Rails 3 ActiveAdmin CanCan. How to configure that the User should see only records belonging to him?

Question

I am setting up admin_users, which belongs to the client class (Client is company). Thus, the client has many administrators.

I am trying to restrict access to records that belong to a specific client. I don’t want customers to view other customers’s data. So I installed this, but it seems to do nothing ...

Class Ability to Enable CanCan :: Ability

def initialize(user) user ||= AdminUser.new if user.role == "administrator" can :manage, :all else cannot :create, :all cannot :update, :all cannot :destroy, :all can :read, Shipment do |shipment| shipment.customer == user.customer end end end end 

And I have it in shipments.rb ...

 ActiveAdmin.register Shipment do menu :if => proc{ can?(:read, Shipment) }, :priority => 1 controller.authorize_resource index do column "File #", :sortable => :file_number do |shipment| link_to shipment.file_number, admin_shipment_path(shipment) end [... more columns ...] default_actions if can? :manage, Shipment end show :title => :file_number do panel "Shipment Details" do attributes_table_for shipment do row("File number") {shipment.file_number} row("Mode") {shipment.mode} row("Ocean Rate") { number_to_currency shipment.ocean_rate} row("Customer") { link_to shipment.customer.company_name, admin_customer_path(shipment.customer)} row("Shipper") { link_to shipment.shipper.company_name, admin_shipper_path(shipment.shipper)} row("Broker") { link_to shipment.broker.company_name, admin_broker_path(shipment.broker)} end end [...more show action stuff...] 

Thus, all the items are displayed on the index page, and if I am registered as client A and clicked on sending client B, I can see it, but it should block me.

More details ...

 shipments_controller.rb class ShipmentsController < InheritedResources::Base before_filter :authenticate_admin_user! end 

Answer 1

Active Admin has a built-in area handling method. See here: http://activeadmin.info/docs/2-resource-customization.html#scoping_the_queries

Answer 2

I had a similar problem in my application. I had superusers and administrators, where administrators could see only other administrators in their organization.

application / models / ability.rb

 if user.organization_admin? can :manage, User, :organization_id => user.organization_id end 

application / admin / users.rb

 controller do load_and_authorize_resource :except => :index def scoped_collection end_of_association_chain.accessible_by(current_ability) end end 

Answer 3

I do not know why it does not work, but can? :read, Shipment can? :read, Shipment will not look for permissions for can :read, Shipment do |shipment| ... can :read, Shipment do |shipment| ...

To confirm this permission, you need to specify a specific instance of the Shipment, for example can :read, @shipment .

You will need to find a way to get an instance of the available dispatch before your menu :if => ... is called.

---

Have you tried using controller.load_and_authorize_resource instead of authorize_resource ?

Answer 4

Use a collection with scope and run a query that depends on the current subscribed user

 ActiveAdmin.register Shipment do controller do def scoped_collection my_scope = resource_class.unscoped return my_scope if current_admin_user.role == "administrator" # return everything my_scope.where(customer_id: current_admin_user.customer_id) # filter by signed in user end end end