help my in that question:
i have 2 models ( admin and user ) -> created with devise, and i have post_controller:
and the question arises:
if i have one model ( user.rb ) -> in my controller i put that:
before_filter :authenticate_user!, :except => [:show, :index]
but i have 2 models and i want to User have access to 'show' and 'index' action of post controller and Admin have access to all actions.
and i do something like that:
before_filter :logged_in
.
.
.
private
def logged_in
if admin_signed_in?
else
authenticate_user!
end
end
but i want change my string:
authenticate_user!
to something like that:
:authenticate_user!, :except => [:show, :index]
but except refers to before_filter
how can I do it ( without 'cancan' gem )
Devise also comes with some very useful helper functions: before_action :authenticate_user! — Add to any controller to limit access to an action unless a user is logged in.
current_user works by storing id of current user in the application session. Most commonly session is stored in cookies. Whether or not the cookies survive browser restart depends on client's browser settings.
Our out-of-the box Devise setup is now working with Rails 7. Once again, if you'd like to refer to any of the code for this setup, or use the template wholesale for a new app, the code is available on GitHub, and you may also use it as a template repo to kick off your own Rails 7 devise projects.
The devise gem is basically based on a warden gem, which gives an opportunity to build authorization direct on a Ruby Rack Stack. This gem is pretty straightforward and well documented. Warden fetches a request data and checks if the request includes valid credentials, according to a defined strategy.
Try using two before filters - one for admin only actions, and another for admin or user actions.
# ensure admin for other actions
before_filter :check_admin_logged_in!, :except => [:show, :index]
# ensure user or admin logged in for these actions (:only option is optional)
before_filter :check_user_logged_in!, :only => [:show, :index]
private
def check_admin_logged_in! # admin must be logged in
authenticate_admin!
end
def check_user_logged_in! # if admin is not logged in, user must be logged in
if !admin_signed_in?
authenticate_user!
end
end
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With