我正在尝试学习如何在Rails 4应用程序中使用Pundit。
我有以下型号:
class User < ActiveRecord::Base
has_one :profile
has_many :eois
end
class Profile < ActiveRecord::Base
belongs_to :user
has_many :projects, dependent: :destroy
end
class Project < ActiveRecord::Base
belongs_to :profile
has_many :eois
end
class Eoi < ActiveRecord::Base
belongs_to :project
belongs_to :user
end
我的作用域
EoiPolicy
具有:class EoiPolicy < ApplicationPolicy
class Scope
attr_reader :user, :scope
def initialize(user, scope)
@user = user
@scope = scope
end
def resolve
if user.profile.project.id == @eoi.project_id?
scope.where(project_id: @user.profile.project.id)
elsif user.id == eoi.user_id?
scope.where(user_id: user.id)
else
nil
end
end
end
def index?
user.profile.project.id == @eoi.project_id? or user.id == eoi.user_id?
end
def new?
true
end
def show?
user.profile.project.id == @eoi.project_id? or user.id == eoi.user_id?
end
def edit?
user.id == eoi.user.id?
end
def create?
true
end
def update?
user.id == eoi.user.id?
end
def destroy?
user.id == eoi.user.id?
end
end
在我的
EoisController
中,我尝试将范围用于:def index
# @eois = @project.eois
@eois = policy_scope(Eoi)
# @eois = Eois.find_by_project_id(params[:project_id])
end
然后在我的
view/eois/index
中,我尝试使用以下方式显示索引:<% policy_scope(@user.eois).each do |group| %>
我无法使它正常工作。错误消息在策略中突出显示了我的范围方法的这一行:
if user.profile.project.id == @eoi.project_id?
对我来说,这看起来是正确的,尽管我仍在设法弄清楚。任何人都可以看到进行这项工作需要发生什么情况,以便如果用户是用户,而其个人资料拥有相关项目,则与该项目有关的所有eois都是可见的。
否则,如果用户是创建eoi的用户,那么可见他们创建的所有eois?
错误消息显示:
undefined method `project' for #<Profile:0x007fa03f3faf48>
Did you mean? projects
projects=
我想知道这是否是因为索引将具有许多记录,它需要在策略中显示不同的内容以识别复数吗?
我也尝试过用:
if @eoi.project_id == @user.profile.project.id?
虽然那也是错误的,并且给出了
undefined method `project_id' for nil:NilClass
Did you mean? object_id
我还尝试了范围:
def resolve
# cant figure what is wrong with this
if eoi.project_id == user.profile.project.id?
scope.where(project_id: @user.profile.project.id)
else
nil
end
end
但这也是错误的,并给出此错误:
undefined local variable or method `eoi' for #<EoiPolicy::Scope:0x007ffb505784f8>
我也尝试过:
def resolve
# cant figure what is wrong with this
if @eoi.project_id == user.profile.project.id? or Eoi.project_id == user.profile.project.id?
scope.where(project_id: @user.profile.project.id)
elsif user.id == eoi.user_id?
scope.where(user_id: user.id)
else
nil
end
end
end
def index?
user.profile.project.id == Eoi.project_id? or user.id == Eoi.user_id?
end
但是这种尝试会给出以下错误消息:
undefined method `project_id' for nil:NilClass
Did you mean? object_id
当前思想
我认为我需要传递的不仅仅是用户和作用域。如果我也可以通过项目,那么我可以使范围引用与EoI相关的项目。
如果我可以执行此操作,那么也许可以使scope方法适用于控制器上的索引视图:
class Scope
attr_reader :user, :scope
def initialize(user, scope, project)
@user = user
@scope = scope
@project = project
end
end
然后在控制器中:
def index
# @eois = @project.eois
@eois = policy_scope(Eoi, @project)
# authorize @eois
# @eois = Eois.find_by_project_id(params[:project_id])
end
这不起作用,当我尝试时出现错误,指出该政策
wrong number of arguments (given 2, expected 1)
请帮忙!
下次尝试
我的下一个尝试是尝试从[this] Pundit问题中获取建议,并实施该想法以获取特定用户的正确范围。
在我的Eoi政策中,我将解决方法更改为:
class Scope
attr_reader :user, :scope
def initialize(user, scope) #project
@user = user
@scope = scope
# @project = project
end
def resolve
# if Eoi.project_id == user.profile.project.id? or Eoi.project_id == user.profile.project.id?
if user.id == eoi.projects.profile.user.map(&:id)
scope.joins(eois: :projects).where(project_id: user.profile.projects.map(&:id)).empty?
# if scope.eoi.project_id == user.profile.projects.map(&:id)
# scope.where(project_id: user.profile.projects.map(&:id)).empty?
# scope.where(project_id: user.profile.project.id)
# elsif user.id == eoi.user_id?
# scope.where(user_id: user.id)
else
# nil
end
end
end
然后在我的eoi控制器索引操作中,我尝试了以下操作:
def index
# @eois = @project.eois
# @eois = policy_scope(Eoi, @project)
policy_scope(Eoi).where(project_id: params[:project_id])
# authorize @eois
# @eois = Eois.find_by_project_id(params[:project_id])
end
那也不起作用。此尝试的错误消息显示:
undefined local variable or method `eoi' for #<EoiPolicy::Scope:0x007f98677c9cf8>
我没有尝试的想法。谁能看到一种为示波器提供正确输入以进行设置的方法?
观察
我注意到,在github上将Pundit与范围一起使用的许多存储库也包括这样的方法:
def scope
Pundit.policy_scope!(user, record.class)
end
该方法是Scope类的补充,并且在Pundit gem文档中未显示。如果有必要包括在内,该怎么办?
1
改写
我现在已经在github上浏览了200多个回购协议,以了解我应该如何编写策略来实现自己的目标。我没有关于如何按预期使用Pundit的想法。
我已经完全更改了设置,以尝试解决我无法理解的问题。我现在有:
Eois控制器
class EoisController < ApplicationController
def index
@eois = Eoi.by_user_id(current_user.id)
end
end
项目:: Eois控制器
module Projects
class EoisController < ApplicationController
before_action :get_project
before_action :set_eoi, only: [:edit, :update, :destroy]
# after_action :verify_authorized
def index
@eois = Project.by_user_id(current_user.id).find_by(id: params[:project_id]).try(:eois) || []
end
def show
@eoi = Eoi.find(params[:id])
authorize @eoi
end
def set_eoi
@eoi = EoiPolicy::Scope.new(current_user, params[:project_id]).resolve.find(params[:id])
end
def get_project
@project = Project.find(params[:project_id])
end
Eoi政策(决定何时显示用户制作的所有eois)
class EoiPolicy < ApplicationPolicy
class Scope
attr_reader :user, :scope
def initialize(user, scope)
@user = user
@scope = scope
end
def resolve
if scope.present?
Eoi.by_user_id(user.id)
# end
else
[]
end
end
end
def index?
user.profile.project.id == Eoi.project_id? or user.id == Eoi.user_id?
end
def new?
true
end
def show?
record.user_id == user.id || user.profile.project_id == record.project_id
# user.profile.project.id == @eoi.project_id? or user.id == eoi.user_id?
end
def edit?
user.id == eoi.user.id?
end
def create?
true
end
def update?
user.id == eoi.user.id?
end
def destroy?
user.id == eoi.user.id?
end
end
路线
resources :eois
resources :projects do
member do
resources :eois, controller: 'projects/eois
end
当我想显示与项目相关的EoI时,我使用了Projects Eoi Policy;当我想显示用户创建的Eois时,我使用了Eoi Policy-无范围。
我很想弄清楚这一点,以便可以按预期的方式使用此gem。意见将不胜感激。我确定这种尝试不是Pundit的意思-但我无法弄清楚如何使用文档中所示的gem。
我无法使用policy_scope,因为我需要将project_id参数传递给项目eoi控制器index操作的index操作。
PaReeOhNos建议
下面列出了我尝试实施PareeOhNos建议的尝试。我不确定我是否理解正确,因为eois总是会有项目ID和用户ID,但是也许我不明白load_parent方法在做什么。
在我的Eois控制器中,我有:
class EoisController < ApplicationController
before_action :load_parent
before_action :load_eoi, only: [:show, :edit, :update, :destroy]
def index
authorize @parent
@eois = EoiPolicy::Scope.new(current_user, @parent).resolve
end
def show
end
# GET /eois/new
def new
@project = Project.find(params[:project_id])
@eoi = @project.eois.build
@contribute = params[:contribute] || false
@participate = params[:participate] || false
@partner = params[:partner] || false
@grant = params[:grant] || false
@invest = params[:invest] || false
end
# GET /eois/1/edit
def edit
end
# POST /eois
# POST /eois.json
def create
@eoi = Project.find(params[:project_id]).eois.build(eoi_params)
@eoi.user_id = @current_user.id
respond_to do |format|
if @eoi.save
format.html { redirect_to Project.find(params[:project_id]), notice: 'Eoi was successfully created.' }
format.json { render :show, status: :created, location: @project }
else
format.html { render :new }
format.json { render json: @eoi.errors, status: :unprocessable_entity }
end
end
end
# PATCH/PUT /eois/1
# PATCH/PUT /eois/1.json
def update
respond_to do |format|
if @eoi.update(eoi_params)
format.html { redirect_to @project, notice: 'Eoi was successfully updated.' }
format.json { render :show, status: :ok, location: @eoi }
else
format.html { render :edit }
format.json { render json: @eoi.errors, status: :unprocessable_entity }
end
end
end
# DELETE /eois/1
# DELETE /eois/1.json
def destroy
@eoi.destroy
respond_to do |format|
format.html { redirect_to @project, notice: 'Eoi was successfully destroyed.' }
format.json { head :no_content }
end
end
private
def load_parent
# @parent = (params[:project_id] ? Project.find(params[:project_id] : current_user)
@parent = params[:project_id] ? Project.find(params[:project_id]) : current_user
end
def load_eoi
@eoi = Eoi.find(params[:id])
authorize @eoi
end
在我的Eoi政策中,我有:
class EoiPolicy < ApplicationPolicy
class Scope
attr_reader :user, :scope
def initialize(user, scope)
@user = user
@scope = scope
end
def resolve
if scope.is_a?(User)
Eoi.where(user_id: scope.id)
elsif scope.is_a?(Project)
Eoi.where(project_id: scope.id)
else
[]
end
end
end
def index?
record.is_a?(User) || user.profile.project.id == record.project_id
end
def new?
true
end
def show?
record.user_id == user.id || user.profile.project_id == record.project_id
end
def edit?
user.id == eoi.user.id?
end
def create?
true
end
def update?
user.id == eoi.user.id?
end
def destroy?
user.id == eoi.user.id?
end
end
在我的routes.rb中,我有:
resources :projects do
member do
resources :eois, shallow: true
resources :eois, only: [:index]
在我的eois / index中,我有:
<% @eois.sort_by(&:created_at).in_groups_of(2) do |group| %>
<% group.compact.each do |eoi| %>
<h4><%= link_to eoi.user.full_name %></h4>
<%= link_to 'VIEW DETAILS', eoi_path(eoi), :class=>"portfolio-item-view" %>
<% end %>
<% end %>
在我的eois /节目中,我有:
"test"
当我尝试所有这些操作时,将加载eois / index页面。当我尝试显示特定的eoi页面时,出现错误消息:
wrong number of arguments (given 2, expected 0)
错误消息指向授权控制器的@eoi行:
def load_eoi
@eoi = Eoi.find(params[:id])
authorize @eoi
end
如果我在show action中而不是load eoi方法中放置了@eoi,则会出现相同的错误。
有申请政策
class ApplicationPolicy
attr_reader :user, :scope
class Scope
def initialize(user, scope)
#byebug
@user = user
# record = record
@scope = scope
end
def resolve
scope
end
end
def index?
false
end
def show?
scope.where(:id => record.id).exists?
end
def create?
false
end
def new?
create?
end
def update?
false
end
def edit?
update?
end
def destroy?
false
end
def scope
Pundit.policy_scope!(user, record.class)
end
下次尝试
采纳PaReeOhNos建议(上面已复制),我尝试对其进行一些调整以使其更适合我的用例。
我现在有:
Eoi控制器
class EoisController < ApplicationController
# before_action :get_project
# before_action :set_eoi, only: [:show, :edit, :update, :destroy]
before_action :load_parent
before_action :load_eoi, only: [:show, :edit, :update, :destroy]
# GET /eois
# GET /eois.json
# def index
# @eois = @project.eois
# # @eois = Eois.find_by_project_id(params[:project_id])
# end
def index
# authorize @parent
@eois = policy_scope(Eoi.where(project_id: params[:project_id]))
# @eois = EoiPolicy::Scope.new(current_user, @parent).resolve
end
# GET /eois/1
# GET /eois/1.json
def show
end
# GET /eois/new
def new
@project = Project.find(params[:project_id])
@eoi = @project.eois.build
@contribute = params[:contribute] || false
@participate = params[:participate] || false
@partner = params[:partner] || false
@grant = params[:grant] || false
@invest = params[:invest] || false
end
# GET /eois/1/edit
def edit
end
# POST /eois
# POST /eois.json
def create
@eoi = Project.find(params[:project_id]).eois.build(eoi_params)
@eoi.user_id = @current_user.id
respond_to do |format|
if @eoi.save
format.html { redirect_to Project.find(params[:project_id]), notice: 'Eoi was successfully created.' }
format.json { render :show, status: :created, location: @project }
else
format.html { render :new }
format.json { render json: @eoi.errors, status: :unprocessable_entity }
end
end
end
# PATCH/PUT /eois/1
# PATCH/PUT /eois/1.json
def update
respond_to do |format|
if @eoi.update(eoi_params)
format.html { redirect_to @project, notice: 'Eoi was successfully updated.' }
format.json { render :show, status: :ok, location: @eoi }
else
format.html { render :edit }
format.json { render json: @eoi.errors, status: :unprocessable_entity }
end
end
end
# DELETE /eois/1
# DELETE /eois/1.json
def destroy
@eoi.destroy
respond_to do |format|
format.html { redirect_to @project, notice: 'Eoi was successfully destroyed.' }
format.json { head :no_content }
end
end
private
def load_parent
# @parent = (params[:project_id] ? Project.find(params[:project_id] : current_user)
@parent = params[:project_id] ? Project.find(params[:project_id]) : current_user
end
def load_eoi
@eoi = Eoi.find(params[:id])
# authorize @eoi
end
经济政策
class EoiPolicy < ApplicationPolicy
class Scope
attr_reader :user, :scope
def initialize(user, scope)
@user = user
@scope = scope
end
def resolve
# since we send the scoped eois from controller, we can pick
# any eoi and get its project id
# check if the current user is the owner of the project
# if (user.profile.projects.map(&:id).include?(project_id))
# # user is the owner of the project, get all the eois
# scope.all
# end
# #not the owner , then get only the eois created by the user
# scope.where(user_id: user.id)
# end
if scope.is_a?(User)
Eoi.where(user_id: scope.id)
elsif scope.is_a?(Project) && (user.profile.projects.map(&:id).include?(project_id))
project_id = scope.first.project_id
Eoi.where(project_id: scope.id)
else
Eoi.none
end
end
end
def index?
record.is_a?(User) || user.profile.project.id == record.project_id
end
def new?
true
end
def show?
record.user_id == user.id || user.profile.project_id == record.project_id
end
def edit?
user.id == eoi.user.id?
end
def create?
true
end
def update?
user.id == eoi.user.id?
end
def destroy?
user.id == eoi.user.id?
end
end
路线
resources :eois#, only: [:index]
concern :eoiable do
resources :eois
end
resources :projects do
concerns :eoiable
end
指数
<% @eois.sort_by(&:created_at).in_groups_of(2) do |group| %>
<% group.compact.each do |eoi| %>
<h4><%= link_to eoi.user.full_name %></h4>
<%= link_to 'VIEW DETAILS', project_eoi_path(eoi.project, eoi), :class=>"portfolio-item-view" %>
<% end %>
<% end %>
视图
'test'
这不起作用,因为当我导航到一个项目然后尝试呈现具有匹配项目ID的eois索引时,当数据库中有4条记录需要呈现时,我得到了一个空的索引页。
LEITO的建议
采纳Leito的建议,我还尝试了以下方法:
Eoi控制器
class EoisController < ApplicationController
before_action :get_project
before_action :set_eoi, only: [:show, :edit, :update, :destroy]
# before_action :load_parent
# before_action :load_eoi, only: [:show, :edit, :update, :destroy]
# GET /eois
# GET /eois.json
# def index
# @eois = @project.eois
# # @eois = Eois.find_by_project_id(params[:project_id])
# end
def index
# authorize @eois
# authorize @parent
# policy_scope(@project.eois)
@eois = policy_scope(Eoi.where(project_id: params[:project_id]))
# @eois = EoiPolicy::Scope.new(current_user, @parent).resolve
end
# GET /eois/1
# GET /eois/1.json
def show
end
# GET /eois/new
def new
@project = Project.find(params[:project_id])
@eoi = @project.eois.build
@contribute = params[:contribute] || false
@participate = params[:participate] || false
@partner = params[:partner] || false
@grant = params[:grant] || false
@invest = params[:invest] || false
end
# GET /eois/1/edit
def edit
end
# POST /eois
# POST /eois.json
def create
@eoi = Project.find(params[:project_id]).eois.build(eoi_params)
@eoi.user_id = @current_user.id
respond_to do |format|
if @eoi.save
format.html { redirect_to Project.find(params[:project_id]), notice: 'Eoi was successfully created.' }
format.json { render :show, status: :created, location: @project }
else
format.html { render :new }
format.json { render json: @eoi.errors, status: :unprocessable_entity }
end
end
end
# PATCH/PUT /eois/1
# PATCH/PUT /eois/1.json
def update
respond_to do |format|
if @eoi.update(eoi_params)
format.html { redirect_to @project, notice: 'Eoi was successfully updated.' }
format.json { render :show, status: :ok, location: @eoi }
else
format.html { render :edit }
format.json { render json: @eoi.errors, status: :unprocessable_entity }
end
end
end
# DELETE /eois/1
# DELETE /eois/1.json
def destroy
@eoi.destroy
respond_to do |format|
format.html { redirect_to @project, notice: 'Eoi was successfully destroyed.' }
format.json { head :no_content }
end
end
private
# def load_parent
# # @parent = (params[:project_id] ? Project.find(params[:project_id] : current_user)
# @parent = params[:project_id] ? Project.find(params[:project_id]) : current_user
# end
# def load_eoi
# @eoi = Eoi.find(params[:id])
# # authorize @eoi
# end
# # Use callbacks to share common setup or constraints between actions.
def set_eoi
@eoi = Eoi.find(params[:id])
end
def get_project
@project = Project.find(params[:project_id])
end
经济政策
def initialize(user, scope)
@user = user
@scope = scope
end
def resolve
if scope.joins(project: :profile).where profiles: { user_id: user }
Eoi.where(project_id: scope.ids)
elsif scope.joins(eoi: :user).where eois: { user_id: user }
Eoi.where(user_id: scope.ids)
else
Eoi.none
end
# since we send the scoped eois from controller, we can pick
# any eoi and get its project id
# check if the current user is the owner of the project
# if (user.profile.projects.map(&:id).include?(project_id))
# # user is the owner of the project, get all the eois
# scope.all
# end
# #not the owner , then get only the eois created by the user
# scope.where(user_id: user.id)
# end
# if scope.is_a?(User)
# Eoi.where(user_id: scope.id)
# elsif scope.is_a?(Project) && (user.profile.projects.map(&:id).include?(project_id))
# project_id = scope.first.project_id
# Eoi.where(project_id: scope.id)
# else
# Eoi.none
# end
end
end
def index?
true
# record.is_a?(User) || user.profile.project.id == record.project_id
end
def new?
true
end
def show?
true
# record.user_id == user.id || user.profile.project_id == record.project_id
end
def edit?
user.id == eoi.user.id?
end
def create?
true
end
def update?
user.id == eoi.user.id?
end
def destroy?
user.id == eoi.user.id?
end
end
路线和观点与上面的尝试相同
这里的问题是控制器中的get project方法。对于Im试图显示特定项目的所有eois的情况,我需要这样做。当我尝试显示用户的所有eois时,我不需要它。
当我保存所有这些并尝试时,项目上的eois正确显示。但是,应该向我展示我所有(作为用户的)eois的eois(未嵌套在项目中)显示错误,该错误为:
Couldn't find Project with 'id'=
错误消息突出显示了“ get_project方法”。
LEITO的最新建议
根据Leito的最新建议,我已经提出了当前的尝试。
在此之前,我想澄清一下,所有Eois都将具有用户ID和项目ID。我使用此表让用户表达对项目的兴趣。我的目标是让其个人资料拥有该项目的用户查看该项目上提交的所有eois。然后,我还希望用户看到自己提交的所有eois(在所有项目中)。
经济政策
def resolve
if scope.joins(project: :profile).where 'profiles.user_id = ? OR eois.user_id = ?', user.id, user.id
Eoi.all
else
Eoi.none
end
Eoi控制器
def index
@eois = policy_scope(Eoi)
@eois = @eois.where(project_id: params[:project_id]) if params[:project_id]
end
目前,这在查找嵌套在项目(project / 26 / eois)下的eois时效果很好。但是,当我尝试执行eois / index(不嵌套在项目下)时,我想返回所有用户的eois,因此出现错误消息:
Couldn't find Project with 'id'=
它突出显示了eoi控制器的这一行:
def get_project
@project = Project.find(params[:project_id])
end
我不确定现在是否了解解决方法或控制器剔除的想法。我看不到范围线有什么问题,可以尝试更改。
最佳答案
我是该问题的前任评论员。
对于您的EoiScope,您只需要用户有权访问的Eois(因为它们属于此配置文件下的项目),而与项目无关(此要求仅适用于控制器,因为它是嵌套的),因此控制器应该看起来像这个:
编辑:根据您的最新尝试,我已经更新了范围以说明直接属于用户的Eois(而不是通过项目),并且您应该仅根据参数params [:project_id]的存在将其范围限制为项目,请参阅更新的答案。
@eois = policy_scope(Eoi)
@eois = @eios.where(project_id: params[:project_id]) if params[:project_id]
并且您的范围应该进行连接,直到到达用户为止,或者仅在Eoi上查找user_id属性。
class EoiPolicy < ApplicationPolicy
class Scope < Scope
def resolve
scope.joins(project: : profile).where 'profiles.user_id = ? OR eois.user_id = ?', user.id, user.id
end
end
# Other methods that differ from ApplicationPolicy's methods
end
请注意,作用域不调用
eoi
,但是默认*作用域仅知道scope
和user
。 *默认情况下,我的意思是当它从ApplicationPolicy::Scope
继承时
关于ruby-on-rails - Rails 4-Pundit-索引范围的策略,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/39186881/