Difference between :manage and :admin permissionset actions

[nbelzer]

solidus/core/lib/spree/permission_sets/user_display.rb

Lines 3 to 13 in a6c2cee

	module Spree
	module PermissionSets
	class UserDisplay < PermissionSets::Base
	def activate!
	can [:read, :admin, :edit, :addresses, :orders, :items], Spree.user_class
	can [:read, :admin], Spree::StoreCredit
	can :read, Spree::Role
	end
	end
	end
	end

Solidus often uses the :admin action on a resource instead of :manage (which is supported out of the box by CanCanCan) for its permission sets. What is the difference between the two options?

[jarednorman]

I'd have to check, but I think it's just an alias for :manage?

[nbelzer]

I believe it does something more than that, otherwise there is no need to also include :read or :edit in the abilities (as they would be covered by :manage).

[forkata]

From the CanCanCan documentation linked in the OP I see that :manage is a special permission that

means literally any action, not only CRUD ones

In Solidus :admin is a custom defined action which is checked in the base backend controller and throughout the rest of the engine controllers when performing actions that require the highest level of permission.

My understanding based on the CanCanCan documentation is that if a user has the :manage permission, they will also be able to :admin a resource.

[nbelzer]

This checks out, thanks for explaining.