can :manage, @entity vs can :manage, Entity, id: @entity.id about cancancan HOT 4 CLOSED

These types of inquires are fine for when you are checking abilities.. ie. in the controller or view: can? :manage, @entity will properly check whatever class @entity is, but when you're defining abilities, you have to use the class then any restrictions.

Something like:

can :manage, [TypeOneEntity, TypeTwoEntity], id: @entity.id or
can :manage, ParentEntity, id: @entity.id or
can :manage, Entity, id: @entity.id, type: %w(TypeOneEntity TypeTwoEntity)

I've done this for subclassed User types where @entity in your example is current_user. If @entity isn't your authorizing resource, would you mind explaining what your use case is?

from cancancan.

In my case @entity isn't the User but an entity linked to the user.
can :manage, ParentEntity, id: @entity.id
Is actually what i did so that accessible_by works.
Thanks for your answer.

from cancancan.

This should be better documented.

I have permissions in database, like so:

create_table(:permissions) do |t|
  t.references :user, index: true
  t.references :subject, polymorphic: true, index: true
  t.string     :action
  t.timestamps
end

I had to change code from:

class Ability
  include CanCan::Ability

  def initialize(user)
    user ||= User.new
    user.permissions.each do |permission|
      can permission.action.to_sym, permission.subject
    end
  end
end

to:

class Ability
  include CanCan::Ability

  def initialize(user)
    user ||= User.new
    user.permissions.each do |permission|
      can permission.action.to_sym, permission.subject_type.constantize, id: permission.subject_id
    end
  end
end

...for it to work. Very unintuitive imho.

from cancancan.

I realised it is actually described this way in https://github.com/CanCanCommunity/cancancan/wiki/Abilities-in-Database

I should have read better, my bad.

from cancancan.