如何在Rolify与CanCanCan中处理用户多角色及师生多对多关联？

Hey there! Let's break down how to tackle these two permission scenarios using Rolify and CanCanCan in your Rails app. I’ve worked with these gems extensively, so here’s a practical, step-by-step approach that should fit your needs perfectly.

Rolify’s strength lies in letting users hold multiple roles, and CanCanCan makes it easy to layer permissions based on those roles. Here’s how to set it up:

First, confirm your model associations #

Rolify automatically adds the has_many :roles association to your User model when you run its generators, so you’re covered here. You can assign multiple roles to a user like this in the console or your admin interface:

user = User.find(1)
user.add_role :teacher
user.add_role :editor

Define layered permissions in your Ability class #

In app/models/ability.rb, you’ll check for each role and apply the corresponding permissions. CanCanCan will automatically combine permissions from all roles the user holds—no extra work needed.

class Ability
  include CanCan::Ability

  def initialize(user)
    user ||= User.new # Guest user fallback

    # Base permissions for all logged-out/in users
    can :read, Course
    can :read, Assignment

    # Permissions for Teachers
    if user.has_role? :teacher
      can :create, Assignment
      can [:update, :destroy], Assignment, course: { teachers: { id: user.id } }
    end

    # Permissions for Editors
    if user.has_role? :editor
      can :update, Course, published: false # Only edit unpublished courses
      can :publish, Course # Custom action for editors
    end

    # Admin overrides all other permissions
    if user.has_role? :admin
      can :manage, :all
    end
  end
end

• If a user is both a teacher and editor, they’ll get permissions from both roles.
• Use can? :action, resource in views to conditionally show/hide elements (e.g., edit buttons):

  <% if can? :update, @course %>
    <%= link_to "Edit Course", edit_course_path(@course) %>
  <% end %>
  

First, you’ll need to set up the many-to-many association between your User (teachers) and Course (classes) models, then lock down permissions to only let teachers manage their own assigned classes.

Step 1: Set up the association #

Create a join model (e.g., TeacherEnrollment) to handle the many-to-many link:

# Generate the join model
rails generate model TeacherEnrollment user:references course:references
rails db:migrate

Update your main models:

# app/models/user.rb
class User < ApplicationRecord
  rolify
  has_many :teacher_enrollments
  has_many :taught_courses, through: :teacher_enrollments, class_name: "Course", source: :course
end

# app/models/course.rb
class Course < ApplicationRecord
  has_many :teacher_enrollments
  has_many :teachers, through: :teacher_enrollments, source: :user
end

Step 2: Define granular permissions in Ability #

Now, restrict teachers to only manage courses they’re enrolled in using CanCanCan’s hash conditions (it automatically translates these to SQL queries for efficient filtering):

class Ability
  include CanCan::Ability

  def initialize(user)
    user ||= User.new

    can :read, Course

    if user.has_role? :teacher
      # Teachers can manage only their assigned courses
      can [:update, :destroy, :assign_students], Course, id: user.taught_courses.pluck(:id)
      # Alternatively, use the association directly for cleaner code
      can :manage, Course, teachers: { id: user.id }

      # Permissions for related resources (e.g., assignments tied to their courses)
      can :create, Assignment
      can [:update, :destroy], Assignment, course: { teachers: { id: user.id } }
    end

    if user.has_role? :admin
      can :manage, :all
    end
  end
end

• In controllers, use load_and_authorize_resource to automatically filter out courses the user doesn’t have access to:

  # app/controllers/courses_controller.rb
  class CoursesController < ApplicationController
    load_and_authorize_resource
  
    def index
      # @courses will only include courses the user can view
    end
  end
  

内容的提问来源于stack exchange，提问作者Vishal Goel