ryanb/cancan — Issue #534: authorization for shared view
Author: pviral
Created: 2011-12-23 16:44:16+00:00
State: open

The problem is: I have shared partial (description.rhtml) and it is used by two different models (Product and Orders). So when some one go to

* www.example.com/product/1 - description section shows description about product
* www.example.com/order/1 - description section shows description about order

This description section has edit button on it so the user can edit it but the condition is

* the user must be owner of the product when on product/1 page or
* owner of order when user is on order/1 page.

My ability class check for

if user is owner or not - depending on product or order controller However on shared description view, I have :

if (can? :update, @orders) || (can? :update, @product)
< hide edit button >
end
but
if can? :update, @orders

return true or false, if user is on order/1 page but it return false when user is viewing product/1 page. So the logic works fine when user view order page but when user view product page it hide edit button even though user is authorize to edit description.

So my question is how can make use CanCan to make sure if users are viewing product I can authorize user to edit Product description and when user is viewing Orders page I can authorize to edit Order description