可以在模型中使用 cancan 吗？

Question

我有一个带有状态机的模型，我想将不同的状态/事件/转换限制给不同的用户。

如何在这个模型中访问当前用户和能力？

Answer 1

您可以在 cancan 中针对模型提供的任何方法定义能力。状态机转换本身就是模型提供的方法，因此只需像设置任何其他方法一样设置您的能力。

例如，给定一个简单的模型：

class Order < ActiveRecord::Base

  state_machine :initial => :new do

    event :start_processing do
      transition :new => :processing
    end

    event :complete_order do
      transition :processing => :complete
    end

    event :escalate_order do
      transition :processing => :escalated
    end

    event :complete_escalated_order
      transition :escalated => :complete
    end

    state :new
    state :processing
    state :escalated
    state :complete
  end

end

你可以这样定义能力：

class Ability

  if user.role? :orderer
    can [:start_processing, :escalate_order, :complete_order], :orders
  end
  if user.role? :manager
    can :complete_escalated_order, :orders
  end

end

编辑 - 我应该补充一下，然后您将在处理用户请求的控制器中使用这些功能：

class OrdersController < ApplicationController

  def complete
    @order = Order.find_by_ref(params[:id])

    if @order.can_complete_order?
      authorize! :complete_order, @order
      @order.complete_order
    elsif @order.can_complete_escalated_order?
      authorize! :complete_escalated_order, @order
      @order.complete_escalated_order
    else
      redirect_to root_url, :notice => "Order cannot be completed"
    end

    redirect_to my_queue_path, :notice => "Order #{@order.ref} has been marked as complete."

结束