ruby-on-rails – 使用CanCan在Active Admin中拒绝访问用户

如果用户无权阅读admin / manuals / 1并将其输入地址栏,则会正确地重定向并显示未经授权的消息.但是,如果用户键入admin / manuals / 1 / parts,则不会拒绝访问.它们被带到该页面,除了隐藏所有部分.他们应该被未经授权的消息重定向到仪表板.

这是我的配置.提前感谢您提供的任何建议.

配置/ routes.rb中

ActiveAdmin.routes(self)

车型/ ability.rb

class Ability
  include CanCan::Ability

  def initialize(user)
    user ||= User.new

    can :read,ActiveAdmin::Page,:name => "Dashboard"

    if user.has_role? :admin
      can :manage,:all
    elsif user.has_role? :moderator
      can :manage,Part,:manual => { :company_id => user.company_id }
    else
      can :read,:manual => { :company_id => user.company_id }
    end
  end
end

我还覆盖了controllers / application_controller.rb中的默认授权方法

rescue_from CanCan::AccessDenied do |exception|
  redirect_to root_url,:alert => exception.message
end

def authenticate_admin_user!
  authenticate_user!
  unless user_signed_in?
    flash[:alert] = "You are not authorized to view this page"
    redirect_to root_path
  end
end

def current_admin_user #use predefined method name
  return nil unless user_signed_in?
  current_user
end

def after_sign_in_path_for(user)
  if current_user.has_role? :admin
    admin_dashboard_path
  elsif current_user.has_role? :moderator
    admin_manuals_path
  else
    company_path(user.company)
  end
end