Using accessible_by with overriding roles about cancancan

[bryanrite]

Looks like the problem is the block section of the second ability is supposed to be run on instances of the business and the first scope is run on collections. ie:

can [:ability], Model, Model.scope_to_select_on_index_action do |model_instance|
  model_instance.condition_to_evaluate_for_new_create_edit_update_destroy
end

You should be able to do:

can :read, Business, Business.user_related(user) do |business|
   business.related_to?(user) # true/false
end

Then, when an admin tries to read a Business it will do (can read all businesses) or (can read user_related businesses)... which will always return all.

Generally I find it useful to separate out rules by roles:

case user.role
when 'admin'
  can :read, Business
  # Other admin rules
when 'user'
  # ...
else
  # guest/not logged in rules
end

[bryanrite]

https://github.com/CanCanCommunity/cancancan/wiki/Defining-Abilities-with-Blocks

[lesliev]

Excellent, thanks a lot! Your "can [:ability]" example should be in the docs.

This still doesn't solve the problem (I still get the same error) - but when I separate out the roles like you suggest, it works. I suppose it does make sense to not run the second block at all if we have an admin.

For others, here's the working code:

    if user.admin?
      can :read, Business 
    else
      can :read, Business, Business.user_related(user) do |business|
        business.related_to?(user)
      end
    end

[robertokl]

+1 on the "example should be in the docs".