如何基于Devise与belongs_to实现仅数据所有者可访问数据？

Hey there! Let's walk through how to lock down your app so only the owner of a record can access or modify it, using Devise and your existing belongs_to associations. Here's a practical, step-by-step approach:

1. 确认模型关联与数据库设置 #

First off, make sure your models are properly linked. Let's use a common example: a User who owns multiple Post records.

• 在你的Post模型中添加关联：

  # app/models/post.rb
  class Post < ApplicationRecord
    belongs_to :user
  end
  

• 在你的User模型中配置反向关联：

  # app/models/user.rb
  class User < ApplicationRecord
    devise :database_authenticatable, :registerable,
           :recoverable, :rememberable, :validatable
    has_many :posts, dependent: :destroy # 可选：删除用户时自动删除其所有帖子
  end
  

• 确保你的posts表包含user_id字段（如果还没有，生成迁移并执行）：

  rails generate migration AddUserIdToPosts user:references
  rails db:migrate
  

2. 创建记录时自动关联当前用户 #

When a logged-in user creates a new record, you want to automatically assign it to them—never let users manually set the user_id via form input (that's a critical security risk!).

在控制器的create动作中，用Devise提供的current_user方法关联新记录：

# app/controllers/posts_controller.rb
def create
  # 通过current_user的关联方法构建，自动设置user_id
  @post = current_user.posts.build(post_params)

  if @post.save
    redirect_to @post, notice: 'Post was successfully created.'
  else
    render :new
  end
end

# 确保强参数排除user_id，防止恶意提交
private
def post_params
  params.require(:post).permit(:title, :body) # 绝对不要包含:user_id！
end

3. 控制器层添加权限校验 #

Add a before-action to check if the current user is the owner of the record before allowing access to show/edit/update/destroy actions.

在你的资源控制器中添加：

# app/controllers/posts_controller.rb
before_action :set_post, only: [:show, :edit, :update, :destroy]
before_action :authorize_owner, only: [:show, :edit, :update, :destroy]

private
def set_post
  @post = Post.find(params[:id])
end

def authorize_owner
  # 校验当前用户是否为记录所有者
  unless @post.user == current_user
    # 重定向到首页并提示无权限，或者返回403 Forbidden状态码
    redirect_to root_path, alert: "You don't have permission to access this resource."
    # 更严谨的后端处理：head :forbidden
  end
end

额外：限制列表页只显示当前用户的记录 #

如果你的index动作应该只展示当前用户的资源，修改为：

def index
  @posts = current_user.posts.all # 替代Post.all，只加载当前用户的帖子
end

4. 视图层的体验优化 #

在视图中，仅对所有者显示编辑/删除按钮，避免无效操作：

# app/views/posts/index.html.erb
<% @posts.each do |post| %>
  <div class="post-card">
    <h3><%= post.title %></h3>
    <p><%= post.body %></p>
    <% if post.user == current_user %>
      <%= link_to 'Edit', edit_post_path(post), class: 'btn btn-primary' %>
      <%= link_to 'Destroy', post, method: :delete, data: { confirm: 'Are you sure?' }, class: 'btn btn-danger' %>
    <% end %>
  </div>
<% end %>

进阶：用Pundit实现复杂权限规则 #

如果你的app需要更精细的权限逻辑（比如允许管理员访问所有记录），推荐使用Pundit gem：

1. 安装Pundit并生成基础配置
2. 为模型创建Policy类，定义权限逻辑：

   # app/policies/post_policy.rb
   class PostPolicy < ApplicationPolicy
     def show?
       record.user == user || user.admin?
     end
   
     # 同理定义edit?、update?、destroy?等方法
   end
   

3. 在控制器中用authorize方法替代自定义的authorize_owner：

   def show
     @post = Post.find(params[:id])
     authorize @post
   end
   

内容的提问来源于stack exchange，提问作者Jelle