A base policy class for authorizing controller actions with access to the current_user and object.
Add this line to your application's Gemfile:
gem'action_authorization'And then execute:
bundleOr install it with:
gem install action_authorizationActionAuthorization requires a current_user method that returns the currently logged in user.
Include the ActionAuthorization module in your ApplicationController (or indvidual controller(s))
classApplicationController < ActionController::BaseincludeActionAuthorizationendCreate an authorization policy for a resource.
classDocumentPolicy < ActionAuthorization::BasePolicydefshow?document.owner == userendendCall authorize method in controller action.
classDocumentController < ApplicationControllerdefshow@document=authorize(Document.find(params[:id]))endendPass a policy_class to authorize to override the default resource based policy.
classDocumentController < ApplicationControllerdefshow@document=authorize(Document.find(params[:id]),policy_class: UserOwnerPolicy)endendCheck if authorized before displaying a link in the view.
<%= link_to(@document.name, @document) if policy(@document).show? %>The gem is available as open source under the terms of the MIT License.