ref. http://www.tzi.org/~sbartsch/declarative_authorization/master/
Module Authorization::AuthorizationHelper
In: lib/declarative_authorization/helper.rb
Methods
has_any_role? has_any_role_with_hierarchy? has_role? has_role_with_hierarchy? permitted_to?
permitted_to?(privilege, object_or_sym = nil, options = {}, &block)
If the current user meets the given privilege, permitted_to? returns true and yields to the optional block. The attribute checks that are defined in the authorization rules are only evaluated if an object is given for context.
Examples:
<% permitted_to? :create, :users do %>
<%= link_to 'New', new_user_path %>
<% end %>
...
<% if permitted_to? :create, :users %>
<%= link_to 'New', new_user_path %>
<% else %>
You are not allowed to create new users!
<% end %>
...
<% for user in @users %>
<%= link_to 'Edit', edit_user_path(user) if permitted_to? :update, user %>
<% end %>
To pass in an object and override the context, you can use the optional options:
permitted_to? :update, user, :context => :account
has_role?(*roles, &block)
While permitted_to? is used for authorization in views, in some cases content should only be shown to some users without being concerned with authorization. E.g. to only show the most relevant menu options to a certain group of users. That is what has_role? should be used for.
Examples:
<% has_role?(:sales) do %>
<%= link_to 'All contacts', contacts_path %>
<% end %>
...
<% if has_role?(:sales) %>
<%= link_to 'Customer contacts', contacts_path %>
<% else %>
...
<% end %>
Module Authorization::AuthorizationInModel
In: lib/declarative_authorization/in_model.rb
Methods
after_find obligation_scope_for permitted_to! permitted_to? using_access_control using_access_control? using_access_control? with_permissions_to
Public Class methods:
using_access_control(options = {})
Activates model security for the current model. Then, CRUD operations are checked against the authorization of the current user. The privileges are :create, :read, :update and :delete in the context of the model. By default, :read is not checked because of performance impacts, especially with large result sets.
class User < ActiveRecord::Base
using_access_control
end
If an operation is not permitted, a Authorization::AuthorizationError is raised.
To activate model security on all models, call using_access_control on ActiveRecord::Base
ActiveRecord::Base.using_access_control
Available options
:context -
Specify context different from the models table name.
:include_read -
Also check for :read privilege after find.