Question

I’m using the gem called acts_as_commentable_with_threading
It automatically creates comments table, and in which there are these columns such as commentable_type, commentable_id, and etcs.

It is made to be polymorphic, and it’s working fine.

I have these three models.

• User
• Community
• Topic

They have comments under of each.

I’d like to enable User to delete his comment or somebody else’s comment on his User page.
(He can delete all the comments on his User page)

I figured out to make it enable coding like this code below.
But I found out the same thing will happen to Community Page and Topic page.
Even if the user was not original creator of the comment, it will be possible for him to delete all the comments if the ID of the Community/Topic is the same as USER ID.

I only like it enable to USER model. How can I customize this?

models/ability.rb

can [:create, :destroy], Comment, {:user_id => user.id}
can [:destroy], Comment, {:commentable_id => user.id}

Answer 1

Since you’re Comment class uses a polymorphic association, the delete action is currently allowed when the commentable_id matches the id of the user. Since you can have conflicting ids across the different tables, you need to match on the commentable_type as well. Try something like this:

can [:destroy], Comment, {:commentable_id => user.id, :commentable_type => user.class.name}