Rails - CanCan - Set & Assign Roles? - cancan

Question

How do I setup the roles for CanCan, and how do I assign those roles to users? I'd like for now at least to have a dropdown menu upon registration for a user to select their role. I'm not quite sure with all of the documentation I keep seeming to miss this, but any help is greatly appreciated!

Answer 1

Here's a solid Rails-appropriate method for managing roles. I use it. I like it. Essentially, you create a has-and-belongs-to-many table to associate users and roles and define a single function, User#has_role? to check for the association.
# file: app/models/user.rb
class User < ActiveRecord::Base
has_many :user_roles, :dependent => :destroy
has_many :roles, :through => :user_roles
def has_role?(name)
roles.pluck(:name).member?(name.to_s)
end
end
# file: app/models/role.rb
class Role < ActiveRecord::Base
has_many :user_roles, :dependent => :destroy
has_many :users, :through => :user_roles
end
# file: app/models/user_role.rb
class UserRole < ActiveRecord::Base
belongs_to :user
belongs_to :role
end
The migration / schema files:
# file: db/migrate/xxx_create_users.rb
class CreateUsers < ActiveRecord::Migration
def change
create_table(:users) do |t|
t.string :email, :null => false, :default => ""
# ... any other fields you want ...
t.timestamps
end
end
end
# file: db/migrate/xxx_create_roles.rb
class CreateRoles < ActiveRecord::Migration
def change
create_table :roles do |t|
t.string :name
t.timestamps
end
end
end
# file: db/migrate/xxx_create_user_roles.rb
class CreateUserRoles < ActiveRecord::Migration
def change
create_table :user_roles do |t|
t.references :user
t.references :role
t.timestamps
end
add_index :user_roles, [:user_id, :role_id], :unique => true
end
end
So now, your Ability file will look something like this:
class Ability
include CanCan::Ability
def initialize(user)
user ||= User.new # support guest user
if user.has_role?(:admin)
can :manage, :all
elsif user.has_role?(:nsa)
can :read, :all
elsif user.has_role?(:editor)
# ... add other abilities here
end
end
end
To be clear, this doesn't answer the OP's question about how you create roles in the first place. But since users, roles, and user_roles are now full Rails models, you can use the standard CRUD tools for managing them. But 90% of the time, you'll simply be assigning admin privileges to one or two users, which is easily done in a seed file like this:
# file: db/seeds.rb
# create a role named "admin"
admin_role = Role.create!(:name => "admin")
# create an admin user
admin_user = User.create!(:email => "admin#admin.com")
# assign the admin role to the admin user. (This bit of rails
# magic creates a user_role record in the database.)
admin_user.roles << admin_role

Answer 2

I figured this out for the most part.
For setting up roles, they are actually set when you define them in the ability class.
For instance:
if user.has_role? :admin
can :manage, :all
else
can :read, :all
end
This is basically "setting up" the admin role. For some reason I thought you would have to initialize that role elsewhere as well.
To assign the roles, following most tutorials I've seen, you need to go into the rails console and use something similar to:
user = User.find(1)
user.add_role :admin # sets a global role
user.has_role? :admin
=> true
The first line finds the user, and the second adds the role. The third is used to check if the user is assigned to that role. There are also ways to add this upon registration, and a few others as well. I'll try to list them here as I run across them, but hopefully this clears up any confusion for someone in the future. :)

Answer 3

I handled this by putting a roles field in the user table, with the roles comma separated in the string field. I let an administrator manage the user roles, with programmatic check for valid against a configuration file (using functions such as such as valid_role?, has_role?. I then wrote some functions in the user model that CanCan could call such as user_can_see_...
Not sure how that would work for a self administered role system, but if you are interested, my code can be found at: tws_auth on github