Is it possible to use cancan in a model?

Question

I have a model with a statemachine and i want to limit different states/events/transitions to different users.

How can i access current user and ability in this model?

Answer 1

You can define abilities in cancan against any methods provided by the model. State machine transitions are themselves methods provided by the model, so just set up your abilities as you would for any other methods.

For example, given a simple model:

class Order < ActiveRecord::Base

  state_machine :initial => :new do

    event :start_processing do
      transition :new => :processing
    end

    event :complete_order do
      transition :processing => :complete
    end

    event :escalate_order do
      transition :processing => :escalated
    end

    event :complete_escalated_order
      transition :escalated => :complete
    end

    state :new
    state :processing
    state :escalated
    state :complete
  end

end

You might define abilities like this:

class Ability

  if user.role? :orderer
    can [:start_processing, :escalate_order, :complete_order], :orders
  end
  if user.role? :manager
    can :complete_escalated_order, :orders
  end

end

EDIT - I should have added, that you would then use these abilities in your controllers handling the user requests:

class OrdersController < ApplicationController

  def complete
    @order = Order.find_by_ref(params[:id])

    if @order.can_complete_order?
      authorize! :complete_order, @order
      @order.complete_order
    elsif @order.can_complete_escalated_order?
      authorize! :complete_escalated_order, @order
      @order.complete_escalated_order
    else
      redirect_to root_url, :notice => "Order cannot be completed"
    end

    redirect_to my_queue_path, :notice => "Order #{@order.ref} has been marked as complete."

end