Rails + CanCan：用户应该可以删除自己的照片，但不能删除

Question

因此，我使用CanCan的Rails 3进行授权。我希望所有用户能够删除他们创建的照片，我想我有这个设置正确，但它是不工作...

这里是我的能力类：

class Ability 
    include CanCan::Ability 

    def initialize(user) 

    # ONLY REGISTERED USERS CAN DO THESE THINGS 
    unless user.nil? 

     # ALL REGISTERED USERS CAN DO THESE THINGS 
     can :read, [Photo, Context, Focus, LandUse, Vote, Rating, Comment, Profile, Article] 
     can :show, Page 

     # MEMBERS 
     if user.has_role? :member 
     can [:create, :read], Photo 
     can [:update, :destroy], Photo, :user_id => user.id 
     can :create, [Vote, Rating, Comment, Profile] 
     can :update, [Vote, Rating, Comment, Profile], :user_id => user.id 

     can [:show, :update], User do |u| 
      u == user 
     end 
     end 

     # CURATORS 
     ... 

     # ADMINS 
     ... 

    end 

    # ALL VISITORS CAN DO THESE THINGS 
    can :create, [User, Profile] 
    can :request_invite, User 
    # can :show, Page 

    end 
end 

这里是我的控制器操作：

def destroy 
    @photo = Photo.find(params[:id]) 

    authorize! :delete, @photo 
    @photo.destroy 
    redirect_to :back, :notice => 'Photo deleted.' 
end 

任何想法这里有什么问题？

Answer 1

应该是authorize! :destroy, @photo您的控制器的destroy操作。

Answer 2

其实，如果你在你的控制器使用load_and_authorize_resource，你可以离开了

@photo = Photo.find(params[:id]) 
authorize! :destroy, @photo 

因为它已经被惨惨完成。