Rails declarative_authorization project_admin角色

Question

我正在尝试使用declarative_authorization gem创建项目管理员和项目协作者角色。

我有一个名为'collaborators‘的表，其中包含用户到项目的映射。

型号：

项目

has_many :collaborators  
has_many :users, :through => :collaborators  

用户

has_many :collaborators
has_many :projects, :through => :collaborators

协作者

belongs_to :user
belongs_to :project

我需要一些关于定义project_admin和project_collaborator角色的领域特定语言的指导。我想出了以下几点：

authorization do
  role :guest do
    has_permission_on :users, :to => [:read]
  end

  role :project_admin do
    has_permission_on :projects, :to => :manage do
      if_attribute :project_admin => true
    end
  end

  role :admin do
    has_permission_on :users, :to => [:delete]
  end
end

privileges do
  privilege :manage do
    includes :create, :read, :update, :delete
  end
end

感谢任何建议/帮助。

谢谢!

Answer 1

我更喜欢这样的东西，这样每个用户都可以成为项目管理员：

项目

has_many :collaborators  
has_many :users, :through => :collaborators 
belongs_to :admin, :table_name => 'users' # Maybe has_many?

authorization_rules.rb

authorization do
  role :guest do
    has_permission_on :users, :to => [:read]
  end

  role :user do
    has_permission_on :projects, :to => :create
    has_permission_on :projects, :to => :manage do
      if_attribute :admin => is { user }
    end
    has_permission_on :projects, :to => :read do
      if_attribute :collaborators => contains { user }
    end
    has_permission_on :files, :to => :manage do
      if_permitted_to :read, :project
    end
  end
end

privileges do
  privilege :manage do
    includes :create, :read, :update, :delete
  end
  privilege :read, :includes => [:index, :show]
  privilege :create, :includes => :new
  privilege :update, :includes => :edit
  privilege :delete, :includes => :destroy
end