CanCan nested permissions
===

What I am trying to achieve are permissions that depend on a parent object. E.g. a collaborator can be associated to multiple projects and of course can have different permissions for each project. So in our can the collaborator can be a project admin or not. If the user is project admin, permissions allow to access collaborators/invitation page.

Situation:

Here is the code:

    can [:read, :show, :description], Project do |project|
      can :index, Translation if collaborator?(project)

      if project_admin? project
        can :index, Collaborator
        can :index, Invitation
      end

      collaborator? project
    end


C1 project admin on P1
C1 only collaborator on P2

The problem I see is, that when permissions are checked for P1 the

    can :index, Collaborator
    can :index, Invitation

are initialized, hence C1 has access to this actions. But what happens I want to check in the same request if C1 has access to can :index for P2? In this case he has permissions to P2 as well ... which is clearly wrong. The correct permissions should be

C1 - P1
can :index, Collaborator
can :index, Invitation

C1 - P2
cannot :index, Collaborator
cannot :index, Invitation

I tried a couple of different versions and googled, but I am not sure if CanCan supports that. Honestly, I am not sure if CanCan is a good permissions framework to begin with, but I haven't found a better one.

One last thing, my CanCan code runs in MRI 1.9.3, but *not* in JRuby. My guess is that the block code and CanCan is too much for JRuby.

I truly appreciate any help