CanCan custom actions not working with blocks

Question

I'm changing some of my custom CanCan actions in the Ability class to use blocks instead of just a hash but now they've stopped actually restricting access. The odd thing is that the built in actions like :manage and :create, etc. seem to still be working fine with the blocks.

This is one example:

OLD

# this one works
can :share, Project, :user_id => user.id

NEW

# this one doesn't work
can :share, Project do |project|
  project.users.exists?(user)
end

Anyone run into this issue before?

Gaddy

Answer 1

I can't say much about your undesired behavior, but you probably shouldn't be changing hashes to block, as these hashes give you the ability of fetching records. Read this article carefully in CanCan wiki.

Entourage

Believe me, I don't want to use the blocks but it seems like the only way to do it in my case. I've moved from a one-to-many relationship between Projects and Users to a many-to-many so now I need to check all of the users on a Project, not just one. – Gaddy

Hmm, try to use debugger and see what happens in CanCan when checking for ability. Or open and edit cancan gem's files on your filesystem and see what gets passed by dumping variables. This is how I stay on path when I can't think of anything else. Of course revert the files back ;) – Entourage