diff --git a/lib/cancan/ability/strong_parameter_support.rb b/lib/cancan/ability/strong_parameter_support.rb index 31da7457..9318c7ea 100644 --- a/lib/cancan/ability/strong_parameter_support.rb +++ b/lib/cancan/ability/strong_parameter_support.rb @@ -20,6 +20,17 @@ def permitted_attributes(action, subject) end.to_a end + # This method returns all attributes which are explicity disallowed + def disallowed_attributes(action, subject) + relevant_rules(action, subject) + .reverse + .select { |rule| rule.matches_conditions? action, subject } + .each_with_object(Set.new) do |rule, set| + attributes = get_attributes(rule, subject) + rule.base_behavior ? set.subtract(attributes) : set.merge(attributes) + end.to_a + end + private def subject_class?(subject)