当Cancan与Accessible_by一起工作时，Cancan不授权控制器操作

Question

过去几天我一直在与坎卡（Cancan）挣扎，需要一些帮助。我的用户应该能够访问他们或他们的团队成员创建的联系人。我为此设置了一个功能，并且它可以收集数据（Cancan限制了索引仅应通过" accessable_by''可查看的联系人），但是当您单击联系人时，Cancan会引发"未授权"错误。

我已经查看了联系人表本身，并且可以验证current_user与我单击的联系人相同的team_id，因此看起来应该可以工作，但行之有效。

感谢您提供的任何帮助。

这是能力。RB文件：

    class Ability
    include CanCan::Ability
    def initialize(user)
        # Define abilities for the passed in user here. For example:
        #
        user ||= User.new # guest user (not logged in)
        case user.role
            when "admin"        then 
              can :manage, :all
            when "team_admin"   then
              can :manage, Team,        :team => { :id => user.team_id }
              can :manage, Upload,      :team => { :id => user.team_id }
              can :manage, Property,    :team => { :id => user.team_id }
              can :manage, Contact,     :team => { :id => user.team_id }
              can :manage, Appointment, :team => { :id => user.team_id }
            when "user"         then                   
              can :manage, Team,        :team => { :id => user.team_id }
              can :manage, Upload,      :team => { :id => user.team_id }
              can :manage, Property,    :team => { :id => user.team_id }
              can :manage, Contact#,    :team => { :id => user.team_id }
              can :manage, Appointment, :team => { :id => user.team_id }
              can :read, User,          :user => { :id => user.id}
              can :create, Team     
              can :create, Upload       
              can :create, Property     
             # can :create, Contact 
              can :create, Appointment
              can :index, Property  
             # can :index, Contact  
        end
            # if user.role == "admin"
            #   can :manage, :all
            # else
            #   can :read, :all
            # end
        #
        # The first argument to `can` is the action you are giving the user permission to do.
        # If you pass :manage it will apply to every action. Other common actions here are
        # :read, :create, :update and :destroy.
        #
        # The second argument is the resource the user can perform the action on. If you pass
        # :all it will apply to every resource. Otherwise pass a Ruby class of the resource.
        #
        # The third argument is an optional hash of conditions to further filter the objects.
        # For example, here the user can only update published articles.
        #
        #   can :update, Article, :published => true
        #
        # See the wiki for details: https://github.com/ryanb/cancan/wiki/Defining-Abilities
    end
end

这是我的联系人控制器中的节目动作：

  def show
    @contact = Contact.find(params[:id])
    authorize! :show, @contact
    respond_to do |format|
      format.html # show.html.erb
      format.json { render json: @contact }
    end

  end

这是用户模型：

class User < ActiveRecord::Base
  has_secure_password
  attr_accessible :email, :password, :password_confirmation, :first_name, :last_name, :team_id, :role
  belongs_to :team
  has_many :appointments
  has_many :contacts
  has_many :properties
  ROLES = %w[admin group_admin user disabled]
  validates_uniqueness_of :email
  before_create { generate_token(:auth_token) }
  def send_password_reset
    generate_token(:password_reset_token)
    self.password_reset_sent_at = Time.zone.now
    save!
    UserMailer.password_reset(self).deliver
  end
  def generate_token(column)
    begin
      self[column] = SecureRandom.urlsafe_base64
    end while User.exists?(column => self[column])
  end
end

这是联系模型：

class Contact < ActiveRecord::Base
  attr_accessible :address_1, :address_2, :city, :first_name, :last_name, :state, :zip, :team_id
  has_and_belongs_to_many :properties
  belongs_to :user
  belongs_to :team
  has_many :appointments
end

最后，这是团队模型：

class Team < ActiveRecord::Base
  attr_accessible :team_name
  has_many :users
  has_many :appointments
  has_many :contacts
  has_many :properties
end

Answer 1

尝试使用以下方式：

when "user"         then  
  ...
  can :manage, Contact, user_id: user.id, team_id: user.team.id
  ...
  can :create, Contact
  ...