README.md in trust-0.8.3 vs README.md in trust-1.4.2

- old
+ new

@@ -57,13 +57,37 @@ def associated_with_client? parent && parent.is_a?(Client) && parent.operators.find(user.id) end end + + + class Voucher < Default + member_roles :accountant do + can :edit, :show, :if => :associated_with_client? + end + def members_role() + user.member_role( subject_or_parent.team ) + end + end + + # Rails 4 - definitions for strong_params + class Invoice < Default + require :invoice # requires :invoice hash. This is set by default, so in practice not necessary to define + permit :date, :due_days # permitted parameters + role :accountant do + can :edit, :show, :if => :associated_with_client? + end + role :department_manager, :accountant do + can :new, :create, :if => lambda { parent }, permit: [:date, :due_days, :discount] + end + end end ``` +The members_role can be implemented if a user has multiple roles such as memberships of teams, projects or similar. + The following attributes will be accessible in a Permissions class: * ```subject``` - the resource that is currently being tested for authorization * ```parent``` - the parent of the authorization when resource is nested * ```user``` - the user accessing the resource @@ -86,11 +110,11 @@ login_required trustee end ``` -The trustee statement will set up 3 before_filters in your controller: +The trustee statement will set up 3 before_filters (before_actions) in your controller: ``` Ruby before_filter :set_user before_filter :load_resource before_filter :access_control @@ -211,9 +235,17 @@ ``` You can even assign these if you like. The resource is also exposed as helper, so you can access it in views. For simplicity we have also exposed an ```instances``` accessor that you can assign when you have a multirecord result, such as for index action. + +Accessing strong_params for updates (rails 4) + +``` Ruby + @invoice.update_attributes(resource.strong_params) + # or + resource.instance.update_attributes(resource.strong_params) +``` ## Overriding defaults ### Overriding resource permits in the controller