README.md in abilities-0.1.2 vs README.md in abilities-4.0.0.0

- old
+ new

@@ -3,12 +3,19 @@ [![Build Status](https://travis-ci.org/mmontossi/abilities.svg)](https://travis-ci.org/mmontossi/abilities) [![Dependency Status](https://gemnasium.com/mmontossi/abilities.svg)](https://gemnasium.com/mmontossi/abilities) # Abilities -Minimalistic authorization inspired in cancan for rails. +Authorization dsl to manage permissions in rails. +## Why + +I did this gem to: + +- Use a dsl instead of a plain class to simplify the syntax. +- Limit authorizations to only controllers and their views. + ## Install Put this line in your Gemfile: ```ruby gem 'abilities' @@ -19,92 +26,72 @@ $ bundle ``` ## Configuration -Generate the abilities configuration file: +Generate the definitions file: ``` bundle exec rails g abilities:install ``` -Define the user fetcher for your controllers and views: +Ensure there is a current_user method in your controllers: ```ruby -Abilities.configure do |config| - config.fetcher do - current_user +class ApplicationController < ActionController::Base + def current_user + @current_user ||= User.find(session[:user_id]) end end ``` -Add the abilities concern to the model if you want to call can? and cannot? in the user instance: -```ruby -class User < ActiveRecord::Base - include Abilities::Concern -end -``` - ## Usage -### Defining +### Definitions -All the abilities are defined in config/abilities.rb by can and cannot methods: +Use can and cannot methods to define the policies: ```ruby Abilities.define do - can :create, Post - cannot :destroy, User unless admin? - can :edit, Post do |subject| - subject.user == self + can :view, :any + can :manage, User do |user| + user == self end - can :manage, User - can :touch, :all + can :detroy, Product if admin? end ``` -If you want to load the abilities from the database you may do something like this: -```ruby -Abilities.define do - permissions.each do |permission| - can premissions.action, permissions.subject - end -end -``` +NOTE: Methods besides can and cannot are sent to the current_user. -NOTE: Any method besides can and cannot references the user instance. +### Controllers -### Checking - -#### Controllers - With the authorize! method Abilities::AccessDenied is raised if authorization fails: ```ruby -class PostsController < ApplicationController +class UsersController < ApplicationController def edit - @post = Post.find(params[:id]) - authorize! :edit, @post + @user = User.find(params[:id]) + authorize! :edit, @user end end ``` If you don't want an exception to be raised use can? and cannot? helpers: ```ruby class UsersController < ApplicationController def edit - @post = Post.find(params[:id]) - if can? :edit, @post - @post.update post_params + @user = User.find(params[:id]) + if can?(:edit, @user) + @user.update post_params else # handle access denied end end end ``` -#### Views +### Views -The helpers can? and cannot? are available here too: +The helpers can? and cannot? are available in the controller views too: ```erb -<% if can? :create, Post %> - <%= link_to new_post_path %> +<% if can?(:detroy, @product) %> + <%= link_to product_path(@product), method: 'delete' %> <% end %> ``` ## Credits