Feature/edit metadata authorization

I assume that pds_handle contain user group name(s) and thus we don't need to add roles. To reflect this I added customized method "groups" to user model. If the assumption is incorrect I will fix it and edit roles file.

Hi Barnaby,

It worked for me

I guess it worked for other Hydra users too. Here is the code from Hydra
tutorial:

 def show
    authorize! :show, params[:id]
    @book = Book.find(params[:id])

    respond_to do |format|
      format.html # show.html.erb
      format.json { render json: @book }
    end
  end

which I took here:
https://github.com/afred/hydra-dev-docs/blob/master/hydra-head-wiki-orig/Lesson:-use-hydra-access-controls-and-cancan-to-decide-whether-to-render-a-page.md

Also in the sample Hydra Book controller you would see the same method call
(Frankly speaking I've just un-commented the code)

I tried to investigate the issue further and I looked at the method
authorize! in  cancan/controller_additions.rb, which is called here. The
method is a wrapper method. It calls some methods from ability.rb.
ability.rb was customized by Hydra developers I guess that's might be the
reason why the custom method call is possible. I didn't use
load_and_authorize because I believe the  item is already loaded in that
line:

before_action :set_item, only [:edit, :update]

private
def set_item
 @item = Nyucore.find(params[ :id])
end

Of course it won't harm to change params[:id] to @item and I will do that.
 Would you mind to tell me, what errors are you getting

Thanks !


On Fri, Jul 25, 2014 at 3:10 PM, barnabyalter <notifications@github.com>
wrote:

> In app/controllers/nyucores_controller.rb:
>
> >      flash[:notice] = 'Item was successfully updated.' if @item.update(item_params)
> >      respond_with(@item)
> >    end
> >
> >    def destroy
> >      # Not authorizing resources for now
> > -    # authorize! :destroy, params[:id]
> > +    authorize! :destroy, params[:id], :message => "un-authorized  item destory attempt"
>
> @ekate <https://github.com/ekate> As far as I can tell this shouldn't
> work. You want to authorize on the resource not the id,
>
> So authorize! :update, @item would be the statement. However, you can add
> a load_and_authorize_resources, which will do the loading (i.e. @item =
> Item.find(params[:id])) and the authorizing for you. See here for more:
> https://github.com/ryanb/cancan/wiki/authorizing-controller-actions
>
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/NYULibraries/ichabod/pull/30/files#r15419075>.
>



-- 
Ekaterina Pechekhonova
Digital Library Programmer/Analyst
New York University
Libraries
email: ekate@nyu.edu
phone: 212-992-9993