Thanks Kevin, I'll take a look at the owned_model.rb On Apr 13, 4:48 pm, kevinpfromnm <[email protected]> wrote: > an aside to clarify: current_user is only available in views and > controllers. acting_user isn't natively there either, just passed > along by the original permissions method call. > > permissions control what users can do/see. the views changing in > response to that is just nice, the primary goal is to secure who can > see/do what to different models. > > really, the controller code is just tweaking what it grabs so that the > pagination comes out cleanly. if someone can think of a way to > reflectively figure out what activerecord sql calls need to be made > based off permissions then that'd need would go away but that's a > pretty nasty problem. > > there is a small example indirectly in the cookbook code of ownership > and how to easily extract common model code/design into > modules.http://github.com/tablatom/hobocookbook/blob/master/app/models/owned_... > is where it defines a new module that includes an ownership > association and default permissions. then models that follow that > pattern (even if just mostly) can include the module and override any > permissions methods you need to change. > > IMO, hobo design workflow is best when you: setup models and model > relations, then model permissions, then viewhints, and lastly > controller and view tweaks. so, in your case, you should still set > permissions even though the finally product won't quite be what you > want, it's a relatively small tweak later to get the controller code > right. > > On Apr 13, 8:07 am, "[email protected]" <[email protected]> > wrote: > > > > > Is there a way in the permissions and associations system to use > > "user_id" and current_user instead of "owner_id" and Owner > > associations (acting_user == owner, owner_is?(acting_user), etc) ... > > using user_id and owner_id in every record seems redundant, or am I > > thinking about this in the wrong way? > > > From what you all have said, I need to re-define the model to return > > current_user records in the controller class and in the model class > > use owner associations in the permissions system .... is there a more > > complete working application example that you could point me to, as > > the Agility tutorial doesn't quite show how this would all work > > together in the best manner and I'm having a hard time understanding > > the logistics of such a system. It's such a common design pattern that > > each user can only manipulate records that belong to them that I'm > > sure this must be fairly straightforward. > > > thanks, > > Jeremy > > > On Apr 12, 6:13 pm, kevinpfromnm <[email protected]> wrote: > > > > You should set the permissions as appropriate but still setting the > > > finder action makes the pagination work better and gives accurate > > > total results. > > > > On Apr 12, 1:53 pm, "[email protected]" <[email protected]> > > > wrote: > > > > > So after going through the agility tutorial, it does seem that I can > > > > do what I want just by using the permissions system, by using owner_id > > > > and the associated methods and checks for owner and acting_user > > > > instead of using current_user and user_id in my models ... which is > > > > fine. > > > > > It is all a bit much to take in, going to need to spend some time > > > > learning the permission system better. > > > > > --jeremy > > > > > On Apr 7, 12:01 pm, Matt Jones <[email protected]> wrote: > > > > > > On Apr 7, 2010, at 11:06 AM, [email protected] wrote: > > > > > > > Thanks Matt, that actually helps a lot ! > > > > > > > One thing though, I no longer have the "New Task" link present on my > > > > > > tasks tab in the application, whether I'm the administrator or > > > > > > another > > > > > > user, and I get a stack trace when trying to access the tasks tab > > > > > > when > > > > > > I am the guest user. When I comment out the lines added, the link > > > > > > comes back ... > > > > > > I'm guessing it's a permissions issue, yes. I'll take a look at it > > > > > this evening. The stack trace is likely because the Guest model > > > > > doesn't have a tasks association. On the other hand, I would have > > > > > assumed that you'd have set :login_required as a before_filter on > > > > > that > > > > > page anyways, given the user-specific behavior. > > > > > > > I'm a total newb to Hobo and fairly new to rails (flex/php > > > > > > background) > > > > > > so if these questions and their answers seem obvious please excuse > > > > > > my > > > > > > ignorance ... thanks again --- this is really great stuff !! > > > > > > ' > > > > > No worries - the permissions code can be some of the trickiest stuff > > > > > to get right. It can be annoying when you change a permission method > > > > > and something important vanishes from a page. > > > > > > --Matt Jones
-- You received this message because you are subscribed to the Google Groups "Hobo Users" group. To post to this group, send email to [email protected]. To unsubscribe from this group, send email to [email protected]. For more options, visit this group at http://groups.google.com/group/hobousers?hl=en.
