ryanb/cancan — Issue #500: can?(:read, obj => Klass) is always true
Author: steerio
Created: 2011-10-31 12:03:19+00:00
State: open

Our system has projects which have many contracts. We need fine grained access control to give certain users rights to the contracts of certain projects, so we added project roles, which belong to users, projects and have a specific designation.

We defined the Cancan rule like this (the initialize method of our ability accepts a user, and sets `@user` to it):

```ruby
can :read, Contract, project: { project_roles: { user_id: @user.id, role: 'contracts' }}
```

When we use `can?(:read, @project.contracts.first)` or `Contract.accessible_by(ability)`, the concept works. However,

````ruby
can?(:read, @project => Contract)`
````

always returns true.