title: declarative_authorization: control access to nested resource that doesn't have an explicit model
body: <p>I have a model that allows a User to mark other Users as Favorites.
  This HABTM relationship is defined in the User model:</p>
  
  <pre><code>class User &lt; ActiveRecord::Base
    has_and_belongs_to_many :favorites, :class_name =&gt; "User", :join_table =&gt; "favorites", :association_foreign_key =&gt; "favorite_id", :foreign_key =&gt; "user_id"
  end
  </code></pre>
  
  <p>The FavoritesController only requires three actions (index, create,
  destroy) to manage a User's Favorites.</p>
  
  <p>Rule: Only an authenticated user (current_user) is allowed to manage
  their Favorites.</p>
  
  <p>Initially, I tried to represent this rule in the authorization_rule.rb
  file:</p>
  
  <pre><code># allow authenticated user to update profile
  has_permission_on :users, :to =&gt; :change do
    if_attribute :id =&gt; is { user.id }
    has_permission_on :favorites, :to =&gt; [:index,:create,:destroy]
  end
  </code></pre>
  
  <p>This didn't work, probably because the Favorite doesn't have an
  explicit model (i.e. favorite.rb).  Though I could be wrong about
  this.</p>
  
  <p>It seems like the correct approach would be to represent the rule in
  the FavoritesController:</p>
  
  <pre><code>filter_access_to :all, :nested_in =&gt; :users
  ...
  </code></pre>
  
  <p>But I'm not certain how to represent the rule properly here.</p>
  
  <p>Assistance is really appreciated. </p>
  
  <p>** edit **</p>
  
  <p>It was suggested that I use a context to control access in this situation: <a href="http://groups.google.com/group/declarative_authorization/browse_thread/thread/258451b4ad0e618c/4000f6d31812df6f" rel="nofollow noreferrer">
  setting permissions for a no-model controller </a>.</p>
  
  <p>I tried modifying the FavoritesController:</p>
  
  <pre><code>filter_access_to :all, :context =&gt; :favorites
  </code></pre>
  
  <p>This change had no effect.</p>
  
  <p>** /edit **</p>