2个设计模型（管理员和用户）和cancan

Question

这是我的代码，但它仍然不允许我创建一些resason的配置文件。 我有2个模型，用户和管理员。

我的控制器：

class ProfilesController < ApplicationController 
    before_action :set_profile, only: [:show, :edit, :update, :destroy] 
    load_and_authorize_resource 



    # GET /profiles 
    # GET /profiles.json 
    def index 
    user = User.find(params[:user_id]) 
    @profiles = user.profiles 

    respond_to do |format| 
     format.html 
     format.xml {render :xml => @profiles} 
    end 
    end 

    # GET /profiles/1 
    # GET /profiles/1.json 
    def show 
    user = User.find(params[:user_id]) 
    @profiles = user.profiles.find(params[:id]) 

    respond_to do |format| 
     format.html 
     format.xml {render :xml => @profile} 
     end 
    end 

    # GET /profiles/new 
    def new 
    user = User.find(params[:user_id]) 
    @profile = user.profiles.build 

    respond_to do |format| 
     format.html 
     format.xml {render :xml => @profile} 
     end 
    end 

    # GET /profiles/1/edit 
    def edit 
    user = User.find(params[:user_id]) 
    @profiles = user.profiles.find(params[:id]) 
    end 

    # POST /profiles 
    # POST /profiles.json 
    def create 
    user = User.find(params[:user_id]) 
    @profile = user.profiles.create(profile_params) 

    respond_to do |format| 
     if @profile.save 
     format.html { redirect_to user_profiles_url, notice: 'Profile was successfully created.' } 
     format.json { render action: 'show', status: :created, location: @profile } 
     else 
     format.html { render action: 'new' } 
     format.json { render json: @profile.errors, status: :unprocessable_entity } 
     end 
    end 
    end 

    # PATCH/PUT /profiles/1 
    # PATCH/PUT /profiles/1.json 
    def update 
    user = User.find(params[:user_id]) 
    @profiles = user.profiles.find(params[:id]) 

    respond_to do |format| 
     if @profile.update(profile_params) 
     format.html { redirect_to user_profile_url, notice: 'Profile was successfully updated.' } 
     format.json { head :no_content } 
     else 
     format.html { render action: 'edit' } 
     format.json { render json: @profile.errors, status: :unprocessable_entity } 
     end 
    end 
    end 

    # DELETE /profiles/1 
    # DELETE /profiles/1.json 
    def destroy 
    user = User.find(params[:user_id]) 
    @profiles = user.profiles.find(params[:id]) 

    @profile.destroy 
    respond_to do |format| 
     format.html { redirect_to job_hunters_path } 
     format.json { head :no_content } 
    end 
    end 

    private 
    # Use callbacks to share common setup or constraints between actions. 
    def set_profile 
     @profile = Profile.find(params[:id]) 
    end 

    # Never trust parameters from the scary internet, only allow the white list through. 
    def profile_params 
     params.require(:profile).permit(:user_id, :full_name, :phone_number, :email, :position, :years_of_experiance, :cover_letter, :resume, :reference) 
    end 
end 

我康康舞能力：当我尝试创建

class Ability 
    include CanCan::Ability 

    def initialize(user) 

    user ||= User.new 

    if user.is_a?(Admin) 

     can :manage, :all 

    else user.is_a?(User) 

     can :read, Profile do |profile| 
     profile.try(:user) == user 
     end 
     can :update, Profile do |profile| 
     profile.try(:user) == user 
     end 
     can :destroy, Profile do |profile| 
     profile.try(:user) == user 
     end 
     can :create, Profile 

    end 
    end 
end 

错误是：

::加载ActiveModel在ForbiddenAttributesError＃ProfilesController创建

Answer 1

尝试跳转到加载资源：在您的控制器中创建操作：

class ProfilesController < ApplicationController 
    before_action :set_profile, only: [:show, :edit, :update, :destroy] 
    load_and_authorize_resource 
    skip_load_resource :only => [:create] 

#..... 

Answer 2

您需要同时访问新操作和创建操作。所以，按照给定的方式修改它。希望能帮助到你。

can [:new, :create], Profile 

除此之外，请确保您允许所有参数。

def profile_params 
    params.require(:profile).permit(:user_id, :full_name, :phone_number, :email, :position, :years_of_experiance, :cover_letter, :resume, :reference) 
end 

Answer 3

我设法解决它。我使用你的skip_load_resource：only => [：create]和in能力：

class Ability 
    include CanCan::Ability 

    def initialize(user) 

    if user.is_a?(Admin) 

     can :manage, :all 

    elsif user.is_a?(User) 

     can :read, Profile do |profile| 
     profile.try(:user) == user 
     end 
     can :update, Profile do |profile| 
     profile.try(:user) == user 
     end 
     can :destroy, Profile do |profile| 
     profile.try(:user) == user 
     end 
     can :create, Profile 

    else 

     cannot :read 
     cannot :destroy 
     cannot :create 

    end 
    end 
end