Howto: Allow access for admin and for own user about openmaize HOT 4 CLOSED

Hm, maybe I should make it clearer. My goal is that:
(a) a user with role "user" can edit/delete/show only his own profile
(b) a user with role "admin" can edit/delete/show all users
I have a pretty standard user_controller & model and only want to add the plugs in the controller so that it represents the behaviour above.

from openmaize.

You can do this by customizing the authorize_id plug, like this:

Openmaize.AccessControl

plug :authorize, roles: ["admin", "user"]
plug :custom_auth when action in [:show, :edit, :delete]

defp custom_auth(conn, opts) do
  if conn.assigns.current_user.role == "admin" do
    conn
  else
    authorize_id(conn, opts)
  end
end

Thanks for raising the issue. I should add an example like this in the documentation somewhere.
Let me know if you have any further questions.

from openmaize.

There is now an example of this in the documentation for the AccessControl module.

from openmaize.

Thanks for your help!

from openmaize.