lib/trust/permissions.rb
def cannot(*args)
        options = args.extract_options!
        raise ArgumentError, "No options (#{options.inspect}) are allowed for cannot. It is just meaning less" if options.size > 0
        p = expand_aliases(args).collect { |action| action }
        if @in_role_block
          @perms[:cannot] += p
        else
          @@can_expressions += 1
          return {:cannot => p }
        end
      end
# Revokes permissions.
#
# Revokes any previous permissions given in parent classes. This cannot be used with conditions. See also +:enforce+ option
# for +can+
#
# +can+ has presedence over +cannot+. In practice this means that in a block; +cannot+ statements are processed before +can+,
# and any previously permissions granted are deleted. 
# Another way to say this is; if you have +cannot :destroy+ and +can :destroy+, then all inheritied destroys will first be
# deleted, and then the can destroy will be granted.
#
#
# === Arguments
# 
#   action - actions to be revoked permissions for. Cannot be aliases
#
# === Example
#
#   module Permissions
#     class Account < Trust::Permissions
#       role :admin, :accountant do 
#         can :read
#         can :read
#         can :update, :destroy, :unless => :closed?
#       end
#     end
#
#     class Account::Credit < Account
#        role :accountant do
#          cannot :destroy    # revoke permission to destroy
#        end
#     end
#   end
#
Revokes permissions.
Revokes any previous permissions given in parent classes. This cannot be used with conditions. See also +:enforce+ option
for +can+

+can+ has presedence over +cannot+. In practice this means that in a block; +cannot+ statements are processed before +can+,
and any previously permissions granted are deleted.
Another way to say this is; if you have +cannot :destroy+ and +can :destroy+, then all inheritied destroys will first be
deleted, and then the can destroy will be granted.

Arguments

actions to be revoked permissions for. Cannot be aliases

Example



class Account::Credit < Account
role :accountant do
cannot :destroy    # revoke permission to destroy
end
end
end
Revokes permissions . Revokes any previous permissions given in parent classes . This cannot be used with conditions . See also + : enforce + option for + can + + can + has presedence over + cannot + . In practice this means that in a block ; + cannot + statements are processed before + can + and any previously permissions granted are deleted . Another way to say this is ; if you have + cannot : destroy + and + can : destroy + then all inheritied destroys will first be deleted and then the can destroy will be granted . Arguments actions to be revoked permissions for . Cannot be aliases Example class Account :: Credit < Account role : accountant do cannot : destroy # revoke permission to destroy end end end
def cannot(*args)
        options = args.extract_options!
        raise ArgumentError, "No options (#{options.inspect}) are allowed for cannot. It is just meaning less" if options.size > 0
        p = expand_aliases(args).collect { |action| action }
        if @in_role_block
          @perms[:cannot] += p
        else
          @@can_expressions += 1
          return {:cannot => p }
        end
      end
def cannot ( * args ) options = args . extract_options! raise ArgumentError , "No options (#{options.inspect}) are allowed for cannot. It is just meaning less" if options . size > 0 p = expand_aliases ( args ) . collect { | action | action } if @in_role_block @perms [ :cannot ] += p else @@can_expressions += 1 return { :cannot => p } end end
Revokes permissions.
Revokes permissions .
args