{"issue":{"state":"open","pull_request":{"diff_url":null,"html_url":null,"patch_url":null},"user":{"avatar_url":"https://secure.gravatar.com/avatar/c73271162da7f48ef1e43f176badbfbd?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","gravatar_id":"c73271162da7f48ef1e43f176badbfbd","url":"https://api.github.com/users/steerio","login":"steerio","id":194688},"milestone":null,"labels":[],"assignee":null,"updated_at":"2011-10-31T12:03:19Z","comments":0,"closed_at":null,"url":"https://api.github.com/repos/ryanb/cancan/issues/500","body":"Our system has projects which have many contracts. We need fine grained access control to give certain users rights to the contracts of certain projects, so we added project roles, which belong to users, projects and have a specific designation.\r\n\r\nWe defined the Cancan rule like this (the initialize method of our ability accepts a user, and sets `@user` to it):\r\n\r\n```ruby\r\ncan :read, Contract, project: { project_roles: { user_id: @user.id, role: 'contracts' }}\r\n```\r\n\r\nWhen we use `can?(:read, @project.contracts.first)` or `Contract.accessible_by(ability)`, the concept works. However,\r\n\r\n````ruby\r\ncan?(:read, @project => Contract)`\r\n````\r\n\r\nalways returns true.","html_url":"https://github.com/ryanb/cancan/issues/500","title":"can?(:read, obj => Klass) is always true","number":500,"id":2096204,"created_at":"2011-10-31T12:03:19Z"},"action":"opened"}