如何为单个控制器配置CanCanCan的Action别名？

Great question! Unfortunately, CanCanCan doesn’t offer a built-in way to set action aliases for a single controller—its alias_action method is indeed global, tied to your main Ability class. But there are a couple of clean, maintainable workarounds that let you avoid manual authorize! calls in your controller methods.

Option 1: Skip Default Authorization & Use a Before Action #

The simplest approach is to bypass CanCanCan’s default authorize_resource behavior for this controller, then explicitly define the permission check for your actions using a before action. This keeps all permission logic centralized in one place without affecting other controllers.

Here’s how to update your VoidJourneyController:

module Journeys
  class VoidJourneyController < ApplicationController
    # Skip the default authorize_resource to avoid the global read alias affecting show
    skip_authorize_resource class: :journey
    # Authorize destroy permission for both show and destroy actions
    before_action :authorize_void_journey_access, only: [:show, :destroy]

    def show; end
    def destroy; end

    private

    def authorize_void_journey_access
      authorize! :destroy, :journey
    end
  end
end

Option 2: Use a Controller-Specific Ability Subclass #

For more complex permission scenarios, you can create a subclass of your main Ability class, override the alias logic there, and tell your controller to use this custom ability instead of the global one.

First, create a dedicated ability class:

# app/models/abilities/void_journey_ability.rb
class VoidJourneyAbility < Ability
  def initialize(user)
    super(user) # Inherit permissions from the main Ability class
    # Override the alias just for this controller's context
    alias_action :show, to: :destroy
  end
end

Then update your controller to use this custom ability:

module Journeys
  class VoidJourneyController < ApplicationController
    authorize_resource class: :journey

    def show; end
    def destroy; end

    private

    def current_ability
      @current_ability ||= VoidJourneyAbility.new(current_user)
    end
  end
end

Why This Works #

The first option is ideal for quick fixes where you just need to map a single action to a different permission. The second option is better if you need multiple custom permission rules for this controller without cluttering your main Ability class.

Neither requires manual authorize! calls in each action, and both keep your permission logic clean and maintainable.

内容的提问来源于stack exchange，提问作者Cameron