Update cancancan Gem to 3.2
#50693
Update cancancan Gem to 3.2
#50693
Conversation
To pick up support for Rails 6.1 - https://github.com/CanCanCommunity/cancancan/blob/develop/CHANGELOG.md#320 - CanCanCommunity/cancancan#666
Hamms
added
the
Rails Upgrade
| @@ -205,7 +205,7 @@ def initialize(user) | |||
| !script.old_professional_learning_course? | |||
| end | |||
| can [:read, :find], :regional_partner_workshops | |||
| can [:new, :create, :read, :update], TEACHER_APPLICATION_CLASS, user_id: user.id | |||
| can [:new, :create, :show, :update], TEACHER_APPLICATION_CLASS, user_id: user.id | |||
There was a problem hiding this comment.
This is a subtle one!
In addition to Rails 6.1 support, this version of CanCanCan also added support for single-table inheritance, meaning that permissions can now cascade to their descendants ancestors (edit: I got this backwards originally). Unfortunately, this revealed what I think is a bug in our implementation logic; our intent here is to grant teachers view permissions to the teacher application model. That model is based on our ApplicationBase model, the permissions of which also control the route that lets you query all applications.
We don't actually want teachers to be able to access that route, but because read is an alias for index plus show, we are implicitly (and I think accidentally) relying on single-table inheritance not working here to avoid this permission cascading up to the application dashboard controller.
The simple fix is to be more targeted in the permissions we grant.
To pick up support for Rails 6.1
Links
Testing story
Relying on existing tests to verify that this does not result in any change in functionality.
PR Checklist: