load_and_authorize_resource with shallow nested resources does not load parent #401

plindelauf opened this Issue Jun 16, 2011 · 6 comments

5 participants


I have:
load_and_authorize_resource :company
load_and_authorize_resource :presentation, :through => :company, :shallow => true

I would expect that the :shallow => true takes care of correctly loading the @company when its id is not in the parameter list, but it doesn't... @company = nil.

Thanks for an otherwise great Gem.



That is an interesting idea. My only concern is that it doesn't quite map what the user is requesting through params since the parent resource isn't mentioned. I'll mark this for discussion to see what others think.

I also wonder what InheritedResource and other resource loading tools do in this situation. Anyone know?


This would definitely be useful for me. As an alternative, I'm using the following workaround:

before_filter :load_project_on_shallow, only: [:show, :edit, :update, :destroy]
load_and_authorize_resource :project
load_and_authorize_resource :task, through: :project, shallow: true

def load_project_on_shallow
  @task = Task.find(params[:id])
  @project = @task.project

This is a little clumsy and I might be doing it all wrong, so suggestions are welcome!


The workaround I usually use is

load_and_authorize_resource :project
load_and_authorize_resource :task, through: :project, shallow: true
before_filter :set_project


def set_project
  @project ||= @task.project

@stellard Looks like a great solution, but this unfortunately does not work. I still get Couldn't find ParentObject with id= and an ActiveRecord::RecordNotFound exception, when accessing the nested resource's edit page.


@sebastianwr You wouldn't expect it to load the parent resource on the edit page for shallow routes (this is why you dont have an id for the find)

This error indicates that your settings are not correct for load_and_authorize_resource

missing shallow: true ?


No, shallow is set to true for this method. The parent object should be loaded not by ID in the URL but through the nested object's reference. But it's related to bug #864, I guess.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment