Action aliases in the controller about action_policy HOT 9 CLOSED

@palkan, you might want to remove https://actionpolicy.evilmartians.io/#/controller_action_aliases that relates to this PR.

from action_policy.

in some of my controllers there are other actions (e.g. sort) and some that are injected by concerns. In that case, it's illogical to keep adding those rule aliases to the policy

Why not using explicit rules in the concerns? That makes more sense, IMO.

I'm also using controllers concerns to add action, and I'm doing like this:

module Voted
  extend ActiveSupport::Concern

  included do
    before_action :set_votable, only: [:vote_up, :vote_down, :cancel_vote]
  end

  def vote_up
    # do smth with @votable
  end

  def set_votable
    @votable = controller_name.classify.constantize.find(params[:id])
    authorize! @votable, to: :manage?
  end
end

from action_policy.

Thanks @palkan, in my case my authorize! is called from a controller superclass. I'd have to restrict its execution to the REST verbs, then use your method to do an alternative authorize! specifying the rule. Seems like a messier approach once I'm dealing with 10's of one-off non-REST actions spread across lots of controllers (many not in concerns).

I'm authorising in the superclass because my policy doesn't care about any of the sub-models in the application, just their ultimate parent, and its place in the site tree.

I'll probably just implement something in my application that is the same as my PR. I just thought you might want to have it as part of action_policy :)

from action_policy.

I just thought you might want to have it as part of action_policy :)

What about adding this use-case to the docs? And then, if there would be a demand, include it into the gem.

from action_policy.

Ok, sounds like a good idea. Do you mean to put in the docs saying that it is a proposed feature and show examples as it would work as implemented in the PR, then ask people to chime in on this issue if they'd like to see it implemented?

from action_policy.

Yep. We can add a new top-level section, say, "Tip & Tricks", and the proposed implementation and the reasoning behind it.

And also add a link to this doc to Readme.

from action_policy.

Done (#28). I'll link to the readme from here once the PR is merged :) Hopefully that page also helps explain my use case a bit better.

from action_policy.

See: https://actionpolicy.evilmartians.io/#/controller_action_aliases for more information.

from action_policy.

Closed as stale

from action_policy.