Question

我使用cancan和devise，我可以更新删除和显示但我无法创建配置文件。为什么我无法创建新的配置文件（“ActiveModel :: ForbiddenAttributesError”）

class Ability
  include CanCan::Ability

  def initialize(user)
    if user.is_a?(Admin)
      can :manage, :all
    elsif user.is_a?(User)

        can :read, Profile do |profile|
        profile.try(:user) == user
        end
        can :update, Profile do |profile|
        profile.try(:user) == user
        end
        can :destroy, Profile do |profile|
        profile.try(:user) == user
        end
        can :create, Profile do |profile|
        profile.try(:user) == user 
    else
      can :read, :all
    end
  end
end

Answer 1

如果您的控制器代码中已经有load_and_authorize_resource，则需要采取另一个步骤，通过控制器中的create_params方法调用来清理输入。

Here's a link to a useful resource

首先：您的CanCan用户能力可以重写如下：

can :create, :read, :update, :destroy, Profile, user_id: user.id

其次：您的管理员能力应该在您的正常用户能力之后编写，从而更成功地覆盖它们：

def initialize(user)
  # I prefer to alias CRUD actions to keep my ability files more succint
  alias_action :create, :read, :update, :destroy, to: :crud

  cannot :manage, :all #Failsafe

  can :crud, Profile, user_id: user.id
  ... #additional abilities for user

  if user.admin?
    can :manage, :all #Override previous failsafe

最后：如果您的个人资料类belongs_to是用户，您应该重写它。因此，您的profile_params将包含user_id字段。

如果你要遵循那个（正确的）范例，你的ProfilesController的#create动作将类似于：

class ProfilesController < ApplicationController
  load_and_authorize_resource

  def create
    @profile = Profile.new(profile_params)
      if @profile.save
        ...
      else
        ...
      end
  end

  private
    def profile_params
      params.require(:profile).permit(:user_id, ...)
    end
end

Answer 2

class ProfilesController < ApplicationController
  before_action :set_profile, only: [:show, :edit, :update, :destroy]
  load_and_authorize_resource


  # GET /profiles
  # GET /profiles.json
  def index
    user = User.find(params[:user_id])
    @profiles = user.profiles

    respond_to do |format|
      format.html
      format.xml {render :xml => @profiles}
    end
  end

  # GET /profiles/1
  # GET /profiles/1.json
  def show
    user = User.find(params[:user_id])
    @profiles = user.profiles.find(params[:id])

    respond_to do |format|
      format.html
      format.xml {render :xml => @profile}
      end
  end

  # GET /profiles/new
  def new
    user = User.find(params[:user_id])
    @profile = user.profiles.build

    respond_to do |format|
      format.html
      format.xml {render :xml => @profile}
      end
  end

  # GET /profiles/1/edit
  def edit
    user = User.find(params[:user_id])
    @profiles = user.profiles.find(params[:id])
  end

  # POST /profiles
  # POST /profiles.json
  def create
    user = User.find(params[:user_id])
    @profile = user.profiles.create(profile_params)

    respond_to do |format|
      if @profile.save
        format.html { redirect_to user_profiles_url, notice: 'Profile was successfully created.' }
        format.json { render action: 'show', status: :created, location: @profile }
      else
        format.html { render action: 'new' }
        format.json { render json: @profile.errors, status: :unprocessable_entity }
      end
    end
  end

  # PATCH/PUT /profiles/1
  # PATCH/PUT /profiles/1.json
  def update
    user = User.find(params[:user_id])
    @profiles = user.profiles.find(params[:id])

    respond_to do |format|
      if @profile.update(profile_params)
        format.html { redirect_to user_profile_url, notice: 'Profile was successfully updated.' }
        format.json { head :no_content }
      else
        format.html { render action: 'edit' }
        format.json { render json: @profile.errors, status: :unprocessable_entity }
      end
    end
  end

  # DELETE /profiles/1
  # DELETE /profiles/1.json
  def destroy
    user = User.find(params[:user_id])
    @profiles = user.profiles.find(params[:id])

    @profile.destroy
    respond_to do |format|
      format.html { redirect_to job_hunters_path }
      format.json { head :no_content }
    end
  end

  private
    # Use callbacks to share common setup or constraints between actions.
    def set_profile
      @profile = Profile.find(params[:id])
    end

    # Never trust parameters from the scary internet, only allow the white list through.
    def profile_params
      params.require(:profile).permit(:full_name, :phone_number, :email, :position, :years_of_experiance, :cover_letter, :resume, :reference)
    end
end

可以与设计，管理和用户

2 个答案: