app/models/appointment.rb
# Custom security check for the custom :issue_receipt action.
#
Custom security check for the custom :issue_receipt action.
Custom security check for the custom : issue_receipt action .
def authorized_for?(*args)
         This is required because of the current model-security layer implementation in ActiveScaffold,
         which is limited to CRUD action types and only the standard CRUD actions are successfully checked
         for their XXX_authorized? methods - unless a 'custom' :crud_type is specified in the
         config.action_link.add() statement of the controller.
         Moreover, specifying anything beside :create, :read, :update or :delete for this :crud_type
         will raise an "unknown CRUD action type" error, _unless_ intercepted here in the
         method below. (And this is the reason why :crud_type => :issue_receipt works.)
         Specifying anything in the :secury_method parameter of the config.action_link.add() statement
         does not solve the issue since the :secury_method is just controller-related and not member (or record) aware.
         For instance, the method issue_receipt_authorized?() above is called automatically would this
         authorized_for?() implementation be commented out - but, alas, this would spawn the error mentioned
         before.
 DEBUG
    puts "\r\n--- authorized_for?( {args.inspect} ) CHECKING => {current_user.inspect}"
    return false if current_user.nil?                If current_user is not defined or the model is accessed outside of the request/response cycle, bail out
    is_allowed = current_user.can_do( :appointments, args[0][:action] )
 DEBUG
    puts "--- is_allowed: {is_allowed}"
    return is_allowed && issue_receipt_authorized? if args[0][:column].blank? && (args[0][:action] == :issue_receipt)
    return is_allowed && (! is_receipt_issued?) if args[0][:column].blank? && (args[0][:action] == :delete)
    return is_allowed
  end
def authorized_for? ( * args ) return false if current_user . nil? is_allowed = current_user . can_do ( :appointments , args [ 0 ] [ :action ] ) return is_allowed && issue_receipt_authorized? if args [ 0 ] [ :column ] . blank? && ( args [ 0 ] [ :action ] == :issue_receipt ) return is_allowed && ( ! is_receipt_issued? ) if args [ 0 ] [ :column ] . blank? && ( args [ 0 ] [ :action ] == :delete ) return is_allowed end
Custom security check for the custom :issue_receipt action.
Custom security check for the custom : issue_receipt action .
# XXX [Steve, 20100315] # #     This is required because of the current model-security layer implementation in ActiveScaffold, #     which is limited to CRUD action types and only the standard CRUD actions are successfully checked #     for their XXX_authorized? methods - unless a 'custom' :crud_type is specified in the #     config.action_link.add() statement of the controller. # #     Moreover, specifying anything beside :create, :read, :update or :delete for this :crud_type #     will raise an "unknown CRUD action type" error, _unless_ intercepted here in the #     method below. (And this is the reason why :crud_type => :issue_receipt works.) # #     Specifying anything in the :secury_method parameter of the config.action_link.add() statement #     does not solve the issue since the :secury_method is just controller-related and not member (or record) aware. # #     For instance, the method issue_receipt_authorized?() above is called automatically would this #     authorized_for?() implementation be commented out - but, alas, this would spawn the error mentioned #     before. # # DEBUG #    puts "#\r\n--- authorized_for?( #{args.inspect} ) CHECKING => #{current_user.inspect}" # If current_user is not defined or the model is accessed outside of the request/response cycle, bail out # DEBUG #    puts "--- is_allowed: #{is_allowed}"
args