Introduce Model.accessible_through

[xjunior]

Provides a scope within the model to find instances of the model accessible by the given ability within the given action/subject permission pair.

I.E.:

Given the scenario below

class Department < ActiveRecord::Base
end

class User < ActiveRecord::Base
  belongs_to :department
end

class Ability
  include CanCan::Ability

  def initialize(user)
    can :contact, User, { department: { id: user.department_id } }
    can :contact, User, { department: { id: user.managing_department_ids } } if user.manager?
  end
end

The following would give you a list of departments that the given ability can contact their users:

> user = User.new(department_id: 13, manager: false)
> ability = Ability.new(user)
> Department.accessible_through(ability, :contact, User).to_sql
=> SELECT * FROM departments WHERE id = 13
#
> user = User.new(department_id: 13, managing_department_ids: [2, 3, 4], manager: true)
> ability = Ability.new(user)
> Department.accessible_through(ability, :contact, User).to_sql
=> SELECT * FROM departments WHERE ((id = 13) OR (id IN (2, 3, 4)))

Sometimes the name of the relation doesn't match the model:

class User < ActiveRecord::Base
  has_many :managing_users, class_name: "User", foreign_key: :managed_by_id
end

class Ability
  include CanCan::Ability

  def initialize(user)
    can :contact, User, { managing_users: { id: user.department_id } }
  end
end

When that happens, you can override it with relation. This would give you a list of departments that the given ability can contact their users:

> user = User.new(department_id: 13, manager: false)
> ability = Ability.new(user)
> Department.accessible_through(ability, :contact, User, relation: :managing_users).to_sql
=> SELECT * FROM departments WHERE id = 13
>
> user = User.new(department_id: 13, managing_department_ids: [2, 3, 4], manager: true)
> ability = Ability.new(user)
> Department.accessible_through(ability, :contact, User, relation: :managing_users).to_sql
=> SELECT * FROM departments WHERE ((id = 13) OR (id IN (2, 3, 4)))

[garettarrowood]

LGTM! This would be helpful.

[coorasse]

I am not exactly sure that I understand the use case. It feels to me that you should be able to do that already with Department.accessible_by(:contact, current_ability)

[xjunior]

@coorasse not really, because the rules are defined on User, not on Department.

    can :contact, User, { department: { id: user.department_id } }
    can :contact, User, { department: { id: user.managing_department_ids } } if user.manager?