Self ownership

[Kevin Monk]

It is possible to add access control that allows the current_user to
access the user show action it they are that user!?

Something like

UsersController <AC::BAse

access_control do
allow :admin
# allow if the current_user is @user, :to => [:show]
deny anonymous, :except => [:new]
end

def index
@users = User.all
..
end

def show
@user = User.find(params[:id])
...
end

end

I could set up lots of self ownership roles on create but that seems
really messy i.e.

@user = User.create!(params[:user])
@user.has_role!(:owner, @user)

SHould I just forget ACL9 for this part and user a before_filter?

[oleg dashevskii]

Hi Kevin,

here's an example

allow all, :to => :show, :if => :me?

private

def me?

   current_user == @user

end

2011/1/9 Kevin Monk <ke...@mangoswiss.com>

--
Олег.

[Kevin Monk]

Simple when you put it like that! :)

Thanks Oleg.