adding :nested option for load_resource - closes #10

CHANGELOG.rdoc

@@ -1,3 +1,5 @@
+* Adding :nested option to load resource method - see issue #10
+
 * Pass :only and :except options to before filters for load/authorize resource methods.
 
 * Adding :collection and :new options to load_resource method so we can specify behavior of additional actions if needed.

lib/cancan/controller_additions.rb

@@ -36,6 +36,11 @@ module CanCan
       # [:+except+]
       #   Does not apply before filter to given actions.
       #   
+      # [:+nested+]
+      #   Specify which resource this is nested under.
+      #   
+      #     load_resource :nested => :author
+      #   
       # [:+collection+]
       #   Specify which actions are resource collection actions in addition to :+index+. This
       #   is usually not necessary because it will try to guess depending on if an :+id+

lib/cancan/resource_authorization.rb

@@ -14,11 +14,20 @@ module CanCan
     end
     
     def load_resource
+      load_parent if @options[:nested]
       unless collection_actions.include? params[:action].to_sym
         if new_actions.include? params[:action].to_sym
-          self.model_instance = model_class.new(params[model_name.to_sym])
+          if parent_instance
+            self.model_instance = parent_instance.send(model_name.pluralize).build(params[model_name.to_sym])
           else
-          self.model_instance = model_class.find(params[:id]) if params[:id]
+            self.model_instance = model_class.new(params[model_name.to_sym])
+          end
+        elsif params[:id]
+          if parent_instance
+            self.model_instance = parent_instance.send(model_name.pluralize).find(params[:id])
+          else
+            self.model_instance = model_class.find(params[:id])
+          end
         end
       end
     end
@@ -37,6 +46,18 @@ module CanCan
       model_name.camelcase.constantize
     end
     
+    def load_parent
+      self.parent_instance = parent_class.find(parent_id)
+    end
+    
+    def parent_class
+      @options[:nested].to_s.camelcase.constantize
+    end
+    
+    def parent_id
+      @params["#{@options[:nested]}_id".to_sym]
+    end
+    
     def model_instance
       @controller.instance_variable_get("@#{model_name}")
     end
@@ -45,6 +66,14 @@ module CanCan
       @controller.instance_variable_set("@#{model_name}", instance)
     end
     
+    def parent_instance
+      @controller.instance_variable_get("@#{@options[:nested]}")
+    end
+    
+    def parent_instance=(instance)
+      @controller.instance_variable_set("@#{@options[:nested]}", instance)
+    end
+    
     def collection_actions
       [:index] + [@options[:collection]].flatten
     end

spec/cancan/resource_authorization_spec.rb

@@ -78,8 +78,28 @@ describe CanCan::ResourceAuthorization do
   end
   
   it "should not try to load resource for other action if params[:id] is undefined" do
-    authorization = CanCan::ResourceAuthorization.new(@controller, {:controller => "abilities", :action => "list"})
+    authorization = CanCan::ResourceAuthorization.new(@controller, :controller => "abilities", :action => "list")
     authorization.load_resource
     @controller.instance_variable_get(:@ability).should be_nil
   end
+  
+  it "should load nested resource and fetch other resource through the association" do
+    person = Object.new
+    stub(Person).find(456) { person }
+    stub(person).abilities.stub!.find(123) { :some_ability }
+    authorization = CanCan::ResourceAuthorization.new(@controller, {:controller => "abilities", :action => "show", :id => 123, :person_id => 456}, {:nested => :person})
+    authorization.load_resource
+    @controller.instance_variable_get(:@person).should == person
+    @controller.instance_variable_get(:@ability).should == :some_ability
+  end
+  
+  it "should load nested resource and fetch build resource through the association" do
+    person = Object.new
+    stub(Person).find(456) { person }
+    stub(person).abilities.stub!.build({:foo => :bar}) { :some_ability }
+    authorization = CanCan::ResourceAuthorization.new(@controller, {:controller => "abilities", :action => "new", :person_id => 456, :ability => {:foo => :bar}}, {:nested => :person})
+    authorization.load_resource
+    @controller.instance_variable_get(:@person).should == person
+    @controller.instance_variable_get(:@ability).should == :some_ability
+  end
 end

spec/spec_helper.rb

@@ -16,3 +16,7 @@ class Ability
   def initialize(user)
   end
 end
+
+# this class helps out in testing nesting
+class Person
+end