quaint-pencil-2979
01/21/2022, 6:52 PMlemon-wall-20836
01/21/2022, 6:52 PMlemon-wall-20836
01/21/2022, 6:52 PMlemon-wall-20836
01/21/2022, 6:52 PMlemon-wall-20836
01/21/2022, 6:53 PMquaint-pencil-2979
01/21/2022, 6:53 PMlemon-wall-20836
01/21/2022, 6:53 PMlemon-wall-20836
01/21/2022, 6:53 PMquaint-pencil-2979
01/21/2022, 6:53 PMlemon-wall-20836
01/21/2022, 6:54 PMlemon-wall-20836
01/21/2022, 6:55 PMlemon-wall-20836
01/21/2022, 6:58 PMquaint-pencil-2979
01/21/2022, 7:04 PMquaint-pencil-2979
01/21/2022, 7:04 PMlemon-wall-20836
01/21/2022, 7:08 PMlemon-wall-20836
01/21/2022, 7:08 PMlemon-wall-20836
01/21/2022, 7:08 PMquaint-pencil-2979
01/21/2022, 7:12 PMbrief-king-35906
01/23/2022, 4:39 PMdefault
when declaring a field have access to the user? i've got a belongs_to
association, and generally this will be a single record. i'd like to default to that record if the user only has a single possible recordlemon-wall-20836
01/23/2022, 9:42 PMlemon-wall-20836
01/23/2022, 9:42 PMlemon-wall-20836
01/23/2022, 9:52 PMbrief-king-35906
01/24/2022, 8:29 AMbrief-king-35906
01/24/2022, 8:31 AMbelongs_to
it’d probably be good to have the scoped collection as well (mine is through a pundit policy for example)brief-king-35906
01/24/2022, 9:05 AMAvo::App.view_context
brief-king-35906
01/24/2022, 9:06 AMruby
field :system, as: :belongs_to, required: true, default: -> do
scope = authorization.apply_policy(System.all)
if scope.one?
scope.first.id
else
nil
end
end
brief-king-35906
01/24/2022, 9:07 AMbelongs_to
association could have a scopebrief-king-35906
01/24/2022, 9:48 AMSystem
has many Entry
records. a user should be authorised to interact with an Entry
if they are an admin (user.admin?
) or they curate the System
that the Entry
belongs to (user.curated_systems.include?(entry.system)
). an extract of the policy which enforces this:
ruby
class EntryPolicy < ApplicationPolicy
def show?
user.admin? || entry_curated_by_user?
end
private
def entry_curated_by_user?
user.curated_systems.include? record.system
end
end
my records are always set to the class (Entry
) and as a result cannot determine anything about the instance.
it looks like this will always be the case as [authorize_action
](https://github.com/avo-hq/avo/blob/6c16f808da4176ba8ef6fd97339704db6506efec/app/controllers/avo/application_controller.rb#L110-L116) is expecting @model
to be set, but we call set_model
after authorize_action
in [Avo::BaseController
](https://github.com/avo-hq/avo/blob/6c16f808da4176ba8ef6fd97339704db6506efec/app/controllers/avo/base_controller.rb#L8-L9)brief-king-35906
01/24/2022, 10:08 AMcolossal-arm-85272
01/25/2022, 9:47 PMTeamMembership
).
it appears the put request is nesting the form under "teammembership"
rather than "team_membership"
as the controller expects, resulting in an ActionController::ParameterMissing
in the base controller action.
seem like this is reproducible in the demo? https://avodemo.herokuapp.com/avo/resources/team_memberships/49/edit
happy to report on GH! just wanted to pop in here before I do ✌️