ruby-on-rails - before_filter 带参数验证用户权限

Question

在允许用户编辑员工信息之前，我需要确保他们拥有正确的权限。具体来说，用户必须是管理员，并且用户必须与员工属于同一家公司。执行此类操作的最佳方法是什么？

def EmployeesController < ApplicationController
  before_filter :requires_admin_from_company(cid)

  # Only allow access to this if user.admin is true and user.company_id is equal to employee.company_id
  def update
    # Somehow pass @employee.company_id into admin
    @employee = Employee.find(params[:id])
    @employee.update_attributes(params[:employee])
  end

  def requires_admin_from_company(cid)
    if !@current_user.admin? || @current_user.company_id != cid
      redirect_to login_url
    end
  end
end

Answer 1

怎么样

before_filter lambda{ requires_admin_from_company(params[:cid]) }, :only => :create