Administrate: How to create read-only dashboard or restrict actions by some conditions

[rozhok]

Hello!

Is there option to disable links to create/update/delete? For instance, I have list of Orders, and some of them are not editable after completion. I'd like to make them read-only not by introducing some logic into controller/model, but also by disabling corresponding buttons in the administrate.

I a nutshell, I'd like to see following options:

1. Completely disable create/update/delete (in any combination) for certain dashboards
2. Disable some actions per model by some logic

Thanks!

[pustomytnyk]

you can append some checks to extend #valid_action?(name, resource) method on your admin controller. It is used on views for conditional display of links. Not sure if it works per model on views. For example, you can append call of some https://github.com/elabs/pundit object.

[rozhok]

@pustomytnyk thanks, that's works:

    def valid_action?(name, resource = resource_class)
      if name.to_s == 'edit' or name.to_s == 'destroy'
        return false
      end
      !!routes.detect do |controller, action|
        controller == resource.to_s.underscore.pluralize && action == name.to_s
      end
    end

Could you please check out this approach so I could add into docs?

[pustomytnyk]

@rozhok you can shorten it, like %w[edit destroy].exclude?(name.to_s) && super

[nickcharlton]

This sounds like something which would be great in the docs, if one of you would be up for doing that?

[rozhok]

@pustomytnyk thanks! definitely shorten :)

@nickcharlton I'll submit PR.

[rozhok]

Cool, we now have documented answer to 1st question.
Is there anything about 2nd?

[G-Rath]

~Update request: could really use this feature at the model-instance level~

Turns out there's show_action?, which does exactly this :D

[frm]

@rozhok @G-Rath although late to the scene, would Pundit and Administrate::Punditize solve the model actions per model logic?

[frm]

@rozhok @G-Rath is it possible to get a use case for disabling controller actions?

Administrate checks against the routes if the given action is valid. If you don't generate the routes, what's the use case that might make you want to explicitly disable them in the code?

[batdevis]

So the solution could be in config/routes.rb, ex if I want to exclude the edit action:

Rails.application.routes.draw do
  namespace :admin do
    resources :items, only: [:index, :show, :new, :create, :destroy]

    root to: "items#index"
  end
...
end

[nickcharlton]

I'm going to close this, as it should be solved through the Authorization functionality. Please open a new issue if this isn't the case.