Don't fetch parent of nested resource if *_id parameter is missing so it works with shallow nested routes - closes #14

CHANGELOG.rdoc

@@ -1,3 +1,6 @@
+* Don't fetch parent of nested resource if *_id parameter is missing so it works with shallow nested routes - see issue #14
+
+
 1.0.0 (Dec 13, 2009)
 
 * Don't set resource instance variable if it has been set already - see issue #13

lib/cancan/resource_authorization.rb

@@ -36,8 +36,13 @@ module CanCan
     def parent_resource
       parent = nil
       [@options[:nested]].flatten.compact.each do |name|
-        parent = ControllerResource.new(@controller, name, parent)
-        parent.find(@params["#{name}_id".to_sym])
+        id = @params["#{name}_id".to_sym]
+        if id
+          parent = ControllerResource.new(@controller, name, parent)
+          parent.find(id)
+        else
+          parent = nil
+        end
       end
       parent
     end

spec/cancan/resource_authorization_spec.rb

@@ -96,4 +96,13 @@ describe CanCan::ResourceAuthorization do
     authorization.load_resource
     @controller.instance_variable_get(:@ability).should == :some_ability
   end
+  
+  it "should not load nested resource and build through this if *_id param isn't specified" do
+    stub(Person).find(456) { :some_person }
+    stub(Ability).new(nil) { :some_ability }
+    authorization = CanCan::ResourceAuthorization.new(@controller, {:controller => "abilities", :action => "new", :person_id => 456}, {:nested => [:person, :behavior]})
+    authorization.load_resource
+    @controller.instance_variable_get(:@person).should == :some_person
+    @controller.instance_variable_get(:@ability).should == :some_ability
+  end
 end