根据所有文档,该:read
操作被别名为:index
和:show
:
alias_action :index, show, :to => :read
但是,请考虑以下具有嵌套资源的场景:
resources :posts
resources :comments
end
如果我这样定义能力:
# ability.rb
can :read, Post
can :show, Comment
# comments_controller.rb
load_and_authorize_resource :organization, :find_by => :permalink
load_and_authorize_resource :membership, :through => :organization
事情按预期工作。但是,如果我将:read
操作更改为 [:index, :show]:
# ability.rb
can [:index, :show], Post
can :show, Comment
# comments_controller.rb
load_and_authorize_resource :organization, :find_by => :permalink
load_and_authorize_resource :membership, :through => :organization
我未经授权访问/posts/:post_id/comments
,/posts/:post_id/comments/:id
等。但是,我仍然可以同时访问:index
和:show
。posts_controller
如果它们的行为不同,这些动作怎么可能被“混淆”?
在我的摆弄中,我还遇到了以下情况。更改load_and_authorize_resource
为以下允许的访问权限:
# ability.rb
can [:index, :show], Post
can :show, Comment
# comments_controller.rb
load__resource :organization, :find_by => :permalink
load_and_authorize_resource :membership, :through => :organization
有人可以解释这里发生了什么吗?