Rails%203%20In%20Action

188 CHAPTER 8 More authorization
To make the spec pass, you need to implement the permission checking on the new
and create actions in your TicketsController.
Run a before_filter before the new action that checks whether the current user
has permission; if not, then redirect the user to the project page and display the error
described in the spec.
Now change the before_filter calls to include this new one, as shown in the following
lines:
before_filter :authenticate_user!
before_filter :find_project
before_filter :find_ticket, :only => [:show, :edit, :update, :destroy]
before_filter :authorize_create!, :only => [:new, :create]
This authorize_create!before_filter is placed after the authenticate_user! and
find_project before_filters because it uses the current_user object set up by the
authenticate_user! method and the @project object from find_project.
In this new filter, you call a new method called cannot?, which returns true or
false to indicate whether the currently signed-in user can’t or can do a particular
action. You define the authorize_create! method code shown next:
def authorize_create!
if !current_user.admin? && cannot?("create tickets".to_sym, @project)
flash[:alert] = "You cannot create tickets on this project."
redirect_to @project
end
end
In this example, you use to_sym to create a symbolized version of a string, which is
required because the cannot? method takes only symbols. You also check whether or
not the user is an admin; if so, the user should be allowed to create tickets. If you run
the controller’s spec again with bin/rspec spec/controllers/tickets_controller
_spec.rb, the example fails because the cannot? method is undefined:
Failure/Error: get :new, :project_id => project.id
undefined method 'cannot?' for #
Rails doesn’t come with a cannot? method, but a gem called cancan (stylized as Can-
Can) does. This gem helps you tie together the User and Permission records. Let’s
install it now.
8.5.3 What is CanCan?
CanCan is a gem written by Ryan Bates of Railscasts fame; it provides some nice helper
methods (such as the cannot? method and its antithesis, can?) to use in controllers
and views.
The can? and cannot? methods use the same permissions table you created to
check that a user has permission to perform a specific action on a specific object.
To install CanCan, add this line to your Gemfile directly underneath the line for
Devise:
gem 'cancan'