What is the 'right' way to restrict access to nested resource index action? about the_role

[the-teacher]

Hello! Give me a time to analyze your situation. I'll try to help

[danevron]

I didn't mean to to upset you.
I'm rather new to Github and I was under the impression that this is the way to ask questions.
Sorry

[the-teacher]

I think, in code your situation looks like that:

class User < AR
  has_many :expense_reports
end

class ExpenseReport < AR
  belongs_to :user
end

and I think you want to render list of expense_reports of user (for example with ID 567) with URL

/users/567/expense_reports

You should not to check ownership of user to each object (@owner_check_object can't to help you). Because you should only render a list of expense_reports of this current_user

This story out of scope of TheRole. TheRole should not to resolve situation when User 1 try to see Index action of User 2. That is why you cant to find solution in TheRole documentaion.

This situation should be resolved manually with your code. There is part of my current project

class ApplicationController < ActionController::Base
  before_action :define_user

  private

  def define_user
    @root   = User.root
    @user   = current_user

    user_id = params[:user_id]
    @user = User.find(user_id) if user_id
  end

class PagesController < ActionController::Base
  before_action :check_for_list_owner, only: [:manage]

  def manage; end

  private

  def check_for_list_owner
    unless (current_user == @user || current_user.admin?)
        redirect_to root_path, flash: { error: "Access denide" } 
    end
  end
end

Can it be solution for your story?

[danevron]

Yes.
This is what I was looking for.
I can protect all the user's nested objects with this solution.
Thanks man!

[seuros]

@danevron he is not upset just Russian. ;)

[the-teacher]

@seuros 😄