Search code examples
ruby-on-railsruby-on-rails-4cancan

Cancan : User can see its backoffice show view

(Using rails 4, Cancan 1.6.10)

Hello all,

I have two UsersController: one for the front, the other under /backoffice for the back, and both are using the same User model.

I defined abilities for a "normal user" like this : 

can(:manage, User) do |u|
  u == user
end

whereas an admin user will be able to manage all users:

can :manage, User

I also have two "show" views, one in the front: /users/:id and one in the backoffice: /backoffice/users/:id

My problem is that a limited user can today see its profile through the backoffice URL, as he "can Manage this user". (And of course this is not acceptable)

I know this should not be too difficult to correct, but what solution would you use?

Solution

  • There seems to be a way to namespace the abilities. See the Wiki entry of the continued project CanCanCan here: https://github.com/CanCanCommunity/cancancan/wiki/Authorization-for-Namespaced-Controllers

    What it basically does is override the Ability class to pass a namespace that is determined by the ApplicationController. The Ability class has two different rulesets depending on the namespace it is initialized with.