New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

attribute level authorization rules #171

Open

exolab opened this issue Jan 22, 2013 · 1 comment

Labels

feature

exolab commented Jan 22, 2013

It would be great if it were possible to limit access to attributes in a model, e.g. like so:

role :moderator do
    has_permission_on [:companies], :to => [:read, :index, :show], :exclude => [:name]
end

or

role :moderator do
    has_permission_on [:companies], :to => [:read, :index, :show], :include => [:name]
end

where :include contains all accessible attributes, and :exclude contains inaccessible attributes.

Owner

stffn commented Jan 24, 2013

There had been some discussion earlier on this feature on the mailing list:
https://groups.google.com/forum/?hl=en_US&fromgroups=#!searchin/declarative_authorization/attribute/declarative_authorization/nLjqv-6h3pk/XLWJTU4WIMgJ

Generally, I agree that this would be nice to have.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment