User with a membership can read all data - ruby-on-rails

Question

The Setup
I'm using Rails 5.2 with the cancancan gem.
rails g scaffold User first_name email:uniq
rails g scaffold Organization name:uniq
rails g scaffold Role name
rails g scaffold Membership user:references organization:references role:refences
user.rb
class User < ApplicationRecord
has_many :memberships
has_many :roles, through: :memberships
has_many :organizations, through: :memberships
end
membership.rb
class Membership < ApplicationRecord
belongs_to :role
belongs_to :organization
belongs_to :user
end
organization.rb
class Organization < ApplicationRecord
has_many :memberships
has_many :users, through: :memberships
end
role.rb
class Role < ApplicationRecord
has_many :memberships
has_many :users, through: :memberships
end
seeds.rb
admin = Role.create(name: 'Admin')
user = Role.create(name: 'User')
abc = Organization.create(name: 'Abc Inc.')
bob = User.create(first_name: 'Bob')
alice = User.create(first_name: 'Alice')
Membership.create(role: user, company: abc, role: user)
Membership.create(role: admin, company: abc, role: admin)
The Task
An admin should be able to manage all users and memberships of the company he/she is admin for. A user can only read all users and memberships of that company.
Here is my take on a cancancan configuration:
ability.rb
class Ability
include CanCan::Ability
def initialize(user)
user ||= User.new
user_role = Role.find_by_name('User')
admin_role = Role.find_by_name('Admin')
organizations_with_user_role = Organization.includes(:memberships).
where(memberships: {user_id: user.id, role_id: user_role.id})
organizations_with_admin_role = Organization.includes(:memberships).
where(memberships: {user_id: user.id, role_id: admin_role.id})
can :read, Organization, organizations_with_user_role
can :manage, Organization, organizations_with_admin_role
end
end
Then I try to run this code in a view:
<% if can? :read, organization %><%= link_to 'Show', organization %><% end %>
This results with an error page which says:
The can? and cannot? call cannot be used with a raw sql 'can' definition. The checking code cannot be determined for :read #
I guess I'm tackling the problem from a totally wrong angle. How do I have to setup the ability.rb to solve this problem?

Answer 1

I'd use a simple hash of conditions here:
can :read, Organization, memberships: { user_id: user.id, role: { name: 'User' } }
can :manage, Organization, memberships: { user_id: user.id, role: { name: 'Admin' } }
this should be really enough and you have the advantage that, with this syntax, you can also call Organization.accessible_by(ability, :read) and retrieve all the Organizations that a user can read.

Answer 2

From the documentation:
Almost anything that you can pass to a hash of conditions in Active
Record will work here. The only exception is working with model ids.
You can't pass in the model objects directly, you must pass in the
ids.
can :manage, Project, group: { id: user.group_ids }
So try something like:
can :read, Organization, id: organizations_with_user_role.pluck(:id)
On a separate note, why are you using includes instead of joins? Your query can be simplified to (without the need for user_role = Role.find_by_name('User')):
organizations_with_user_role = Organization.joins(memberships: :role).
where(memberships: {user_id: user.id}).where(roles: {name: 'User'})