urkle/declarative_authorization — comment on commit 560f9ff411533a60d29429684107c7417ae03d16
File:  line 0
By urkle:

I agree no_attribute_check is horrible :-D

The use case is we have a has_many :sites association on our users. and I want to limit creation based on the sites they are allowed access to

So, given a user can have multiple sites, and a Sprocket belongs_to :site, this is the rule file

```ruby
has_permission_on :sprokcets, :to => :create do
if_attribute :site => is_in { user.sites }
end
```
Then this

```ruby
class MyController < ApplicationController
filter_resource_access :additional_no_attribute_check => [:new]
end
```

allows the "new" action to proceed but forces the create action to check attributes (e.g. ensuring the user didn't pick/fudge a site they don't have access to)

the other thought I had for fixing this was to simply make :no_attribute_check additive only.

And as for the case of :nested_in being possibly set as well, yes that could happen, BUT in that case I wouldn't need to set :additional_no_attribute_check most likely..