varvet/godmin — pull request #7 by Linuus (2014-06-10 13:29:25+00:00)
Title: [WIP] Authentication and Authorization

## Authorization

This is an **experimental** branch to test out if we should move over from CanCan to Pundit (https://github.com/elabs/pundit). It also kind of uses Devise.

Pundit uses Policies to control what a user can do and so far this is working:

### ApplicationPolicy
By default Godmin has a `Godmin::ApplicationPolicy`. For now it just has one method called `has_admin_access` which returns true. This should be the default settings from which all other Policies inherits. Inheriting is actually optional but perhaps it is a good idea :)

### Specific policies for admin
When creating a new resource, say `Article` you need to create a policy as well. Minimum implementation is:

```ruby
# admin/app/policies/admin
module Admin
class ArticlePolicy < Godmin::ApplicationPolicy
end
end
```

If you use Pundit in the frontend as well and you want to use the same Policy, that is possible too. If we don't find any Policy in `admin/app/policies/admin/article_policy.rb` we fall back to `app/policies/article_policy.rb`. Or they can inherit from each other and so on....

### Scopes
Let's say that admins who belongs to a certain department only can see articles from that department. Pundit provides simple scopes for that, if we want to use that :)

Example:
```ruby
# admin/app/policies/admin
module Admin
class ArticlePolicy < Godmin::ApplicationPolicy
class Scope < Godmin::ApplicationPolicy::Scope
def resolve
if !user.superadmin?
scope.where(department_id: user.department_id)
else
scope.all
end
end
end
end
end
```

Then in the controller we can make use of the `policy_scope(collection)` method. (It is used right now in `Godmin::ResourceController`.

So far it seems pretty cool and I want to use `Pundit` :thumbsup: