Custom Authorization

[vincentcordel]

Hi there,

I have a problem securing the access in my backend. I'm not using Devise but a custom auth (based on M.Hartl's tutorial) with cancancan.

Ideally, I'd like to do the same than my other routes/controllers using load_and_authorize_resource and the can :manage of cancancan.

I'm really confused on how to do this, even more after reading different posts about the subject. The examples provided didn't really help.

Any ideas on how to solve this?

Thanks!

• Vincent

[dapicester]

I know it's a very old issue, but I have recently found a way to address it, inspired by this article: use rails constraints.

This is how it works:

# config/routes.rb

class AdminOnly
  def self.matches?(request)
    user = UserService.find_from request
    user.admin?
  end
end

constraints AdminOnly do
  mount DelayedJobWeb.new, at: "/delayed_job"
end

In my case I am using cancancan, but it's conceptually the same:

# config/routes.rb

class AbilityConstraint
  def initialize(action, resource)
    @action, @resource = action, resource
  end

  def matches?(request)
    user = UserService.find_from request 
    user.present? && user.can?(@action, @resource)
  end
end

constraints AbilityConstraint.new(:manage, :delayed_job) do
  mount DelayedJobWeb.new, at: "/delayed_job"
end

Hope it helps.