Something like:

access_control do
  allow all, :except => :destroy
  allow complex_role, :to => :destroy do
    is :strong
    is :decisive
    is :owner, :of => :object
    is_not :banned
    is_not :fake
  end
end

I've seen the acl9 documentation referred to as "confusing" or "don't read the docs, just use the thing".

Currently the only doc is the huge README file. Actually it's more of a description what and how acl9 does. Would be enough for me if I weren't the creator, but... Different people learn things different way.

So, do you see any ways of improving the docs? What are the most unclear aspects? Should it be tutorials, or...?

Looking forward to your comments here.

Some people expect ACL block in derived controller to extend its counterpart from the base controller. So they put rather restrictive rules to the base (e.g. deny all), trynig to loosen the restrictions in descendant controllers.

Unfortunately this doesn't work. Each access_control call with a block results in a filter being appended to the "before" filter chain. Now add more filters, get more restrictive behavior.

skip_before_filter comes to the rescue when you need to circumvent ACL block from the base controller, but how could we truly inherit ACL rules?

I see several possibilities.

1. Declare "virtual" ACL blocks, which are used only for inheritance. Something like:

   class BaseController < ApplicationController
     # ...
     access_control :base, :virtual => true do
       deny anonymous
     end
     # ...
   end
   
   class DerivedController < BaseController
     access_control do
       extends :base
       allow anonymous, :to => [:show, :index]
       allow logged_in
     end
   end
   

Here :base block doesn't get installed in BaseController as a filter.

1. Modification of (1).

Install the filter, but also save the rules into inheritable array. Each derived controller will append its rules, calling skip_before_filter against the inherited filter.

    class BaseController < ApplicationController
      # ...
      access_control :base, :virtual => true do
        deny anonymous
      end
      # ...
    end

    class DerivedController < BaseController
      access_control :base do
        allow anonymous, :to => [:show, :index]
        allow logged_in
      end
    end

    class DerivedDerivedController < DerivedController
      access_control :base do
        allow anonymous, :to => [:custom]
      end
    end

We get 3 blocks here. The 3rd block is used to match first (both for allow and for deny). If it doesn't bring a match, the 2nd block is tried and then the 1st.

...make all the pieces into the wiki.

For those who don't need object roles -- dead-simple has_role?() backend.

Currently one needs to copy-paste it from the doc, but the generator will do well.

Currently there seems to be privilege revocation missing which results in orphaned data rows.
Example:

@user.has_role! :provider, @service

If @service or @user is deleted, corresponding privileges need to be revoked. Maybe this could be implemented inside an after_destroy callback.

Well, it appears that you cannot reply to posts on the Google Groups without signing up, something I have no intention of doing (I like how they let you start a thread though...eugh).

Following on from :http://groups.google.com/group/acl9-discuss/browse_thread/thread/5b663c80191ac35a

I have the following

has_many :committee_memberships, :class_name => "Role", :finder_sql => 'SELECT * FROM roles r WHERE name = "member" AND authorizable_type = "Committee" AND id = (SELECT role_id FROM roles_users WHERE user_id = #{id} and role_id = r.id)'

This nicely returns all the role records for that user with the match. It is possible to use this to hardcode a "commitees" has_many without using the :through of users_roles but that isn't quite what I am after.

Has anyone got any ideas if this could be built on using a :through to get what I am after? Or any other ideas on how to get a :through working.

Roles are great, but it would be awesome to be able to control authorization based on associations that already exist, without having to manually assign a role to a user. For example, let's say a User created a Post, so @post.creator returns the user that created it. I want to be able to do this:

allow :creator, :of => :post

without calling user.has_role!('creator', post).

I know that you can override #has_role?, I currently do that to achieve this. I just thought that this could be a rather common issue. My implementation also allows for the same role to be applied to other subjects (users, in this case), so it doesn't get in the way of anything else you would do.

What do you think? Here is my version of has_role?

def has_role?(role_name, object = nil)
  !! if object.nil?
    self.roles.find_by_name(role_name.to_s) ||
    self.roles.member?(get_role(role_name, nil))
  else
    role = get_role(role_name, object)
    subject_owns_object = object.send(role_name) == self if object.respond_to?(role_name)
    (role && self.roles.exists?(role.id)) || subject_owns_object
  end
end

I have:

class User < ActiveRecord::Base acts_as_authentic do |c|

c.transition_from_restful_authentication = true

end

acts_as_authorization_subject end

class Role < ActiveRecord::Base acts_as_authorization_role end

All works fine except that user.roles that give me method_missing error. I need to put habtm roles relation in the User class.

What I am missing ?

I run into a bug with the dsl when using action blocks.

This work :

access_control do
  allow :superadmin
  action :index, :show do
    allow anonymous
  end
end

This doesn't :

access_control do
  allow :superadmin
  action :index, :show do
    allow anonymous
    allow :member
  end
end

After some testing, the wrong expression is :

.(@_subject.nil?) || (!@_subject.nil? && @_subject.has_role?('member', nil)) && Set.new(['index','show']).include?(@_current_action)

As you can see, when anonymous is used, this expression always true.

This issue come from missing parentheses in _either_of function.

I correct it like so, and it works :

def _either_of(exprs)
  clause = exprs.map { |expr| "(#{expr})" }.join(' || ')
  return "(#{clause})"
end

I'll fork acl9, add few tests, and commit the correction.

Cheers
Franck