ryanb/cancan — Issue #533: suggestion: including mass_assignment_security with cancan 
Author: suzi2000
Created: 2011-12-19 16:52:43+00:00
State: open

It seems to me that it may be possible to integrate the rails 3 mass assignment protection with cancan ?
https://github.com/rails/rails/blob/f69be6ae8f0a309cca59bea2526b71b1029b4beb/activemodel/lib/active_model/mass_assignment_security.rb#L205

so we could define our controllers simple, e.g. with a :default and :admin role

```ruby

class AccountsController < ApplicationController
#(cancan could do this) include ActiveModel::MassAssignmentSecurity
attr_accessible :first_name, :last_name
attr_accessible :first_name, :last_name, :plan_id, :as => :admin
end
```

In cancan we would say:
```ruby

class Ability
include CanCan::Ability

def initialize(user)
if user

can [:read, :update], Accounts # :as => default if not specified

if user.admin?
can :manage, Accounts, :as => :admin
end

end
end
end

```

cancan would sanitize the params & instance variables for us, based on the roles so the controllers don't have to change at all for mass assignment security. Is this possible or usefull?