Skip to content
This repository has been archived by the owner on Nov 19, 2019. It is now read-only.

Commit

Permalink
more readme tweaks
Browse files Browse the repository at this point in the history
  • Loading branch information
Nathan Long committed Apr 26, 2012
1 parent c391de0 commit 762a007
Showing 1 changed file with 3 additions and 1 deletion.
4 changes: 3 additions & 1 deletion README.markdown
Expand Up @@ -154,7 +154,7 @@ These are where your actual authorization logic goes. Here's how it works:
- Instance methods answer questions about model instances, like "can this user update this **particular** widget?" (Within an instance method, you can get the model instance with `resource`).
- Any instance method you don't define (for example, if you didn't make a `def deletable_by?(user)`) will fall back to the corresponding class method. In other words, if you haven't said whether a user can update **this particular** widget, we'll decide by checking whether they can update **any** widget.
- Class methods answer questions about model classes, like "is it **ever** permissible for this user to update a Widget?"
- Any class method you don't define (for example, if you didn't make a `def self.updatable_by?(user)`) will call that authorizer's `default` method
- Any class method you don't define (for example, if you didn't make a `def self.updatable_by?(user)`) will call that authorizer's `default` method.

For example:

Expand All @@ -171,6 +171,8 @@ class ScheduleAuthorizer < ApplicationAuthorizer
resource.in_future? && user.manager? && resource.department == user.department
end
end

ScheduleAuthorizer.updatable_by?(user) #=> undefined; calls `ScheduleAuthorizer.default(:updatable, user)`
```

As you can see, you can specify different logic for every method on every model, if necessary. On the other extreme, you could simply supply a [default method](#default_methods) that covers all your use cases.
Expand Down

0 comments on commit 762a007

Please sign in to comment.