Skip to content

Commit

Permalink
Resource Controller: Allow overriding authorize_resource
Browse files Browse the repository at this point in the history
In a host app, I want to use scopes as resource models for index actions.
Scopes can not be authorized through CanCanCan like actual models can.

This is a pretty remote use case, so I won't try baking that into the
already pretty complex resource handling system. However, it would be
convenient to be able to override the authorization logic from my host app.
This commit achieves that.
  • Loading branch information
mamhoff committed Jul 29, 2017
1 parent a62fa91 commit ad8852b
Showing 1 changed file with 5 additions and 3 deletions.
8 changes: 5 additions & 3 deletions app/controllers/alchemy/admin/resources_controller.rb
Original file line number Diff line number Diff line change
Expand Up @@ -13,9 +13,7 @@ class ResourcesController < Alchemy::Admin::BaseController
before_action :load_resource,
only: [:show, :edit, :update, :destroy]

before_action do
authorize!(action_name.to_sym, resource_instance_variable || resource_handler.model)
end
before_action :authorize_resource

def index
@query = resource_handler.model.ransack(params[:q])
Expand Down Expand Up @@ -112,6 +110,10 @@ def load_resource
instance_variable_set("@#{resource_handler.resource_name}", resource_handler.model.find(params[:id]))
end

def authorize_resource
authorize!(action_name.to_sym, resource_instance_variable || resource_handler.model)
end

# Permits all parameters as default!
#
# THIS IS INSECURE! Although only signed in admin users can send requests anyway, but we should change this.
Expand Down

0 comments on commit ad8852b

Please sign in to comment.