I have a plugin that adds a model, server, which has a user_id field. I want only the owner of the server to be able to make a POST (or maybe it should be a PUT?–the action will do a command-line rebuild of a Discourse instance on their server`; I’m not sure which would be best practice.) In config…

Can’t you pass a method to before_action to check your condition?

I think that the permissions need to be enforced in the controller or the constraints. The model doesn’t know who is calling it, I think. Thanks very much for thinking about this.

I think you need a guardian method to check if a user is allowed to perform a given action. for e.g. can_upgrade_server? Also, once you do that, you can use guardian.ensure_can_upgrade_server! method which checks the condition and raises an exception which I think is exactly what you want.

Ooooh! Guardian method! Yes! I’ll look at those! Thanks.

The only model that uses guardian is the user model . It looks like most of the action with guardian is in the controllers. For example, the categories controller uses ensure_can_create_category , which I think is magically created over in lib/guardian.rb . But for now, I’m not using guardian because…

أفضل طريقة لفرض الأذونات - وحدة التحكم أم القيد؟

مطور

pfaffman (Jay Pfaffman) 18 يناير 2021، 2:29م 5

أوه! طريقة الحارس! نعم! سأراجعها! شكرًا لك.

الموضوع		الردود	مرات العرض
Proper place to propose a permissions predicate? Development	1	137	21 فبراير 2025
Guardian before and after checks api Development	4	344	29 يوليو 2024
More detailed response for API /post_actions failures Development	4	1215	25 أبريل 2017
How to add route to root path Development	3	540	8 أبريل 2021
Allow specifiy user different from guardian.user in chat services such as Chat::CreateMessage Feature chat	3	694	4 ديسمبر 2023

أفضل طريقة لفرض الأذونات - وحدة التحكم أم القيد؟

الموضوعات ذات الصلة