role_core: https://github.com/rails-engine/role_core
cancancan: https://github.com/CanCanCommunity/cancancan

先說(shuō)效果，后臺(tái)有個(gè)Roles，是后臺(tái)用戶的角色。
AdminUser就是后臺(tái)用戶，可分配某些角色。用戶只能操作角色中賦予的功能

圖片.png

安裝gem

# 后臺(tái)界面
gem 'activeadmin'
gem 'devise'
# 用戶訪問(wèn)權(quán)限
gem 'cancancan', '~> 2.0'
# 用戶訪問(wèn)角色權(quán)限配置
gem 'role_core'

activeadmin在之前的配置在之前的文章中講過(guò)

運(yùn)行命令，生成abilitiy的文件

rails g cancan:ability

配置ActiveAdmin的權(quán)限管理適配器為cancancan,并且指定驗(yàn)證失敗后的回調(diào)函數(shù) access_denied

config.authorization_adapter = ActiveAdmin::CanCanAdapter
config.on_unauthorized_access = :access_denied

在application_controller中配置access_denied函數(shù)

class ApplicationController < ActionController::Base
  protect_from_forgery

  # cancanadapter，訪問(wèn)被拒絕后會(huì)回調(diào)這個(gè)方法
  def access_denied(exception)
    redirect_to admin_root_path, alert: exception.message
  end

  # cancanadapter，訪問(wèn)被拒絕后會(huì)回調(diào)這個(gè)方法，上面的那個(gè)方法無(wú)效,提示多了個(gè)參數(shù)（暫不知原因）
  def access_denied
    redirect_to admin_root_path, alert: "您沒(méi)有權(quán)限訪問(wèn)！"
  end

這里先只能訪問(wèn)Dashboard這個(gè)頁(yè)面

class Ability
  include CanCan::Ability

  def initialize(user)
    can :read, ActiveAdmin::Page, name: "Dashboard", namespace_name: "admin"
  end
end

到這里，cancancan和ActiveAdmin的集成已經(jīng)完畢。至于權(quán)限代碼還是得自己去實(shí)現(xiàn)。
現(xiàn)在通過(guò)集成role_core來(lái)制定用戶角色權(quán)限，之后就可以讓運(yùn)營(yíng)自己玩了

根據(jù)role_core的配置文檔來(lái)運(yùn)行命令

圖片.png

這邊是定義用戶和角色是多對(duì)多的關(guān)系:

圖片.png

role_core結(jié)合cancancan,在initializeres/role_core打開(kāi)注釋：

require "role_core/contrib/can_can_can_permission"
RoleCore.permission_class = RoleCore::CanCanCanPermission

并且繼續(xù)定義各個(gè)model的操作權(quán)限

# frozen_string_literal: true

# Be sure to restart your server when you modify this file.

# For I18n, see `config/locales/role_core.en.yml` for details which followed the rule of ActiveRecord's I18n,
# See <http://guides.rubyonrails.org/i18n.html#translations-for-active-record-models>.

# Uncomment below if you want to integrate with CanCanCan
#
require "role_core/contrib/can_can_can_permission"
RoleCore.permission_class = RoleCore::CanCanCanPermission

RoleCore.permission_set_class.draw do
  # Define permissions for the application. For example:
  #
  #   permission :foo, default: true # `default: true` means grant to user by default
  #   permission :bar
  #
  # You can also group permissions by using `group`:
  #
  #   group :project do
  #     permission :create
  #     permission :destroy
  #     permission :update
  #     permission :read
  #     permission :read_public
  #
  #     # `group` supports nesting
  #     group :task do
  #       permission :create
  #       permission :destroy
  #       permission :update
  #       permission :read
  #     end
  #   end
  #
  # For CanCanCan integration, you can pass `model_name` for `group` or `permission`. For example:
  #
  #   group :project, model_name: "Project" do
  #     permission :create
  #     permission :destroy, model_name: 'Plan'
  #   end
  #
  # That will translate to CanCanCan's abilities (if user has these permissions),
  # the permission's name will be the action:
  #
  #   can :create, Project
  #   can :destroy, Plan
  #
  # You can pass `_priority` argument to `permission`
  #
  #   group :project, model_name: "Project" do
  #     permission :read_public,
  #     permission :read, _priority: 1
  #   end
  #
  # That will made 'read' prior than `read_public`.
  #
  # For CanCanCan's hash of conditions
  # (see https://github.com/CanCanCommunity/cancancan/wiki/Defining-Abilities#hash-of-conditions)
  # you can simply pass them as arguments for `permission` even with a block
  #
  #   group :task, model_name: "Task" do
  #     permission :read_public, is_public: true
  #     permission :update_my_own, action: :update, default: true do |user, task|
  #       task.user_id == user.id
  #     end
  #   end
  #
  # Although permission's name will be CanCanCan's action by default,
  # you can pass `action` argument to override it.
  #
  #   permission :read_public, action: :read, is_public: true
  #
  # For some reason, you won't interpret the permission to CanCanCan,
  # you can set `_callable: false` to `permission` or `group`
  #
  #   permission :read, _callable: false
  #

  group :admin do

    # group :user, model_name: "User" do
    #   permission :create
    #   permission :destroy
    #   permission :update
    #   permission :read
    #   permission :manage
    # end
    #
    # group :admin_user, model_name: "AdminUser" do
    #   permission :create
    #   permission :destroy
    #   permission :update
    #   permission :read
    #   permission :manage
    # end

    # 這里是簡(jiǎn)便的寫法
    %w(user admin_user role).each do |item|
      group item.to_sym, model_name: "#{item.camelcase}" do
        permission :create
        permission :destroy
        permission :update
        permission :read
        permission :manage
      end
    end
  end

end.finalize! # Call `finalize!` to freezing the definition, that's optional.

在AdminUser中加入驗(yàn)證權(quán)限代碼 computed_permissions

class AdminUser < ApplicationRecord
  # Include default devise modules. Others available are:
  # :confirmable, :lockable, :timeoutable, :trackable and :omniauthable
  devise :database_authenticatable,
         :recoverable, :rememberable, :validatable

  # AdminUser與Role多對(duì)多
  has_many :role_assignments, dependent: :destroy
  has_many :roles, through: :role_assignments

  def computed_permissions
    roles.map(&:computed_permissions).reduce(RoleCore::ComputedPermissions.new, &:concat)
  end
end

在ability.rb中加入配置user.computed_permissions.call(self, user)

class Ability
  include CanCan::Ability

  def initialize(user)
    user.computed_permissions.call(self, user)
    can :read, ActiveAdmin::Page, name: "Dashboard", namespace_name: "admin"
  end
end

ActiveAdmin中創(chuàng)建或更新的model和視圖
admin_users.rb

ActiveAdmin.register AdminUser do
  permit_params :email, :password, :password_confirmation, role_ids: []

  index do
    selectable_column
    id_column
    column :email
    column :current_sign_in_at
    column :sign_in_count
    column :created_at
    actions
  end

  filter :email
  filter :current_sign_in_at
  filter :sign_in_count
  filter :created_at

  form partial: 'form'

end

admin_users/_form.html.erb

<%= form_for([:admin, @admin_user], local: true) do |f| %>
  <% if @admin_user.errors.any? %>
    <article class="message is-danger">
      <div class="message-header">
        <p>
          <%= pluralize(@admin_user.errors.count, "error") %> prohibited this form from being saved:
        </p>
      </div>
      <div class="message-body">
        <% @admin_user.errors.full_messages.each do |message| %>
          <li><%= message %></li>
        <% end %>
      </div>
    </article>
  <% end %>

  <div class="field">
    <%= f.label :email, class: 'label' %>
    <p class="control">
      <%= f.text_field :email, id: :admin_user_email, class: 'input' %>
    </p>
  </div>

  <% if @admin_user.persisted? %>
    <div class="field">
      <%= f.label :roles, class: 'label' %>
      <p class="control">
        <%= f.collection_check_boxes :role_ids, Role.all, :id, :name do |m| %>
          <%= m.label class: 'checkbox' do %>
            <%= m.check_box class: 'checkbox' %>
            <%= m.text %>
          <% end %>
        <% end %>
      </p>
    </div>
  <% end %>

  <div class="field is-grouped">
    <p class="control">
      <%= f.submit class: 'button is-primary' %>
    </p>
    <p class="control">
      <%= link_to 'Back', url_for(:back), class: 'button is-link' %>
    </p>
  </div>
<% end %>

role.rb

ActiveAdmin.register Role do

  form partial: 'form'

  # 注意：要寫這個(gè)，不然創(chuàng)建不成功
  controller do
    def permitted_params
      params.permit!
    end
  end
end

roles/_form.html.erb

<%= form_for([:admin, @role], local: true) do |f| %>
  <% if @role.errors.any? %>
    <article class="message is-danger">
      <div class="message-header">
        <p>
          <%= pluralize(@role.errors.count, "error") %> prohibited this form from being saved:
        </p>
      </div>
      <div class="message-body">
        <% @role.errors.full_messages.each do |message| %>
          <li><%= message %></li>
        <% end %>
      </div>
    </article>
  <% end %>

  <div class="field">
    <%= f.label :name, class: 'label' %>
    <p class="control">
      <%= f.text_field :name, id: :role_name, class: 'input', required: 'required' %>
    </p>
  </div>

  <%= render partial: "permissions", locals: {f: f, name: :permissions_attributes, permissions: @role.permissions} %>

  <div class="field is-grouped">
    <%= f.submit class: 'button is-primary' %>
    <%= link_to 'Back', url_for(:back), class: 'button is-link' %>
  </div>
<% end %>

roles/_permissions.html.erb

<%= f.fields_for name, permissions do |ff| %>
  <% if permissions.class.attribute_names_for_inlining.any? %>
    <div class="field">
      <label class="label">
        <%= permissions.class.model_name.human %>
      </label>

      <p class="control">
        <% permissions.class.attribute_names_for_inlining.each do |permission| %>
          <%= ff.label permission, class: 'checkbox' do %>
            <%= ff.check_box permission, class: 'checkbox' %>
            <%= permissions.class.human_attribute_name(permission) %>
          <% end %>
        <% end %>
      </p>
    </div>
  <% end %>

  <% permissions.class.attribute_names_for_nesting.each do |permission| %>
    <%= render partial: "permissions", locals: {f: ff, name: permission, permissions: permissions.send(permission)} %>
  <% end %>
<% end %>