Ruby&Rails---ActiveAdmin、cancanc

role_core: https://github.com/rails-engine/role_core
cancancan: https://github.com/CanCanCommunity/cancancan

先说效果，后台有个Roles，是后台用户的角色。
AdminUser就是后台用户，可分配某些角色。用户只能操作角色中赋予的功能

图片.png

安装gem

# 后台界面
gem 'activeadmin'
gem 'devise'
# 用户访问权限
gem 'cancancan', '~> 2.0'
# 用户访问角色权限配置
gem 'role_core'

activeadmin在之前的配置在之前的文章中讲过

运行命令，生成abilitiy的文件

rails g cancan:ability

配置ActiveAdmin的权限管理适配器为cancancan,并且指定验证失败后的回调函数 access_denied

config.authorization_adapter = ActiveAdmin::CanCanAdapter
config.on_unauthorized_access = :access_denied

在application_controller中配置access_denied函数

class ApplicationController < ActionController::Base
  protect_from_forgery

  # cancanadapter，访问被拒绝后会回调这个方法
  def access_denied(exception)
    redirect_to admin_root_path, alert: exception.message
  end

  # cancanadapter，访问被拒绝后会回调这个方法，上面的那个方法无效,提示多了个参数（暂不知原因）
  def access_denied
    redirect_to admin_root_path, alert: "您没有权限访问！"
  end

这里先只能访问Dashboard这个页面

class Ability
  include CanCan::Ability

  def initialize(user)
    can :read, ActiveAdmin::Page, name: "Dashboard", namespace_name: "admin"
  end
end

到这里，cancancan和ActiveAdmin的集成已经完毕。至于权限代码还是得自己去实现。
现在通过集成role_core来制定用户角色权限，之后就可以让运营自己玩了

根据role_core的配置文档来运行命令

图片.png

这边是定义用户和角色是多对多的关系:

图片.png

role_core结合cancancan,在initializeres/role_core打开注释：

require "role_core/contrib/can_can_can_permission"
RoleCore.permission_class = RoleCore::CanCanCanPermission

并且继续定义各个model的操作权限

# frozen_string_literal: true

# Be sure to restart your server when you modify this file.

# For I18n, see `config/locales/role_core.en.yml` for details which followed the rule of ActiveRecord's I18n,
# See <http://guides.rubyonrails.org/i18n.html#translations-for-active-record-models>.

# Uncomment below if you want to integrate with CanCanCan
#
require "role_core/contrib/can_can_can_permission"
RoleCore.permission_class = RoleCore::CanCanCanPermission

RoleCore.permission_set_class.draw do
  # Define permissions for the application. For example:
  #
  #   permission :foo, default: true # `default: true` means grant to user by default
  #   permission :bar
  #
  # You can also group permissions by using `group`:
  #
  #   group :project do
  #     permission :create
  #     permission :destroy
  #     permission :update
  #     permission :read
  #     permission :read_public
  #
  #     # `group` supports nesting
  #     group :task do
  #       permission :create
  #       permission :destroy
  #       permission :update
  #       permission :read
  #     end
  #   end
  #
  # For CanCanCan integration, you can pass `model_name` for `group` or `permission`. For example:
  #
  #   group :project, model_name: "Project" do
  #     permission :create
  #     permission :destroy, model_name: 'Plan'
  #   end
  #
  # That will translate to CanCanCan's abilities (if user has these permissions),
  # the permission's name will be the action:
  #
  #   can :create, Project
  #   can :destroy, Plan
  #
  # You can pass `_priority` argument to `permission`
  #
  #   group :project, model_name: "Project" do
  #     permission :read_public,
  #     permission :read, _priority: 1
  #   end
  #
  # That will made 'read' prior than `read_public`.
  #
  # For CanCanCan's hash of conditions
  # (see https://github.com/CanCanCommunity/cancancan/wiki/Defining-Abilities#hash-of-conditions)
  # you can simply pass them as arguments for `permission` even with a block
  #
  #   group :task, model_name: "Task" do
  #     permission :read_public, is_public: true
  #     permission :update_my_own, action: :update, default: true do |user, task|
  #       task.user_id == user.id
  #     end
  #   end
  #
  # Although permission's name will be CanCanCan's action by default,
  # you can pass `action` argument to override it.
  #
  #   permission :read_public, action: :read, is_public: true
  #
  # For some reason, you won't interpret the permission to CanCanCan,
  # you can set `_callable: false` to `permission` or `group`
  #
  #   permission :read, _callable: false
  #

  group :admin do

    # group :user, model_name: "User" do
    #   permission :create
    #   permission :destroy
    #   permission :update
    #   permission :read
    #   permission :manage
    # end
    #
    # group :admin_user, model_name: "AdminUser" do
    #   permission :create
    #   permission :destroy
    #   permission :update
    #   permission :read
    #   permission :manage
    # end

    # 这里是简便的写法
    %w(user admin_user role).each do |item|
      group item.to_sym, model_name: "#{item.camelcase}" do
        permission :create
        permission :destroy
        permission :update
        permission :read
        permission :manage
      end
    end
  end

end.finalize! # Call `finalize!` to freezing the definition, that's optional.

在AdminUser中加入验证权限代码 computed_permissions

class AdminUser < ApplicationRecord
  # Include default devise modules. Others available are:
  # :confirmable, :lockable, :timeoutable, :trackable and :omniauthable
  devise :database_authenticatable,
         :recoverable, :rememberable, :validatable

  # AdminUser与Role多对多
  has_many :role_assignments, dependent: :destroy
  has_many :roles, through: :role_assignments

  def computed_permissions
    roles.map(&:computed_permissions).reduce(RoleCore::ComputedPermissions.new, &:concat)
  end
end

在ability.rb中加入配置user.computed_permissions.call(self, user)

class Ability
  include CanCan::Ability

  def initialize(user)
    user.computed_permissions.call(self, user)
    can :read, ActiveAdmin::Page, name: "Dashboard", namespace_name: "admin"
  end
end

ActiveAdmin中创建或更新的model和视图
admin_users.rb

ActiveAdmin.register AdminUser do
  permit_params :email, :password, :password_confirmation, role_ids: []

  index do
    selectable_column
    id_column
    column :email
    column :current_sign_in_at
    column :sign_in_count
    column :created_at
    actions
  end

  filter :email
  filter :current_sign_in_at
  filter :sign_in_count
  filter :created_at

  form partial: 'form'

end

admin_users/_form.html.erb

<%= form_for([:admin, @admin_user], local: true) do |f| %>
  <% if @admin_user.errors.any? %>
    <article class="message is-danger">
      <div class="message-header">
        <p>
          <%= pluralize(@admin_user.errors.count, "error") %> prohibited this form from being saved:
        </p>
      </div>
      <div class="message-body">
        <% @admin_user.errors.full_messages.each do |message| %>
          <li><%= message %></li>
        <% end %>
      </div>
    </article>
  <% end %>

  <div class="field">
    <%= f.label :email, class: 'label' %>
    <p class="control">
      <%= f.text_field :email, id: :admin_user_email, class: 'input' %>
    </p>
  </div>

  <% if @admin_user.persisted? %>
    <div class="field">
      <%= f.label :roles, class: 'label' %>
      <p class="control">
        <%= f.collection_check_boxes :role_ids, Role.all, :id, :name do |m| %>
          <%= m.label class: 'checkbox' do %>
            <%= m.check_box class: 'checkbox' %>
            <%= m.text %>
          <% end %>
        <% end %>
      </p>
    </div>
  <% end %>

  <div class="field is-grouped">
    <p class="control">
      <%= f.submit class: 'button is-primary' %>
    </p>
    <p class="control">
      <%= link_to 'Back', url_for(:back), class: 'button is-link' %>
    </p>
  </div>
<% end %>

role.rb

ActiveAdmin.register Role do

  form partial: 'form'

  # 注意：要写这个，不然创建不成功
  controller do
    def permitted_params
      params.permit!
    end
  end
end

roles/_form.html.erb

<%= form_for([:admin, @role], local: true) do |f| %>
  <% if @role.errors.any? %>
    <article class="message is-danger">
      <div class="message-header">
        <p>
          <%= pluralize(@role.errors.count, "error") %> prohibited this form from being saved:
        </p>
      </div>
      <div class="message-body">
        <% @role.errors.full_messages.each do |message| %>
          <li><%= message %></li>
        <% end %>
      </div>
    </article>
  <% end %>

  <div class="field">
    <%= f.label :name, class: 'label' %>
    <p class="control">
      <%= f.text_field :name, id: :role_name, class: 'input', required: 'required' %>
    </p>
  </div>

  <%= render partial: "permissions", locals: {f: f, name: :permissions_attributes, permissions: @role.permissions} %>

  <div class="field is-grouped">
    <%= f.submit class: 'button is-primary' %>
    <%= link_to 'Back', url_for(:back), class: 'button is-link' %>
  </div>
<% end %>

roles/_permissions.html.erb

<%= f.fields_for name, permissions do |ff| %>
  <% if permissions.class.attribute_names_for_inlining.any? %>
    <div class="field">
      <label class="label">
        <%= permissions.class.model_name.human %>
      </label>

      <p class="control">
        <% permissions.class.attribute_names_for_inlining.each do |permission| %>
          <%= ff.label permission, class: 'checkbox' do %>
            <%= ff.check_box permission, class: 'checkbox' %>
            <%= permissions.class.human_attribute_name(permission) %>
          <% end %>
        <% end %>
      </p>
    </div>
  <% end %>

  <% permissions.class.attribute_names_for_nesting.each do |permission| %>
    <%= render partial: "permissions", locals: {f: ff, name: permission, permissions: permissions.send(permission)} %>
  <% end %>
<% end %>