app/models/ability.rb
#########################################
# Deprecation of :manage
# ---------------------------------
# CanCanCan best practice seems to indicate it's better to give permissions than to take them away.
# Using :manage impedes this because it grants permissions on all actions.
# This means one has to use cannot to revoke some of those later in the file if necessary.
# Having multiple places where a permission is defined (given, taken away, given again) is confusing
# and can prevent the definition of a scope for use with accessible_by.
# So we are moving away from using :manage, preferring to grant permissions explicitly instead.
#
# When refactoring away from :manage, be sure to account for all permissions that may be getting checked
# at runtime. Places to look are:
# - Throughout this file
# - Throughout this gist https://gist.github.com/cooperka/47f50bd17f854e25ec179b382d9e9e4f
#   which was created by grepping:
#     - Throughout the app by grepping can?, cannot?, authorize!, and accessible_by
#     - The routes file (are there any custom actions combined authorize_resource?-if so, consider using
#       skip_authorize_resource and using a stock permission unless the custom one is really needed.)
Deprecation of :manage
CanCanCan best practice seems to indicate it's better to give permissions than to take them away.
Using :manage impedes this because it grants permissions on all actions.
This means one has to use cannot to revoke some of those later in the file if necessary.
Having multiple places where a permission is defined (given, taken away, given again) is confusing
and can prevent the definition of a scope for use with accessible_by.
So we are moving away from using :manage, preferring to grant permissions explicitly instead.

When refactoring away from :manage, be sure to account for all permissions that may be getting checked
at runtime.
Deprecation of : manage CanCanCan best practice seems to indicate it ' s better to give permissions than to take them away . Using : manage impedes this because it grants permissions on all actions . This means one has to use cannot to revoke some of those later in the file if necessary . Having multiple places where a permission is defined ( given taken away given again ) is confusing and can prevent the definition of a scope for use with accessible_by . So we are moving away from using : manage preferring to grant permissions explicitly instead . When refactoring away from : manage be sure to account for all permissions that may be getting checked at runtime .
def user_dependent_permissions
    can(:show, Welcome)
    can(%i[show update], User, id: user.id)
    can(:confirm_login, UserSession)
    can(%i[index show clear destroy], Operation, creator_id: user.id)
    can(:submit_to, Form) { |f| user.admin? || user.assignments.detect { |a| a.mission == f.mission } }
    non_admin_permissions unless user.admin?
    mission_dependent_permissions if mission
    admin_permissions if user.admin?
    cannot(:change_assignments, User, id: user.id) unless user.admin?
    cannot(:regenerate_api_key, User)
    can(:regenerate_api_key, User) { |u| u == user }
    can(:create, Media::Object)
    can(:destroy, Media::Object) { |obj| obj.response.nil? || can?(:edit, obj.response) }
  end
def user_dependent_permissions can ( :show , Welcome ) can ( %i[ show update ] , User , id : user . id ) can ( :confirm_login , UserSession ) can ( %i[ index show clear destroy ] , Operation , creator_id : user . id ) can ( :submit_to , Form ) { | f | user . admin? || user . assignments . detect { | a | a . mission == f . mission } } non_admin_permissions unless user . admin? mission_dependent_permissions if mission admin_permissions if user . admin? cannot ( :change_assignments , User , id : user . id ) unless user . admin? cannot ( :regenerate_api_key , User ) can ( :regenerate_api_key , User ) { | u | u == user } can ( :create , Media :: Object ) can ( :destroy , Media :: Object ) { | obj | obj . response . nil? || can? ( :edit , obj . response ) } end
Deprecation of :manage
CanCanCan best practice seems to indicate it's better to give permissions than to take them away.
Deprecation of : manage CanCanCan best practice seems to indicate it ' s better to give permissions than to take them away .
# Toggle permissions in order of increasing level of role power. # Can only modify own API key.