an aside to clarify: current_user is only available in views and controllers. acting_user isn't natively there either, just passed along by the original permissions method call.
permissions control what users can do/see. the views changing in response to that is just nice, the primary goal is to secure who can see/do what to different models. really, the controller code is just tweaking what it grabs so that the pagination comes out cleanly. if someone can think of a way to reflectively figure out what activerecord sql calls need to be made based off permissions then that'd need would go away but that's a pretty nasty problem. there is a small example indirectly in the cookbook code of ownership and how to easily extract common model code/design into modules. http://github.com/tablatom/hobocookbook/blob/master/app/models/owned_model.rb is where it defines a new module that includes an ownership association and default permissions. then models that follow that pattern (even if just mostly) can include the module and override any permissions methods you need to change. IMO, hobo design workflow is best when you: setup models and model relations, then model permissions, then viewhints, and lastly controller and view tweaks. so, in your case, you should still set permissions even though the finally product won't quite be what you want, it's a relatively small tweak later to get the controller code right. On Apr 13, 8:07 am, "[email protected]" <[email protected]> wrote: > Is there a way in the permissions and associations system to use > "user_id" and current_user instead of "owner_id" and Owner > associations (acting_user == owner, owner_is?(acting_user), etc) ... > using user_id and owner_id in every record seems redundant, or am I > thinking about this in the wrong way? > > From what you all have said, I need to re-define the model to return > current_user records in the controller class and in the model class > use owner associations in the permissions system .... is there a more > complete working application example that you could point me to, as > the Agility tutorial doesn't quite show how this would all work > together in the best manner and I'm having a hard time understanding > the logistics of such a system. It's such a common design pattern that > each user can only manipulate records that belong to them that I'm > sure this must be fairly straightforward. > > thanks, > Jeremy > > On Apr 12, 6:13 pm, kevinpfromnm <[email protected]> wrote: > > > You should set the permissions as appropriate but still setting the > > finder action makes the pagination work better and gives accurate > > total results. > > > On Apr 12, 1:53 pm, "[email protected]" <[email protected]> > > wrote: > > > > So after going through the agility tutorial, it does seem that I can > > > do what I want just by using the permissions system, by using owner_id > > > and the associated methods and checks for owner and acting_user > > > instead of using current_user and user_id in my models ... which is > > > fine. > > > > It is all a bit much to take in, going to need to spend some time > > > learning the permission system better. > > > > --jeremy > > > > On Apr 7, 12:01 pm, Matt Jones <[email protected]> wrote: > > > > > On Apr 7, 2010, at 11:06 AM, [email protected] wrote: > > > > > > Thanks Matt, that actually helps a lot ! > > > > > > One thing though, I no longer have the "New Task" link present on my > > > > > tasks tab in the application, whether I'm the administrator or another > > > > > user, and I get a stack trace when trying to access the tasks tab when > > > > > I am the guest user. When I comment out the lines added, the link > > > > > comes back ... > > > > > I'm guessing it's a permissions issue, yes. I'll take a look at it > > > > this evening. The stack trace is likely because the Guest model > > > > doesn't have a tasks association. On the other hand, I would have > > > > assumed that you'd have set :login_required as a before_filter on that > > > > page anyways, given the user-specific behavior. > > > > > > I'm a total newb to Hobo and fairly new to rails (flex/php background) > > > > > so if these questions and their answers seem obvious please excuse my > > > > > ignorance ... thanks again --- this is really great stuff !! > > > > > ' > > > > No worries - the permissions code can be some of the trickiest stuff > > > > to get right. It can be annoying when you change a permission method > > > > and something important vanishes from a page. > > > > > --Matt Jones > > -- You received this message because you are subscribed to the Google Groups "Hobo Users" group. To post to this group, send email to [email protected]. To unsubscribe from this group, send email to [email protected]. For more options, visit this group at http://groups.google.com/group/hobousers?hl=en.
