Access Controls and Visibility

Summary: An overview of how Samvera applications authorize users to see content and perform actions.


Samvera uses cancancan to do authorization of many actions.

Cancancan generates app/models/ability.rb into your application and then hydra-head’s generator and later Hyrax’s generator each adds a couple of lines so that the class looks like this:

class Ability include Hydra::Ability include Hyrax::Ability self.ability_logic += [:everyone_can_create_curation_concerns] # Define any customized permissions here. def custom_permissions # Limits deleting objects to a the admin user # # if current_user.admin? # can [:destroy], ActiveFedora::Base # end # Limits creating new objects to a specific group # # if user_groups.include? 'special_group' # can [:create], ActiveFedora::Base # end end end

You don’t need to make any changes to this class as the included behavior provides all that you need to get started. However, if you are integrating an group system other than the default (See Hydra::RoleMapper), then you may want to change who has the admin role.

You can do this by overriding the admin? method on the Ability class like this:

def admin? user_groups.include? 'librarians' end


In-depth tutorials and explanations of the structure

Potential for Refactoring

Notes, links and ideas