README.md in abilities-0.1.2 vs README.md in abilities-4.0.0.0
- old
+ new
@@ -3,12 +3,19 @@
[![Build Status](https://travis-ci.org/mmontossi/abilities.svg)](https://travis-ci.org/mmontossi/abilities)
[![Dependency Status](https://gemnasium.com/mmontossi/abilities.svg)](https://gemnasium.com/mmontossi/abilities)
# Abilities
-Minimalistic authorization inspired in cancan for rails.
+Authorization dsl to manage permissions in rails.
+## Why
+
+I did this gem to:
+
+- Use a dsl instead of a plain class to simplify the syntax.
+- Limit authorizations to only controllers and their views.
+
## Install
Put this line in your Gemfile:
```ruby
gem 'abilities'
@@ -19,92 +26,72 @@
$ bundle
```
## Configuration
-Generate the abilities configuration file:
+Generate the definitions file:
```
bundle exec rails g abilities:install
```
-Define the user fetcher for your controllers and views:
+Ensure there is a current_user method in your controllers:
```ruby
-Abilities.configure do |config|
- config.fetcher do
- current_user
+class ApplicationController < ActionController::Base
+ def current_user
+ @current_user ||= User.find(session[:user_id])
end
end
```
-Add the abilities concern to the model if you want to call can? and cannot? in the user instance:
-```ruby
-class User < ActiveRecord::Base
- include Abilities::Concern
-end
-```
-
## Usage
-### Defining
+### Definitions
-All the abilities are defined in config/abilities.rb by can and cannot methods:
+Use can and cannot methods to define the policies:
```ruby
Abilities.define do
- can :create, Post
- cannot :destroy, User unless admin?
- can :edit, Post do |subject|
- subject.user == self
+ can :view, :any
+ can :manage, User do |user|
+ user == self
end
- can :manage, User
- can :touch, :all
+ can :detroy, Product if admin?
end
```
-If you want to load the abilities from the database you may do something like this:
-```ruby
-Abilities.define do
- permissions.each do |permission|
- can premissions.action, permissions.subject
- end
-end
-```
+NOTE: Methods besides can and cannot are sent to the current_user.
-NOTE: Any method besides can and cannot references the user instance.
+### Controllers
-### Checking
-
-#### Controllers
-
With the authorize! method Abilities::AccessDenied is raised if authorization fails:
```ruby
-class PostsController < ApplicationController
+class UsersController < ApplicationController
def edit
- @post = Post.find(params[:id])
- authorize! :edit, @post
+ @user = User.find(params[:id])
+ authorize! :edit, @user
end
end
```
If you don't want an exception to be raised use can? and cannot? helpers:
```ruby
class UsersController < ApplicationController
def edit
- @post = Post.find(params[:id])
- if can? :edit, @post
- @post.update post_params
+ @user = User.find(params[:id])
+ if can?(:edit, @user)
+ @user.update post_params
else
# handle access denied
end
end
end
```
-#### Views
+### Views
-The helpers can? and cannot? are available here too:
+The helpers can? and cannot? are available in the controller views too:
```erb
-<% if can? :create, Post %>
- <%= link_to new_post_path %>
+<% if can?(:detroy, @product) %>
+ <%= link_to product_path(@product), method: 'delete' %>
<% end %>
```
## Credits