Question

I am using cancan and trying to get it to limit equipment shown for a specific company.

I have a company with many users that should only see equipment that belong to that company.

I thought cancan could do this based on this:

Rails 3 company account with many users, restrict access to data

So I tried this code:

can :manage, Equipment do |equipment|
  user.company == equipment.company
end

In the equipment controller I have @equipment = Equipment.all which I figured would just pull the equipment for that users company, but of course it pulls them all. Is there an easy way to do this or do I need to do @equipment = Equipment.find_by_company_id(current_user.company) anytime I want to pull just that companies equipment. To make this worse I want to eventually break it down by groups and departments, but would rather not have to force myself into more big find queries. I am open to anything, plugins, suggestions, whatever will be the fastest way to fix this.

I could have added more code to this question, but I don’t know that adding it all would really help the question.

Thank you very much

Toby

Answer 1

Try Equipment.accessible_by()

https://github.com/ryanb/cancan/blob/master/lib/cancan/model_additions.rb