tailieunhanh - Rails for Java Developers phần 10

với khả năng hướng đối tượng (mọi thứ đều là đối tượng) hay hàm (nó có các hàm không có tên (anonymous functions), closures, và continuations; mọi câu lệnh đều có giá trị trả về, và các hàm đều trả về kết quả ước lượng cuối cùng). Nó hỗ trợ mạnh cho tự định kiểu (type introspection), reflection và meta-programming. | Authorization with the Authorization Plugin 289 With the Authorization plugin role permissions are assigned in the controller itself. Instead of using pure Ruby code the permit code parses a mini-language that aspires to read like a human language. For example the following lines in the controller will specify that only administrators can edit Quips and mere mortals can only view them Download code rails_xt app controllers READ_ACTIONS w index list show permit admin or mortal only READ_ACTIONS permit admin except READ_ACTIONS As with the Acegi pattern language we find the Authorization plugin s mini-language to be self-explanatory. You can test that the authorization protections work by loading the test fixture data into the development database. Rails has a built-in task specifically for this purpose. From the rails_xt directory rake db fixtures load will blow away the development database and replace its contents with the test fixtures. After loading the fixtures you can run script server and navigate to quips. If you are Quentin you will have read write access but as Aaron you will have read access only. Both Acegi and the Authorization plugin are much more powerful than we have shown here. Both provide the ability to associate roles with particular objects. Acegi also has one incredible feature that we have not seen anywhere else. Because it integrates with the web tier with simple method interception and with AspectJ s pointcuts Acegi can secure just about anything. Better yet you can use the same configuration and roles from end-to-end in your application. You can use the same roles to secure web endpoints methods objects and anything you can capture in an AspectJ pointcut. For the biggest hairiest problems out there we would not use anything else. The acts_as_authenticated Authorization plugin tandem also has its area of excellence the tiny amount of configuration and code involved. The amount of configuration required is an order of .