Authorization with RESTful_ACL (index)

I’m using the latest RESTful_ACL plugin -

  • and so far it has fulfilled my app needs…
    I control the access to the several models depending on the user’s
    role and the REST action.
    Although, I have a question:

For example, imagine that I have an User, each User can have many
Numbers, and each Number can have many Profiles.
A User can only access his Numbers and hence only the Profiles
associated with each of those Numbers he owns.

Imagine that I have an User 1, which owns the Number 1, which has a
Profile 1.
And there’s another User 2, which owns the Number 2, which has a
Profile 2.

I can protect the access to a particular Number and Profile using
self.is_readable_by(user. object). User 1 is successfully blocked when
trying to access /numbers/2 and /numbers/2/profiles/2
But I’m having problems finding a way to not allow a User to access
the index of Profiles for a Number that he doesn’t own.

How could I protect the User 1 from accessing the index of Profiles
belonging to User 2? /numbers/2/profiles

Thanks for using RESTful_ACL!

What you’re trying to do is simple with v2.0+:

class Profile < ActiveRecord::Base
logical_parent :number

belongs_to :number

This method checks permissions for the :index action

def self.is_indexable_by(user, parent = nil)
user.number == parent
end

end

Jm Freitas wrote:

Many thanks for the reply, issue solved!!!
Keep up with the good work :slight_smile:

  1. Awesome.
  2. Thanks :wink:

Many thanks for the reply, issue solved!!!
Keep up with the good work :slight_smile: