为什么cancancan不允许我访问某些页面？

Question

我正在尝试创建简单的质量检查论坛。我使用 devise 进行身份验证，并决定使用 cancancan 进行授权。

能力.rb：

class Ability
  include CanCan::Ability
    def initialize(user)
        can :read, :all

        if user && user.role?(:admin)
            can :access, :rails_admin
            can :dashboard
            can :manage, :all
        elsif user && user.role?(:user)
            can :create, [Post, Comment]
            can :update, Post, user_id: user.id
            can :update, User, id: user.id
            can [:update, :destroy], Comment, user_id: user.id
        elsif user && user.role?(:moderator)
            can [:create, :update, :destroy], [Post, Comment]
        end
    end
end

帖子控制器：

class PostsController < ApplicationController
  before_action :authenticate_user!, except: [:index, :show]
  load_and_authorize_resource

  def index
    @posts = Post.all.order('created_at DESC')
  end

  def withtag
    if params[:tag]
      @posts = Post.tagged_with(params[:tag]).order('created_at DESC')
      @tagname = params[:tag]
      @tag = Tag.find_by_name(params[:tag])
    end
  end

  def usernews
    @posts = []
    allPosts = Post.all.order('created_at DESC')
    userTags = current_user.subscribed_tags.map(&:name)
    allPosts.each do |post|
      postTags = post.tag_list.split(',')
      userTags.each do |tag|
        if postTags.include?(tag)
          @posts.push(post)
          break
        end
      end
    end
  end

  def userposts
    @user = User.find(params[:id])
    @posts = Post.where(user_id: @user.id).order('created_at DESC')
  end

  def new
    @post = Post.new
  end

  def create
    @post = current_user.posts.build(post_params)
    @post.user_id = current_user.id

    if @post.save
     redirect_to @post
    else
      render 'new'
    end
  end

  def show
    @post = Post.find(params[:id])
  end

  def edit
    @post = Post.find(params[:id])
  end

  def update
    @post = Post.find(params[:id])

    if @post.update(post_params)
      redirect_to @post
    else
      render 'edit'
    end
  end

  def destroy
    @post = Post.find(params[:id])
    @post.destroy

    redirect_to root_path
  end

  private
    def post_params
      params.require(:post).permit(:title, :body, :image, :tag_list)
    end
end

当我尝试访问 usernews 并查看我订阅的所有带有标签的新帖子或查看某个用户创建的所有帖子时，我收到错误消息，那说

您无权访问此页面

如果用户角色不是管理员并且他不能这样做，就会发生这种情况

：管理，：全部

如何在不使用 :manage 的情况下修复它并让用户和版主访问此页面。

P.S.：你也可以说我，我使用的是 rails_admin 对吗？

RailsAdmin.config do |config|
  config.authenticate_with do
    warden.authenticate! scope: :user
  end
  config.current_user_method(&:current_user)
  config.authorize_with :cancan
end

Answer 1

试试这个：

class Ability
  include CanCan::Ability
    def initialize(user)
        if user
            can :access, :rails_admin
            can :dashboard
            if user.role == :admin
               can :manage, :all
            elsif user.role == :user
               can :create, [Post, Comment]
               can :update, Post, user_id: user.id
               can :update, User, id: user.id
               can [:update, :destroy], Comment, user_id: user.id
               can :read, :all 
            elsif user.role == :moderator
              can :read, :all 
              can [:create, :update, :destroy], [Post, Comment]
           end
       end
    end
end