CanCan filters that work on :index have no effect on :nestable about rails_admin_nestable HOT 3 CLOSED

Dudes.

So, I went and checked this out ... I found out that you're just using @abstract_model.model.arrange to pull data out of the model, which barring magic (always a possibility in railsland) doesn't seem to allow for CanCan to be applying any sort of filtering from Ability.

But if anyone else out there like me just wants to make CanCan work (ie, not just 'allow/disallow nestable', but full parity with eg 'index' action), go ahead and make a local copy of lib/rails_admin_nestable/nestable.rb, and you can just change lines 75-81 of nestable.rb to

model = @abstract_model.model

# use the accessible_by scope with current user if supported
model = model.accessible_by( Ability.new current_user ) if model.respond_to? :accessible_by

if @nestable_conf.tree?
  @tree_nodes = model.arrange(order: @nestable_conf.options[:position_field])
end

if @nestable_conf.list?
  @tree_nodes = model.order(@nestable_conf.options[:position_field])
end

That'll apply Devise filtering to the records you see in nestable.

Offhand I can't see why this would be a bad thing, but I might be missing something since it's been a while since I knew CanCan/Devise/Radmin inside and out.

from rails_admin_nestable.

+1 @mrluc

from rails_admin_nestable.

Hi @mrluc,
I released a new version which use the rails_admin method list_entries to retrieve records.
list_entries is integrated with the authorization_adapter, generally CanCan, so the issue should be resolved.

Take a look here for the list_entries implementation: https://github.com/sferik/rails_admin/blob/master/app/controllers/rails_admin/main_controller.rb#L32

Could you try the last release to check if it works correctly?

Sorry for my late reply, but I have little free time to work on rails_admin_nestable..

Thanks

from rails_admin_nestable.