我遇到了与该线程中所述完全相同的问题:
I'm having the exact same issue as described on this thread:
仅5条轨道_已删除cancancan#356
我可以访问已删除的记录,如下所示:
I can access a deleted record, like this:
@area = Area.only_deleted.find(params[:id])但是如果我将load_and_authorize_resource添加到控制器中,它将尝试运行如下查询:
but if I add load_and_authorize_resource to my controller, it'll attempt to run the query like this:
@area = Area.find(params[:id])这将导致错误,因为它将无法在不包含delete_at不为null的集合(未删除的记录,这是Paranoia gem的目的)上找到具有该ID的记录.
which will result in error since it won't find a record with that id on a collection where deleted_at isn't null (not deleted records, the purpose of the Paranoia gem).
如果我禁用控制器或该动作的load_and_authorize_resource,它可以解决错误,但这不是解决方案,因为这意味着失去授权控制.
If I disable load_and_authorize_resource for the controller or for that very action, it solves the error but it's not a solution since that means losing authorization control.
是否已解决此问题,或者是否有可以与我切换到的Rails 5上的Paranoia配合使用的授权gem?
Is there a fix for this, or is there an authorization gem which plays nice with Paranoia on Rails 5 which I could switch over to?
谢谢.
推荐答案因此,根据有关load_and_authorize_resource 的文档,如果尚未设置实例变量,该方法将尝试加载实例变量;如果存在已设置的实例变量,则该方法将不会加载该实例变量.为什么应用程序被破坏了:
So, according to documentation on load_and_authorize_resource, the method will attempt to load an instance variable in case one hasn't been set yet, and won't do so if there's a set instance variable, which is precisely why the application was breaking:
class AreasController < ApplicationController load_and_authorize_resource before_action :set_area, only: [:show, :edit, :update, :destroy] ... def set_area if session[:show_obsolete_records] == true @area = Area.only_deleted.find(params[:id]) else @area = Area.find(params[:id]) end end endload_and_authorize_resource首先在列表上运行,并且由于在调用之前没有设置实例变量,因此它会自行执行@area = Area.find(params[:id]),这显然会导致错误,因为 Paranoia 会覆盖查找程序方法,其中包含检查deleted_at是否为NULL的条件.
load_and_authorize_resource runs first on the list, and since there were no instance variables set before its call, it does @area = Area.find(params[:id]) on its own account, which obviously leads to error, since Paranoia overwrittes finder methods to include a condition to check whether the deleted_at is NULL.
例如,当使用常规(不使用妄想症)Area.find(17)时,您会在控制台上收到如下查询:
For example, when using the regular (without Paranoia) Area.find(17), you get a query like this on your console:
Area Load (0.2ms) SELECT "areas".* FROM "areas" WHERE "areas"."id" = ? LIMIT ? [["id", 17], ["LIMIT", 1]]使用 Paranoia 时,您会收到以下查询:
When using Paranoia, you'd get this query:
Area Load (0.2ms) SELECT "areas".* FROM "areas" WHERE ("areas"."deleted_at" IS NULL) AND "areas"."id" = ? LIMIT ? [["id", 17], ["LIMIT", 1]]这样,由于已设置了deleted_at时间戳记(deleted_at现在为NOT NULL),因此在常见查询中不会找到已删除的记录.
This way, records that have been deleted won't be found on common queries since they'll have the deleted_at timestamp set (deleted_at is now NOT NULL).
要访问已删除的记录,您必须使用with_deleted或only_deleted,例如
To access deleted records, you must use either with_deleted or only_deleted, like
@area = Area.only_deleted.find(params[:id])
否则它将找不到删除的记录,因此为什么我会得到错误
or else it won't find the deleted record, hence why I was getting the error
ActiveRecord::RecordNotFound - Couldn't find Area with 'id'=16 [WHERE "areas"."deleted_at" IS NULL]:方法load_and_authorize_resource加载了@area = Area.find(params[:id])并跳过了set_area,因此您可以删除该方法,即使代码不存在,该方法仍会设置区域.
The method load_and_authorize_resource loaded @area = Area.find(params[:id]) and skipped set_area, so you could delete the method and it would still set the area even if the code is not there.
解决方案是将load_and_authorize_resource方法简单地移到回调列表下方:
The solution is to simply move the load_and_authorize_resource method below the callbacks list:
class AreasController < ApplicationController before_action :set_area, only: [:show, :edit, :update, :destroy] load_and_authorize_resource ... def set_area if session[:show_obsolete_records] == true @area = Area.only_deleted.find(params[:id]) else @area = Area.find(params[:id]) end end end更新
您可以将方法调用load_and_authorize_resource留在堆栈的顶部,但是将其更改为authorize_resource,这样它就不会尝试调用@area = Area.find(params[:id]),根据此线程.
You can leave the method call load_and_authorize_resource at the top at the stack, but change it to authorize_resource so it doesn't attempt to call @area = Area.find(params[:id]), according to this thread.
class AreasController < ApplicationController authorize_resource before_action :set_area, only: [:show, :edit, :update, :destroy] ... def set_area if session[:show_obsolete_records] == true @area = Area.only_deleted.find(params[:id]) else @area = Area.find(params[:id]) end end end更多推荐
偏执狂和CanCanCan之间的Rails 5兼容性受到损害吗?
发布评论