{"action":"opened","issue":{"url":"https://api.github.com/repos/CanCanCommunity/cancancan/issues/337","repository_url":"https://api.github.com/repos/CanCanCommunity/cancancan","labels_url":"https://api.github.com/repos/CanCanCommunity/cancancan/issues/337/labels{/name}","comments_url":"https://api.github.com/repos/CanCanCommunity/cancancan/issues/337/comments","events_url":"https://api.github.com/repos/CanCanCommunity/cancancan/issues/337/events","html_url":"https://github.com/CanCanCommunity/cancancan/issues/337","id":167980520,"number":337,"title":"accessible_by not returning the correct results when multiple rules are present","user":{"login":"rickyhopkins","id":4586254,"avatar_url":"https://avatars.githubusercontent.com/u/4586254?v=3","gravatar_id":"","url":"https://api.github.com/users/rickyhopkins","html_url":"https://github.com/rickyhopkins","followers_url":"https://api.github.com/users/rickyhopkins/followers","following_url":"https://api.github.com/users/rickyhopkins/following{/other_user}","gists_url":"https://api.github.com/users/rickyhopkins/gists{/gist_id}","starred_url":"https://api.github.com/users/rickyhopkins/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rickyhopkins/subscriptions","organizations_url":"https://api.github.com/users/rickyhopkins/orgs","repos_url":"https://api.github.com/users/rickyhopkins/repos","events_url":"https://api.github.com/users/rickyhopkins/events{/privacy}","received_events_url":"https://api.github.com/users/rickyhopkins/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-07-27T23:31:02Z","updated_at":"2016-07-27T23:31:02Z","closed_at":null,"body":"I have a complex data structure with a large number of abilities. I have recently added two new abilities to add permissions for two new scenarios.\r\n\r\nModel files:\r\n```\r\nclass Asset < ActiveRecord::Base\r\n  has_and_belongs_to_many :clients\r\n  has_and_belongs_to_many :applications\r\nend\r\n```\r\n```\r\nclass Client < ActiveRecord::Base\r\n  belongs_to :firm\r\n  belongs_to :owner, class_name: 'User'\r\n\r\n  has_and_belongs_to_many :assets\r\n  has_and_belongs_to_many :borrower_applications, class_name: 'Application', join_table: :borrowers\r\n  has_and_belongs_to_many :guarantor_applications, class_name: 'Application', join_table: :guarantors\r\nend\r\n```\r\n```\r\nclass Application < ActiveRecord::Base\r\n  has_and_belongs_to_many :assets\r\n  has_and_belongs_to_many :borrowers, class_name: 'Client', join_table: :borrowers\r\n  has_and_belongs_to_many :guarantors, class_name: 'Client', join_table: :guarantors\r\nend\r\n```\r\n\r\nSo my assests can be linked to either a Client or an Application, and I want my permissions to be driven by `client.firm_id`, so a user in the right firm should have permissions on all Assets related to the `firms -> clients`, or the `firms -> clients -> applications` where the client is either a borrower or a guarantor.\r\n\r\nSo I have set up abilities like so:\r\n```\r\nfirm_id = user.current_firm.try(:id)\r\ncan :manage, Asset, loan_applications: { guarantors: { firm_id: firm_id } }\r\ncan :manage, Asset, loan_applications: { borrowers: { firm_id: firm_id } }\r\ncan :manage, Asset, clients: { firm_id: firm_id }\r\n```\r\n\r\nSo to test this I set up a client as a borrower on an application, and linked an asset to both the client and the application (as a borrower, not a guarantor)\r\n\r\nResults:\r\n```\r\nfirm_id = User.last.current_firm.id\r\n\r\nAsset.last.clients.first.firm_id == firm_id #=> true\r\nAsset.last.loan_applications.first.borrowers.first.firm_id == firm_id #=> true\r\nAsset.last.loan_applications.first.guarantors.first.try(:firm_id) == firm_id #=> false\r\n\r\na = Ability.new(User.last)\r\n\r\na.can?(:read, Asset.last) #=> true\r\nAsset.accessible_by(a, :read) #=> #<ActiveRecord::Relation []>\r\n\r\na.can?(:destroy, Asset.last) #=> true\r\nAsset.accessible_by(a, :destroy) #=> #<ActiveRecord::Relation []>\r\n```\r\nManually testing each of the rules suggest that two pass and one fails, but according to the ability precedence wiki page `Adding can rules do not override prior rules, but instead are logically or'ed.` so I would expect the user to have permissions on the asset.\r\n\r\nWhile it is very possible that I am doing something wrong I dont know why I am getting different results from the `can?` and `accessible_by` methods.\r\n\r\nFor the record it works when I comment out the first two abilities."}}
{"actor":{"display_login":"rickyhopkins"}}