An overview of how Samvera applications authorize users to see content and perform actions

Quickstart

Samvera uses cancancan to do authorization of many actions.

Cancancan generates app/models/ability.rb into your application and then hydra-head’s generator and later Hyrax’s generator each adds a couple of lines so that the class looks like this:

class Ability
  include Hydra::Ability

  include Hyrax::Ability
  self.ability_logic += [:everyone_can_create_curation_concerns]

  # Define any customized permissions here.
  def custom_permissions
    # Limits deleting objects to a the admin user
    #
    # if current_user.admin?
    #   can [:destroy], ActiveFedora::Base
    # end

    # Limits creating new objects to a specific group
    #
    # if user_groups.include? 'special_group'
    #   can [:create], ActiveFedora::Base
    # end
  end
end

You don’t need to make any changes to this class as the included behavior provides all that you need to get started. However, if you are integrating an group system other than the default (See Hydra::RoleMapper), then you may want to change who has the admin role.

You can do this by overriding the admin? method on the Ability class like this:

    def admin?
      user_groups.include? 'librarians'
    end

Legacy

In-depth tutorials and explanations of the structure

Potential for Refactoring

Notes, links and ideas

Tags: development_resources