ruby-on-rails - Rails 3 ActiveAdmin CanCan。如何设置用户应该只看到属于他的记录？

我设置属于客户类(客户是公司)的admin_users。因此，客户有许多admin_users。

我试图限制对属于某个客户的货件记录的访问。我不希望客户观看其他客户数据。因此，我对此进行了设置，但似乎无能为力...

类(class)能力
包括CanCan::Ability

  def initialize(user)
    user ||= AdminUser.new
    if user.role == "administrator"
        can :manage, :all
    else
      cannot :create, :all
      cannot :update, :all
      cannot :destroy, :all
      can :read, Shipment do |shipment|
        shipment.customer == user.customer
      end
    end
  end
end

我在ships.rb中确实有这个...

ActiveAdmin.register Shipment do
  menu :if => proc{ can?(:read, Shipment) }, :priority => 1
  controller.authorize_resource

  index do
    column "File #", :sortable => :file_number do |shipment|
      link_to shipment.file_number, admin_shipment_path(shipment)
    end
    [... more columns ...]
    default_actions if can? :manage, Shipment
  end

  show :title => :file_number do
  panel "Shipment Details" do
  attributes_table_for shipment do
    row("File number") {shipment.file_number}
    row("Mode") {shipment.mode}
    row("Ocean Rate") { number_to_currency shipment.ocean_rate}
    row("Customer") { link_to shipment.customer.company_name, admin_customer_path(shipment.customer)}
    row("Shipper") { link_to shipment.shipper.company_name, admin_shipper_path(shipment.shipper)}
    row("Broker") { link_to shipment.broker.company_name, admin_broker_path(shipment.broker)}
  end
end

[...more show action stuff...]

因此，在索引页面中，将显示所有货件，如果我以客户A的身份登录并单击客户B的货件，则可以看到它，但这应该阻止了我。

更多信息...

shipments_controller.rb
class ShipmentsController < InheritedResources::Base
  before_filter :authenticate_admin_user!
end

最佳答案

Active Admin具有用于处理范围的内置方法。看到这里:http://activeadmin.info/docs/2-resource-customization.html#scoping_the_queries

关于ruby-on-rails - Rails 3 ActiveAdmin CanCan。如何设置用户应该只看到属于他的记录？，我们在Stack Overflow上找到一个类似的问题：https://stackoverflow.com/questions/8935322/