Introduce Model.accessible_through

lib/cancan/ability.rb

@@ -172,6 +172,13 @@ def model_adapter(model_class, action)
       adapter_class.new(model_class, relevant_rules_for_query(action, model_class))
     end
 
+    # @private
+    def relation_model_adapter(model_class, action, subject, relation)
+      ::CanCan::ModelAdapters::AbstractAdapter
+        .adapter_class(model_class)
+        .new(model_class, relevant_rules_for_relation(model_class, action, subject, relation))
+    end
+
     # See ControllerAdditions#authorize! for documentation.
     def authorize!(action, subject, *args)
       message = args.last.is_a?(Hash) && args.last.key?(:message) ? args.pop[:message] : nil

lib/cancan/ability/rules.rb

@@ -66,6 +66,18 @@ def relevant_rules_for_match(action, subject)
         end
       end
 
+      def relevant_rules_for_relation(model_class, action, subject, relation)
+        relevant_rules(action, subject).map do |rule|
+          case rule.conditions
+          when Hash
+            conditions = rule.conditions[relation] || rule.conditions[relation.to_sym]
+            Rule.new(rule.base_behavior, action, model_class, conditions, rule.block)
+          else
+            raise Error, "accessible_through is only available with hash conditions"
+          end
+        end
+      end
+
       def relevant_rules_for_query(action, subject)
         rules = relevant_rules(action, subject).reject do |rule|
           # reject 'cannot' rules with attributes when doing queries

lib/cancan/model_additions.rb

@@ -25,6 +25,75 @@ def accessible_by(ability, action = :index, strategy: CanCan.accessible_by_strat
           ability.model_adapter(self, action).database_records
         end
       end
+
+      # Provides a scope within the model to find instances of the model that are accessible
+      # by the given ability within the given action/subject permission pair.
+      #
+      # I.E.:
+      #
+      # Given the scenario below:
+      #
+      #   class Department < ActiveRecord::Base
+      #   end
+      #
+      #   class User < ActiveRecord::Base
+      #     belongs_to :department
+      #   end
+      #
+      #   class Ability
+      #     include CanCan::Ability
+      #
+      #     def initialize(user)
+      #       can :contact, User, { department: { id: user.department_id } }
+      #       can :contact, User, { department: { id: user.managing_department_ids } } if user.manager?
+      #     end
+      #   end
+      #
+      # The following would give you a list of departments that the given ability can contact their users:
+      #
+      #   > user = User.new(department_id: 13, manager: false)
+      #   > ability = Ability.new(user)
+      #   > Department.accessible_through(ability, :contact, User).to_sql
+      #   => SELECT * FROM departments WHERE id = 13
+      #   #
+      #   > user = User.new(department_id: 13, managing_department_ids: [2, 3, 4], manager: true)
+      #   > ability = Ability.new(user)
+      #   > Department.accessible_through(ability, :contact, User).to_sql
+      #   => SELECT * FROM departments WHERE ((id = 13) OR (id IN (2, 3, 4)))
+      #
+      # Sometimes the name of the relation doesn't match the model:
+      #
+      #   class User < ActiveRecord::Base
+      #     has_many :managing_users, class_name: "User", foreign_key: :managed_by_id
+      #   end
+      #
+      #   class Ability
+      #     include CanCan::Ability
+      #
+      #     def initialize(user)
+      #       can :contact, User, { managing_users: { id: user.department_id } }
+      #     end
+      #   end
+      #
+      # When that happens, you can override it with `relation`. This would give you a list of departments
+      # that the given ability can contact their users:
+      #
+      #   > user = User.new(department_id: 13, manager: false)
+      #   > ability = Ability.new(user)
+      #   > Department.accessible_through(ability, :contact, User, relation: :managing_users).to_sql
+      #   => SELECT * FROM departments WHERE id = 13
+      #   >
+      #   > user = User.new(department_id: 13, managing_department_ids: [2, 3, 4], manager: true)
+      #   > ability = Ability.new(user)
+      #   > Department.accessible_through(ability, :contact, User, relation: :managing_users).to_sql
+      #   => SELECT * FROM departments WHERE ((id = 13) OR (id IN (2, 3, 4)))
+      #
+      def accessible_through(ability, action, subject, relation: model_name.element, strategy: CanCan.accessible_by_strategy)
+        CanCan.with_accessible_by_strategy(strategy) do
+          ability.relation_model_adapter(self, action, subject, relation)
+                 .database_records
+        end
+      end
     end
 
     def self.included(base)

spec/cancan/model_adapters/accessible_through_integration_spec.rb

@@ -0,0 +1,114 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+# integration tests for latest ActiveRecord version.
+RSpec.describe CanCan::ModelAdapters::ActiveRecord5Adapter do
+  let(:ability) { double.extend(CanCan::Ability) }
+  before :each do
+    connect_db
+    ActiveRecord::Migration.verbose = false
+
+    ActiveRecord::Schema.define do
+      create_table(:divisions) do |t|
+      end
+
+      create_table(:departments) do |t|
+        t.string :name
+        t.integer :division_id
+      end
+
+      create_table(:employees) do |t|
+        t.integer :department_id
+      end
+    end
+
+    class Division < ActiveRecord::Base
+    end
+
+    class Department < ActiveRecord::Base
+      belongs_to :division
+      has_many :employees
+    end
+
+    class Employee < ActiveRecord::Base
+      belongs_to :department
+    end
+  end
+
+  before do
+    @division1 = Division.create!
+    @division2 = Division.create!
+    @department1 = Department.create!(division: @division1)
+    @department2 = Department.create!(division: @division2, name: "People")
+    @department3 = Department.create!(division: @division2)
+    @user1 = Employee.create!(department: @department1)
+    @user2 = Employee.create!(department: @department2)
+    @user3 = Employee.create!(department: @department3)
+  end
+
+  it "selects the correct objects through the association" do
+    ability.can :message, Employee, { department: { id: @department1.id } }
+    ability.can :message, Employee, { department: { id: @department2.id } }
+
+    departments = Department.accessible_through(ability, :message, Employee)
+
+    expect(departments.pluck(:id)).to match_array [@department1.id, @department2.id]
+  end
+
+  it "treats no condition unconditional" do
+    ability.can :message, Employee, { department: { id: @department1.id } }
+    ability.can :message, Employee
+
+    # Finds all departments that ability can message employees from
+    departments = Department.accessible_through(ability, :message, Employee)
+
+    expect(departments.pluck(:id)).to match_array [@department1.id, @department2.id, @department3.id]
+  end
+
+  it "unallowing yields impossible condition" do
+    ability.can :message, Employee, { department: { id: @department1.id } }
+    ability.cannot :message, Employee
+
+    # Finds all departments that ability can message employees from
+    departments = Department.accessible_through(ability, :message, Employee)
+
+    expect(departments.pluck(:id)).to be_empty
+  end
+
+  describe 'preloading of associatons' do
+    it 'preloads associations correctly' do
+      ability.can :message, Employee, { department: { division: { id: @department1.id } } }
+
+      department = Department.accessible_through(ability, :message, Employee)
+                             .includes(:division).first
+
+      expect(department).to eql @department1
+      expect(department.association(:division)).to be_loaded
+    end
+  end
+
+  describe 'filtering of results' do
+    it 'adds the where clause correctly' do
+      ability.can :message, Employee, { department: { division: { id: [@department1.id, @department2.id] } } }
+
+      department = Department.accessible_through(ability, :message, Employee)
+                             .where("name LIKE 'Peo%'").first
+
+      expect(department).to eql @department2
+    end
+  end
+
+  if CanCan::ModelAdapters::ActiveRecordAdapter.version_greater_or_equal?('5.0.0')
+    describe 'selecting custom columns' do
+      it 'extracts custom columns correctly' do
+        ability.can :message, Employee, { department: { division: { id: @department2.id } } }
+
+        department = Department.accessible_through(ability, :message, Employee)
+                               .select('name as title').first
+
+        expect(department.title).to eql @department2.name
+      end
+    end
+  end
+end