Cancan不会加载嵌套的资源，因为我期望它

Question

Cancan在用户登录时工作正常。但是当用户是“访客”时，我希望他们能够看到一些照片，但不是那些照片的父邮件有一个限制employees_only标志设置。

问题是如果在@photos阵列中有任何与employee_only帖子相关的照片，则Cancan将丢弃CanCan::AccessDenied in PhotosController#index。但是控制器中不应该有load_and_authorize_resource :photo, :through => :event已经从@photos中删除了那些未经授权的记录？

ability.rb

class Ability 
    include CanCan::Ability 

    def initialize(user) 
    user ||= User.new # guest user (not logged in) 

    if user.role? :admin 
     can :manage, :all 
    elsif user.role? :moderator 
     can :read, :all 
     can :manage, Post 
     can :manage, Event 
    elsif user.role? :employee 
     can :read, :all 
     can :create, Post 
     can :update, Post, :user_id => user.id 
     can :destroy, Post, :user_id => user.id 
     can :update, User, :id => user.id 
     can :create, Photo 
     can :update, Photo, :id => user.id 
     can :destroy, Photo, :id => user.id 
    else 
     can :read, :all 
     cannot :read, Post, :employee_only => true 
     cannot :read, Photo, :post => { :employee_only => true } ## <- problem? 
    end 
    end 
end 

event.rb：

class Event < ActiveRecord::Base 
Event has_many :posts 
Event has_many :photos, :through => :posts 

post.rb

class Post < ActiveRecord::Base 
    belongs_to :user 
    belongs_to :event 
    has_many :photos, :dependent => :destroy 

photos_controller：

class PhotosController < ApplicationController 
    load_and_authorize_resource :event      ## <- problem? 
    load_and_authorize_resource :photo, :through => :event ## <- problem? 

    def index 
    # @event = Event.find(params[:event_id]) 
    # @photos = @event.photos.all 

    respond_to do |format| 
     format.html # index.html.erb 
     format.json { render json: @events } 
    end 
    end 
    ... 

user.rb＃不知道这是要解决此问题，但JIC：

class User < ActiveRecord::Base 
    attr_protected :roles_mask 
    has_many :posts 
    has_many :photos, :through => :posts 
    ... 

Answer 1

首先，在你的能力文件中删除

cannot :read, Photo, :post => { :employee_only => true } ## <- problem? 

我不认为你需要，当你被限制在帖子上。

然后在你的控制器改变

load_and_authorize_resource :event      ## <- problem? 
load_and_authorize_resource :photo, :through => :event ## <- problem? 

要

load_and_authorize_resource :post 
load_and_authorize_resource :photo, :through => :post 

我相信你正在尝试做的是通过与后因职位仅限于那些employee_only加载照片= false，你隐式限制照片。然后，在您的照片控制器中，您需要加载帖子，以便它可以用来加载和授权照片。在cancan（我认为）中应该发生的是内部连接是在posts.employee_only = false的帖子和照片之间完成的。