepted answered so it total 43%...I hope this is not stopping you to answer my question — Viral

Robin Robin · Accepted Answer · 2011-12-23T16:47:32

I think you should not use the exact same partial for products and orders.

You might want to use a layout:

views/layouts/description.html.erb

<div class="description">
    <%= model.description %>
    <!-- other common code... -->
    <div class="actions">
        <%= yield %>
    </div>
</div>

views/orders/description.html.erb

<%= render :layout => "layouts/description", :locals => { :model => @order } do %>
    <%= if (can? :update, @order) %>
       your link
    <% end %>
<%= end %>

You don't have to do that, but I think it's cleaner than having to deal with several models in the same partial.

side note:

but if can? :update, @orders return true or false, it show or hides edit button depending on that condition only

I don't really understand that. If @orders were null, then can? would return false, and the result of the whole expression would be the result of (can? :update, @product) which, I thought, was what you wanted.

CanCan for shared view

1 Answers