CanCan没有授权控制器操作，但它可以正常工作accessible_by

Question

过去几天我一直在CanCan中挣扎，需要一些帮助。我的用户应该能够访问他们或他们的团队成员创建的联系人。我为此设置了一种能力，它可用于收集数据（CanCan将索引限制为只能通过'accessable_by'查看的联系人），但是当您单击联系人时，CanCan会抛出“未授权”错误。

我已经看过联系人表本身，可以验证current_user与我点击的联系人具有相同的team_id，所以它看起来应该可以工作，但它不会。

感谢您提供的任何帮助。

这里是ability.rb文件：

class Ability 
    include CanCan::Ability 

    def initialize(user) 
     # Define abilities for the passed in user here. For example: 
     # 

     user ||= User.new # guest user (not logged in) 

     case user.role 
      when "admin"  then 
       can :manage, :all 
      when "team_admin" then 
       can :manage, Team,  :team => { :id => user.team_id } 
       can :manage, Upload,  :team => { :id => user.team_id } 
       can :manage, Property, :team => { :id => user.team_id } 
       can :manage, Contact,  :team => { :id => user.team_id } 
       can :manage, Appointment, :team => { :id => user.team_id } 
      when "user"   then     
       can :manage, Team,  :team => { :id => user.team_id } 
       can :manage, Upload,  :team => { :id => user.team_id } 
       can :manage, Property, :team => { :id => user.team_id } 
       can :manage, Contact#, :team => { :id => user.team_id } 
       can :manage, Appointment, :team => { :id => user.team_id } 
       can :read, User,   :user => { :id => user.id} 

       can :create, Team  
       can :create, Upload  
       can :create, Property  
      # can :create, Contact 
       can :create, Appointment 

       can :index, Property 
      # can :index, Contact 
     end 

      # if user.role == "admin" 
      # can :manage, :all 
      # else 
      # can :read, :all 
      # end 

     # 
     # The first argument to `can` is the action you are giving the user permission to do. 
     # If you pass :manage it will apply to every action. Other common actions here are 
     # :read, :create, :update and :destroy. 
     # 
     # The second argument is the resource the user can perform the action on. If you pass 
     # :all it will apply to every resource. Otherwise pass a Ruby class of the resource. 
     # 
     # The third argument is an optional hash of conditions to further filter the objects. 
     # For example, here the user can only update published articles. 
     # 
     # can :update, Article, :published => true 
     # 
     # See the wiki for details: https://github.com/ryanb/cancan/wiki/Defining-Abilities 
    end 
end 

这里是我的联系控制器的显示操作：

def show 
    @contact = Contact.find(params[:id]) 
    authorize! :show, @contact 

    respond_to do |format| 
     format.html # show.html.erb 
     format.json { render json: @contact } 
    end 


    end 

下面是用户模式：

class User < ActiveRecord::Base 

    has_secure_password 
    attr_accessible :email, :password, :password_confirmation, :first_name, :last_name, :team_id, :role 

    belongs_to :team 
    has_many :appointments 
    has_many :contacts 
    has_many :properties 

    ROLES = %w[admin group_admin user disabled] 

    validates_uniqueness_of :email 

    before_create { generate_token(:auth_token) } 

    def send_password_reset 
    generate_token(:password_reset_token) 
    self.password_reset_sent_at = Time.zone.now 
    save! 
    UserMailer.password_reset(self).deliver 
    end 

    def generate_token(column) 
    begin 
     self[column] = SecureRandom.urlsafe_base64 
    end while User.exists?(column => self[column]) 
    end 

end 

这里是联系型号：

class Contact < ActiveRecord::Base 
    attr_accessible :address_1, :address_2, :city, :first_name, :last_name, :state, :zip, :team_id 
    has_and_belongs_to_many :properties 
    belongs_to :user 
    belongs_to :team 
    has_many :appointments 
end 

最后，这里是团队模式：

class Team < ActiveRecord::Base 
    attr_accessible :team_name 

    has_many :users 
    has_many :appointments 
    has_many :contacts 
    has_many :properties 
end 

Answer 1

尝试使用这样的：

when "user"   then 
    ... 
    can :manage, Contact, user_id: user.id, team_id: user.team.id 
    ... 
    can :create, Contact 
    ...