{"id":38724,"date":"2026-02-06T12:00:38","date_gmt":"2026-02-06T09:00:38","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/rails-authorization-beyond-models-cancancan-ile-gosterge-panolari-ve-servis-kontrolculerinin-guvenligini-saglama\/"},"modified":"2026-02-06T12:00:38","modified_gmt":"2026-02-06T09:00:38","slug":"rails-authorization-beyond-models-cancancan-ile-gosterge-panolari-ve-servis-kontrolculerinin-guvenligini-saglama","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/rails-authorization-beyond-models-cancancan-ile-gosterge-panolari-ve-servis-kontrolculerinin-guvenligini-saglama\/","title":{"rendered":"Rails Authorization Beyond Models: CanCanCan ile G\u00f6sterge Panolar\u0131 ve Servis Kontrolc\u00fclerinin G\u00fcvenli\u011fini Sa\u011flama"},"content":{"rendered":"<h2>Rails Authorization Beyond Models: CanCanCan ile G\u00f6sterge Panolar\u0131 ve Servis Kontrolc\u00fclerinin G\u00fcvenli\u011fini Sa\u011flama<\/h2>\n<p>Modern web uygulamalar\u0131nda yetkilendirme, kullan\u0131c\u0131lar\u0131n belirli kaynaklara eri\u015fimini kontrol etmekten \u00e7ok daha fazlas\u0131n\u0131 ifade eder. \u00d6zellikle Rails uygulamalar\u0131nda, model tabanl\u0131 CRUD operasyonlar\u0131n\u0131n \u00f6tesine ge\u00e7erek g\u00f6sterge panolar\u0131, raporlama aray\u00fczleri ve harici servis kontrolc\u00fcleri gibi model d\u0131\u015f\u0131 kaynaklar\u0131n g\u00fcvenli\u011fini sa\u011flamak kritik \u00f6neme sahiptir. Bu makalede, pop\u00fcler CanCanCan gemini kullanarak bu karma\u015f\u0131k senaryolar\u0131 nas\u0131l ele alabilece\u011fimizi, yetkilendirme mant\u0131\u011f\u0131n\u0131 nas\u0131l merkezi hale getirebilece\u011fimizi ve uygulamalar\u0131m\u0131z\u0131n genel g\u00fcvenli\u011fini nas\u0131l art\u0131rabilece\u011fimizi detayl\u0131ca inceleyece\u011fiz.<\/p>\n<h3>CanCanCan&#8217;a H\u0131zl\u0131 Bir Bak\u0131\u015f ve Temel Model Yetkilendirmesi<\/h3>\n<p>CanCanCan, Ruby on Rails uygulamalar\u0131 i\u00e7in esnek ve g\u00fc\u00e7l\u00fc bir yetkilendirme \u00e7\u00f6z\u00fcm\u00fcd\u00fcr. Kullan\u0131c\u0131lar\u0131n hangi eylemleri ger\u00e7ekle\u015ftirebilece\u011fini merkezi bir <code>Ability<\/code> s\u0131n\u0131f\u0131nda tan\u0131mlayarak, yetkilendirme mant\u0131\u011f\u0131n\u0131 kontrolc\u00fclerden ve view&#8217;lerden ay\u0131r\u0131r. Bu, kodun daha temiz, anla\u015f\u0131l\u0131r ve s\u00fcrd\u00fcr\u00fclebilir olmas\u0131n\u0131 sa\u011flar.<\/p>\n<h4>CanCanCan Nedir?<\/h4>\n<p>CanCanCan, Ryan Bates&#8217;in orijinal CanCan geminin topluluk taraf\u0131ndan s\u00fcrd\u00fcr\u00fclen bir \u00e7atal\u0131d\u0131r. Uygulaman\u0131zdaki her kullan\u0131c\u0131 rol\u00fc i\u00e7in yetenekleri (abilities) tan\u0131mlaman\u0131za olanak tan\u0131r. \u00d6rne\u011fin, bir &#8220;admin&#8221; kullan\u0131c\u0131s\u0131n\u0131n t\u00fcm kaynaklar\u0131 y\u00f6netebilece\u011fini, bir &#8220;editor&#8221; kullan\u0131c\u0131s\u0131n\u0131n ise sadece kendi yaz\u0131lar\u0131n\u0131 d\u00fczenleyebilece\u011fini belirtebilirsiniz. Bu yetenekler, <code>Ability<\/code> s\u0131n\u0131f\u0131nda tan\u0131mlanan kurallar arac\u0131l\u0131\u011f\u0131yla ifade edilir.<\/p>\n<h4>Ability S\u0131n\u0131f\u0131n\u0131n Temelleri<\/h4>\n<p>CanCanCan&#8217;\u0131n kalbi, genellikle <code>app\/models\/ability.rb<\/code> dosyas\u0131nda bulunan <code>Ability<\/code> s\u0131n\u0131f\u0131d\u0131r. Bu s\u0131n\u0131f, <code>can<\/code> ve <code>cannot<\/code> y\u00f6ntemlerini kullanarak kullan\u0131c\u0131lar\u0131n yeteneklerini tan\u0131mlar.<\/p>\n<pre><code class=\"language-ruby\">\n# app\/models\/ability.rb\nclass Ability\n  include CanCan::Ability\n\n  def initialize(user)\n    user ||= User.new # Misafir kullan\u0131c\u0131 i\u00e7in\n\n    if user.admin?\n      can :manage, :all # Admin t\u00fcm kaynaklar\u0131 y\u00f6netebilir\n    elsif user.editor?\n      can :read, :all\n      can :create, Article\n      can :update, Article, user_id: user.id # Sadece kendi yaz\u0131lar\u0131n\u0131 g\u00fcncelleyebilir\n    else\n      can :read, :all # Normal kullan\u0131c\u0131lar sadece okuyabilir\n    end\n  end\nend\n<\/pre>\n<p><\/code><\/p>\n<p>Bu \u00f6rnekte, farkl\u0131 kullan\u0131c\u0131 rolleri i\u00e7in temel yetkilendirme kurallar\u0131 belirlenmi\u015ftir.<\/p>\n<h4>Model Tabanl\u0131 Yetkilendirme \u00d6rnekleri<\/h4>\n<p>Kontrolc\u00fclerde <code>load_and_authorize_resource<\/code> makrosu ile model tabanl\u0131 yetkilendirmeyi kolayca uygulayabiliriz:<\/p>\n<pre><code class=\"language-ruby\">\n# app\/controllers\/articles_controller.rb\nclass ArticlesController < ApplicationController\n  load_and_authorize_resource\n\n  def index\n    @articles = Article.all # CanCanCan, @articles'\u0131 otomatik olarak yetkilendirir\n  end\n\n  def show\n    # @article, load_and_authorize_resource taraf\u0131ndan y\u00fcklenir ve yetkilendirilir\n  end\n\n  def create\n    @article = Article.new(article_params)\n    if @article.save\n      redirect_to @article, notice: 'Yaz\u0131 ba\u015far\u0131yla olu\u015fturuldu.'\n    else\n      render :new\n    end\n  end\n\n  # ... di\u011fer CRUD eylemleri\nend\n<\/pre>\n<p><\/code><\/p>\n<p><code>load_and_authorize_resource<\/code> sayesinde, <code>index<\/code>, <code>show<\/code>, <code>create<\/code>, <code>update<\/code>, <code>destroy<\/code> gibi eylemler i\u00e7in otomatik olarak yetkilendirme kontrol\u00fc yap\u0131l\u0131r. Bir kullan\u0131c\u0131 yetkili de\u011filse, CanCanCan otomatik olarak <code>CanCan::AccessDenied<\/code> hatas\u0131 f\u0131rlat\u0131r.<\/p>\n<h3>Model D\u0131\u015f\u0131 Kaynaklar\u0131 Yetkilendirme \u0130htiyac\u0131<\/h3>\n<p>Uygulamalar b\u00fcy\u00fcd\u00fck\u00e7e, yetkilendirme gereksinimleri sadece veritaban\u0131 modelleriyle s\u0131n\u0131rl\u0131 kalmaz. G\u00f6sterge panolar\u0131, \u00f6zel raporlar, harici servislerle etkile\u015fim kuran API u\u00e7 noktalar\u0131 gibi \"kaynak\" olarak do\u011frudan bir modele kar\u015f\u0131l\u0131k gelmeyen alanlar ortaya \u00e7\u0131kar.<\/p>\n<h4>Neden Sadece Modeller Yeterli De\u011fil?<\/h4>\n<p>Geleneksel CanCanCan kullan\u0131m\u0131, <code>Article<\/code>, <code>Product<\/code>, <code>User<\/code> gibi ActiveRecord modelleri \u00fczerinde \u00e7al\u0131\u015fmak \u00fczere tasarlanm\u0131\u015ft\u0131r. Ancak, bir kullan\u0131c\u0131n\u0131n belirli bir \"raporu g\u00f6r\u00fcnt\u00fcleme\" veya \"y\u00f6netici paneline eri\u015fme\" yetene\u011fi, do\u011frudan bir modelin <code>create<\/code>, <code>update<\/code>, <code>destroy<\/code> gibi eylemlerine kar\u015f\u0131l\u0131k gelmez. Bu t\u00fcr soyut kavramlar i\u00e7in \u00f6zel yetenekler tan\u0131mlamam\u0131z gerekir.<\/p>\n<h4>G\u00f6sterge Panolar\u0131 ve Raporlar<\/h4>\n<p>Bir g\u00f6sterge panosu (dashboard), genellikle birden fazla modelden veri toplayan ve kullan\u0131c\u0131ya \u00f6zet bilgiler sunan bir aray\u00fczd\u00fcr. \u00d6rne\u011fin, bir y\u00f6netici panosu, sat\u0131\u015f istatistiklerini, yeni kay\u0131tlar\u0131 ve bekleyen g\u00f6revleri g\u00f6sterebilir. Bu panoya eri\u015fim, belirli bir role veya yetene\u011fe sahip kullan\u0131c\u0131larla s\u0131n\u0131rl\u0131 olmal\u0131d\u0131r. Benzer \u015fekilde, finansal raporlar veya kullan\u0131c\u0131 aktivite raporlar\u0131 da hassas bilgiler i\u00e7erdi\u011finden yetkilendirme gerektirir.<\/p>\n<h4>API U\u00e7 Noktalar\u0131 ve Servis Katmanlar\u0131<\/h4>\n<p>Uygulamalar genellikle \u00fc\u00e7\u00fcnc\u00fc taraf servislerle entegre olur veya kendi i\u00e7 servislerini sunar. Bu servis kontrolc\u00fcleri veya API u\u00e7 noktalar\u0131, do\u011frudan bir model \u00fczerinde i\u015flem yapmasalar bile, hassas i\u015f mant\u0131\u011f\u0131n\u0131 tetikleyebilir veya \u00f6nemli verilere eri\u015febilirler. \u00d6rne\u011fin, bir \"fatura olu\u015fturma\" servisi, kullan\u0131c\u0131n\u0131n bu i\u015flemi ger\u00e7ekle\u015ftirmeye yetkili olup olmad\u0131\u011f\u0131n\u0131 kontrol etmelidir.<\/p>\n<h3>G\u00f6sterge Panolar\u0131 \u0130\u00e7in Yetkilendirme Stratejileri<\/h3>\n<p>Model d\u0131\u015f\u0131 kaynaklar\u0131, \u00f6zellikle g\u00f6sterge panolar\u0131n\u0131 yetkilendirmek i\u00e7in CanCanCan'\u0131n esnekli\u011fini kullanabiliriz.<\/p>\n<h4>Ability S\u0131n\u0131f\u0131nda \u00d6zel Yetenekler Tan\u0131mlama<\/h4>\n<p>G\u00f6sterge panolar\u0131 veya belirli raporlar gibi model d\u0131\u015f\u0131 kaynaklar i\u00e7in semboller kullanarak \u00f6zel yetenekler tan\u0131mlayabiliriz.<\/p>\n<pre><code class=\"language-ruby\">\n# app\/models\/ability.rb\nclass Ability\n  include CanCan::Ability\n\n  def initialize(user)\n    user ||= User.new\n\n    if user.admin?\n      can :manage, :all\n      can :access, :admin_dashboard # Admin paneline eri\u015fim yetene\u011fi\n      can :view, :financial_reports # Finansal raporlar\u0131 g\u00f6r\u00fcnt\u00fcleme yetene\u011fi\n    elsif user.manager?\n      can :read, :all\n      can :access, :manager_dashboard # Y\u00f6netici paneline eri\u015fim yetene\u011fi\n      can :view, :sales_reports # Sat\u0131\u015f raporlar\u0131n\u0131 g\u00f6r\u00fcnt\u00fcleme yetene\u011fi\n    end\n    # ... di\u011fer roller\n  end\nend\n<\/pre>\n<p><\/code><\/p>\n<p>Burada <code>:admin_dashboard<\/code>, <code>:financial_reports<\/code>, <code>:manager_dashboard<\/code>, <code>:sales_reports<\/code> gibi semboller, do\u011frudan bir modele kar\u015f\u0131l\u0131k gelmeyen soyut yetenekleri temsil eder.<\/p>\n<h4>Kontrolc\u00fc Seviyesinde Yetkilendirme<\/h4>\n<p>Bu \u00f6zel yetenekleri kontrolc\u00fclerde <code>authorize!<\/code> veya <code>can?<\/code> y\u00f6ntemleriyle kontrol edebiliriz.<\/p>\n<pre><code class=\"language-ruby\">\n# app\/controllers\/admin\/dashboards_controller.rb\nclass Admin::DashboardsController < ApplicationController\n  before_action :authenticate_user! # Kullan\u0131c\u0131n\u0131n giri\u015f yapmas\u0131n\u0131 sa\u011flar\n\n  def show\n    authorize! :access, :admin_dashboard # Kullan\u0131c\u0131n\u0131n admin paneline eri\u015fim yetkisi var m\u0131?\n    # Admin panosu verilerini y\u00fckle\n    @total_users = User.count\n    @recent_orders = Order.last(10)\n  end\nend\n<\/pre>\n<p><\/code><\/p>\n<p>E\u011fer kullan\u0131c\u0131 <code>:access, :admin_dashboard<\/code> yetene\u011fine sahip de\u011filse, <code>authorize!<\/code> otomatik olarak bir <code>CanCan::AccessDenied<\/code> hatas\u0131 f\u0131rlat\u0131r ve kullan\u0131c\u0131y\u0131 yetkisiz bir sayfaya y\u00f6nlendirir.<\/p>\n<h4>View Seviyesinde Yetkilendirme ve UI Gizleme<\/h4>\n<p>Kullan\u0131c\u0131n\u0131n yetkilerine g\u00f6re aray\u00fcz \u00f6\u011felerini g\u00f6stermek veya gizlemek, kullan\u0131c\u0131 deneyimini iyile\u015ftirir ve gereksiz hata mesajlar\u0131n\u0131 \u00f6nler.<\/p>\n<pre><code class=\"language-erb\">\n<!-- app\/views\/layouts\/application.html.erb -->\n<nav>\n  <ul>\n    <li><%= link_to \"Ana Sayfa\", root_path %><\/li>\n    <% if can? :access, :admin_dashboard %>\n      <li><%= link_to \"Y\u00f6netici Panosu\", admin_dashboard_path %><\/li>\n    <% end %>\n    <% if can? :view, :financial_reports %>\n      <li><%= link_to \"Finans Raporlar\u0131\", financial_reports_path %><\/li>\n    <% end %>\n  <\/ul>\n<\/nav>\n<\/pre>\n<p><\/code><\/p>\n<p>Bu yakla\u015f\u0131m, yetkisiz kullan\u0131c\u0131lar\u0131n hi\u00e7 g\u00f6rmemesi gereken men\u00fc \u00f6\u011felerini veya butonlar\u0131 gizleyerek daha temiz bir aray\u00fcz sunar.<\/p>\n<h3>Servis Kontrolc\u00fclerinde CanCanCan Kullan\u0131m\u0131<\/h3>\n<p>Servis kontrolc\u00fcleri, genellikle bir i\u015f ak\u0131\u015f\u0131n\u0131 veya harici bir entegrasyonu y\u00f6neten, do\u011frudan bir modelle ili\u015fkili olmayan, ancak hassas i\u015flemler ger\u00e7ekle\u015ftiren kontrolc\u00fclerdir.<\/p>\n<h4>Servis Kontrolc\u00fclerinin Rol\u00fc<\/h4>\n<p>Bir servis kontrolc\u00fcs\u00fc, bir \u00f6deme a\u011f ge\u00e7idiyle etkile\u015fime girmek, bir e-posta bildirimini tetiklemek veya karma\u015f\u0131k bir veri i\u015fleme g\u00f6revini ba\u015flatmak gibi g\u00f6revleri \u00fcstlenebilir. Bu t\u00fcr kontrolc\u00fcler, genellikle <code>load_and_authorize_resource<\/code> makrosunun do\u011frudan uygulanamayaca\u011f\u0131 senaryolard\u0131r, \u00e7\u00fcnk\u00fc belirli bir <code>resource<\/code> yoktur.<\/p>\n<h4>load_and_authorize_resource Olmadan Yetkilendirme<\/h4>\n<p><code>load_and_authorize_resource<\/code> kullan\u0131lamad\u0131\u011f\u0131nda, <code>authorize!<\/code> y\u00f6ntemini manuel olarak \u00e7a\u011f\u0131rarak yetkilendirme yapabiliriz.<\/p>\n<pre><code class=\"language-ruby\">\n# app\/controllers\/payment_service_controller.rb\nclass PaymentServiceController < ApplicationController\n  before_action :authenticate_user!\n\n  def process_payment\n    # Kullan\u0131c\u0131n\u0131n \u00f6deme i\u015flemini ba\u015flatmaya yetkili olup olmad\u0131\u011f\u0131n\u0131 kontrol et\n    authorize! :process, :payment # veya belirli bir \u00f6deme nesnesi \u00fczerinde\n\n    # \u00d6deme i\u015fleme mant\u0131\u011f\u0131\n    if PaymentProcessor.call(current_user, params[:amount])\n      render json: { status: 'success', message: '\u00d6deme ba\u015far\u0131yla i\u015flendi.' }\n    else\n      render json: { status: 'error', message: '\u00d6deme ba\u015far\u0131s\u0131z oldu.' }, status: :unprocessable_entity\n    end\n  end\nend\n<\/pre>\n<p><\/code><\/p>\n<p><code>Ability<\/code> s\u0131n\u0131f\u0131nda bu yetene\u011fi tan\u0131mlamam\u0131z gerekir:<\/p>\n<pre><code class=\"language-ruby\">\n# app\/models\/ability.rb\nclass Ability\n  include CanCan::Ability\n\n  def initialize(user)\n    user ||= User.new\n\n    if user.admin? || user.manager?\n      can :process, :payment # Admin ve y\u00f6neticiler \u00f6deme i\u015fleyebilir\n    end\n    # ...\n  end\nend\n<\/pre>\n<p><\/code><\/p>\n<h4>\u00d6rnek: Harici API Entegrasyonlar\u0131<\/h4>\n<p>Uygulaman\u0131z\u0131n harici bir API ile etkile\u015fime girdi\u011fi bir senaryo d\u00fc\u015f\u00fcnelim. \u00d6rne\u011fin, bir \"raporu d\u0131\u015fa aktar\" i\u015flevi.<\/p>\n<pre><code class=\"language-ruby\">\n# app\/controllers\/api\/export_controller.rb\nclass Api::ExportController < ApplicationController\n  before_action :authenticate_user!\n\n  def export_data\n    # Kullan\u0131c\u0131n\u0131n veri d\u0131\u015fa aktarma yetkisi var m\u0131?\n    authorize! :export, :data # :data, soyut bir kaynak sembol\u00fc\n\n    # Veri d\u0131\u015fa aktarma servisini \u00e7a\u011f\u0131r\n    ExportService.perform_export(current_user, params[:report_type])\n    render json: { status: 'success', message: 'Veri d\u0131\u015fa aktarma ba\u015flat\u0131ld\u0131.' }\n  rescue CanCan::AccessDenied\n    render json: { status: 'error', message: 'Yetkisiz eri\u015fim.' }, status: :forbidden\n  rescue StandardError => e\n    render json: { status: 'error', message: e.message }, status: :internal_server_error\n  end\nend\n<\/pre>\n<p><\/code><\/p>\n<p>Bu durumda, <code>Ability<\/code> s\u0131n\u0131f\u0131nda <code>:export, :data<\/code> yetene\u011fini tan\u0131mlayarak hangi kullan\u0131c\u0131lar\u0131n bu API'yi kullanabilece\u011fini belirleriz.<\/p>\n<h3>Karma\u015f\u0131k Yetkilendirme Kurallar\u0131 ve \u00d6zel Yetenekler<\/h3>\n<p>CanCanCan, basit <code>can :action, Model<\/code> kurallar\u0131n\u0131n \u00f6tesine ge\u00e7erek daha karma\u015f\u0131k yetkilendirme senaryolar\u0131n\u0131 destekler.<\/p>\n<h4>Ko\u015fullu Yetenekler ve Bloklar<\/h4>\n<p><code>can<\/code> y\u00f6ntemine bir blok ge\u00e7irerek daha dinamik ve ko\u015fullu yetenekler tan\u0131mlayabiliriz. Bu, yetkilendirme mant\u0131\u011f\u0131n\u0131n daha esnek olmas\u0131n\u0131 sa\u011flar.<\/p>\n<pre><code class=\"language-ruby\">\n# app\/models\/ability.rb\nclass Ability\n  include CanCan::Ability\n\n  def initialize(user)\n    user ||= User.new\n\n    if user.admin?\n      can :manage, :all\n      can :access, :admin_dashboard\n    end\n\n    # Sadece kendi olu\u015fturdu\u011fu projeleri silebilir\n    can :destroy, Project do |project|\n      project.user == user\n    end\n\n    # Sadece aktif kullan\u0131c\u0131lar\u0131n profillerini g\u00f6r\u00fcnt\u00fcleyebilir\n    can :view, User do |target_user|\n      target_user.active? && user.admin? # Sadece adminler aktif kullan\u0131c\u0131lar\u0131 g\u00f6r\u00fcnt\u00fcleyebilir\n    end\n\n    # Belirli bir IP aral\u0131\u011f\u0131ndan geliyorsa \u00f6zel bir rapora eri\u015febilir\n    if user.admin? && user.current_sign_in_ip.present? && IPAddr.new('192.168.1.0\/24').include?(IPAddr.new(user.current_sign_in_ip))\n      can :view, :restricted_report\n    end\n  end\nend\n<\/pre>\n<p><\/code><\/p>\n<p>Bu \u00f6rnekler, <code>Ability<\/code> s\u0131n\u0131f\u0131n\u0131n ne kadar g\u00fc\u00e7l\u00fc olabilece\u011fini g\u00f6stermektedir. Kullan\u0131c\u0131n\u0131n \u00f6zelliklerine, kayna\u011f\u0131n \u00f6zelliklerine veya hatta \u00e7evresel fakt\u00f6rlere (IP adresi gibi) g\u00f6re yetkilendirme kararlar\u0131 al\u0131nabilir.<\/p>\n<h4>can? ve cannot? Kullan\u0131m\u0131<\/h4>\n<p><code>can?<\/code> ve <code>cannot?<\/code> y\u00f6ntemleri, belirli bir eylemi ger\u00e7ekle\u015ftirmeye yetkili olup olmad\u0131\u011f\u0131n\u0131 kontrol etmek i\u00e7in kullan\u0131l\u0131r. Bu y\u00f6ntemler, kontrolc\u00fclerde ve view'lerde ko\u015fullu mant\u0131k uygulamak i\u00e7in idealdir.<\/p>\n<pre><code class=\"language-ruby\">\n<% if can? :update, @article %>\n  <%= link_to \"Yaz\u0131y\u0131 D\u00fczenle\", edit_article_path(@article) %>\n<% end %>\n\n<% if cannot? :delete, @user %>\n  <p>Bu kullan\u0131c\u0131y\u0131 silemezsiniz.<\/p>\n<% end %>\n<\/pre>\n<p><\/code><\/p>\n<p>Bu y\u00f6ntemler, <code>authorize!<\/code> gibi bir hata f\u0131rlatmaz; sadece <code>true<\/code> veya <code>false<\/code> d\u00f6nd\u00fcr\u00fcr, bu da UI'da veya i\u015f mant\u0131\u011f\u0131nda esneklik sa\u011flar.<\/p>\n<h4>Rol Tabanl\u0131 Yetkilendirmeden Daha Fazlas\u0131<\/h4>\n<p>CanCanCan, sadece rol tabanl\u0131 yetkilendirme (RBAC) i\u00e7in de\u011fil, ayn\u0131 zamanda nitelik tabanl\u0131 yetkilendirme (ABAC) i\u00e7in de kullan\u0131labilir. Yani, bir kullan\u0131c\u0131n\u0131n bir eylemi ger\u00e7ekle\u015ftirebilmesi i\u00e7in belirli bir role sahip olmas\u0131 yerine, belirli niteliklere (\u00f6rne\u011fin, <code>user.age > 18<\/code> veya <code>project.status == 'active'<\/code>) sahip olmas\u0131 gerekebilir. Bu, \u00e7ok daha gran\u00fcler ve esnek yetkilendirme modelleri olu\u015fturmam\u0131za olanak tan\u0131r.<\/p>\n<h3>Performans ve G\u00fcvenlik \u0130pu\u00e7lar\u0131<\/h3>\n<p>Yetkilendirme, uygulaman\u0131n performans\u0131 ve g\u00fcvenli\u011fi \u00fczerinde do\u011frudan bir etkiye sahiptir. Bu nedenle, CanCanCan'\u0131 etkin ve g\u00fcvenli bir \u015fekilde kullanmak \u00f6nemlidir.<\/p>\n<h4>Veritaban\u0131 Sorgular\u0131n\u0131 Optimize Etme<\/h4>\n<p><code>Ability<\/code> s\u0131n\u0131f\u0131ndaki bloklar i\u00e7inde karma\u015f\u0131k veritaban\u0131 sorgular\u0131 \u00e7al\u0131\u015ft\u0131rmak performans\u0131 olumsuz etkileyebilir. \u00d6zellikle <code>can :read, Article do |article| ... end<\/code> gibi bloklar, her <code>Article<\/code> nesnesi i\u00e7in ayr\u0131 bir sorgu tetikleyebilir (N+1 problemi).<\/p>\n<p>*   <strong>\u00c7\u00f6z\u00fcm:<\/strong> <code>can :read, Article, user_id: user.id<\/code> gibi do\u011frudan veritaban\u0131 sorgular\u0131na \u00e7evrilebilen ko\u015fullar\u0131 tercih edin.<br \/>\n*   <strong>\u00c7\u00f6z\u00fcm:<\/strong> <code>accessible_by<\/code> kapsam\u0131n\u0131 kullan\u0131n. <code>Article.accessible_by(current_ability)<\/code> yaln\u0131zca yetkili makaleleri d\u00f6nd\u00fcr\u00fcr ve bu i\u015flemi tek bir veritaban\u0131 sorgusunda yapar.<\/p>\n<pre><code class=\"language-ruby\">\n# app\/models\/ability.rb\nclass Ability\n  include CanCan::Ability\n\n  def initialize(user)\n    user ||= User.new\n\n    if user.admin?\n      can :manage, :all\n    else\n      can :read, Article, published: true # Sadece yay\u0131nlanm\u0131\u015f yaz\u0131lar\u0131 okuyabilir\n      can :manage, Article, user_id: user.id # Kendi yaz\u0131lar\u0131n\u0131 y\u00f6netebilir\n    end\n  end\nend\n\n# app\/controllers\/articles_controller.rb\nclass ArticlesController < ApplicationController\n  def index\n    @articles = Article.accessible_by(current_ability) # Optimize edilmi\u015f sorgu\n  end\nend\n<\/pre>\n<p><\/code><\/p>\n<h4>Yetkilendirme Hatalar\u0131n\u0131 Y\u00f6netme<\/h4>\n<p>CanCanCan, yetkilendirme ba\u015far\u0131s\u0131z oldu\u011funda <code>CanCan::AccessDenied<\/code> hatas\u0131 f\u0131rlat\u0131r. Bu hatay\u0131 uygulaman\u0131zda uygun \u015fekilde yakalamak ve kullan\u0131c\u0131 dostu bir mesaj sunmak \u00f6nemlidir.<\/p>\n<pre><code class=\"language-ruby\">\n# app\/controllers\/application_controller.rb\nclass ApplicationController < ActionController::Base\n  rescue_from CanCan::AccessDenied do |exception|\n    redirect_to root_url, alert: exception.message # Kullan\u0131c\u0131y\u0131 ana sayfaya y\u00f6nlendir ve mesaj g\u00f6ster\n  end\nend\n<\/pre>\n<p><\/code><\/p>\n<p>Bu, kullan\u0131c\u0131n\u0131n beklenmedik bir hata sayfas\u0131 g\u00f6rmek yerine, ne oldu\u011funu anlatan bir mesajla kar\u015f\u0131la\u015fmas\u0131n\u0131 sa\u011flar.<\/p>\n<h4>Test Edilebilirlik ve Bak\u0131m<\/h4>\n<p><code>Ability<\/code> s\u0131n\u0131f\u0131n\u0131zdaki kurallar\u0131n do\u011fru \u00e7al\u0131\u015ft\u0131\u011f\u0131ndan emin olmak i\u00e7in kapsaml\u0131 testler yazmak \u00e7ok \u00f6nemlidir. RSpec veya Minitest kullanarak farkl\u0131 kullan\u0131c\u0131 rolleri ve senaryolar\u0131 i\u00e7in yetkilendirme kurallar\u0131n\u0131 test edin. Bu, gelecekteki de\u011fi\u015fikliklerin mevcut yetkilendirme mant\u0131\u011f\u0131n\u0131 bozmas\u0131n\u0131 engeller. Ayr\u0131ca, <code>Ability<\/code> s\u0131n\u0131f\u0131n\u0131 mod\u00fcler tutmaya \u00e7al\u0131\u015f\u0131n; \u00e7ok uzun ve karma\u015f\u0131k hale gelirse, farkl\u0131 sorumluluklar\u0131 olan mod\u00fcllere ay\u0131rmay\u0131 d\u00fc\u015f\u00fcnebilirsiniz.<\/p>\n<h3>Sonu\u00e7<\/h3>\n<p>Rails uygulamalar\u0131nda yetkilendirme, sadece model tabanl\u0131 CRUD operasyonlar\u0131yla s\u0131n\u0131rl\u0131 de\u011fildir. G\u00f6sterge panolar\u0131, raporlar ve servis kontrolc\u00fcleri gibi model d\u0131\u015f\u0131 kaynaklar\u0131n g\u00fcvenli\u011fini sa\u011flamak, uygulaman\u0131n b\u00fct\u00fcnl\u00fc\u011f\u00fc ve kullan\u0131c\u0131 verilerinin korunmas\u0131 i\u00e7in hayati \u00f6neme sahiptir. CanCanCan, esnek <code>Ability<\/code> s\u0131n\u0131f\u0131 ve <code>can?<\/code>, <code>authorize!<\/code> gibi g\u00fc\u00e7l\u00fc y\u00f6ntemleriyle bu karma\u015f\u0131k senaryolar\u0131 ele almak i\u00e7in m\u00fckemmel bir ara\u00e7t\u0131r. \u00d6zel yetenekler tan\u0131mlayarak, kontrolc\u00fc ve view seviyesinde yetkilendirme yaparak ve performans ipu\u00e7lar\u0131n\u0131 uygulayarak, Rails uygulaman\u0131z\u0131n her k\u00f6\u015fesini g\u00fcvenli ve s\u00fcrd\u00fcr\u00fclebilir bir \u015fekilde koruyabilirsiniz. Unutmay\u0131n, iyi tasarlanm\u0131\u015f bir yetkilendirme sistemi, sadece g\u00fcvenlik sa\u011flamakla kalmaz, ayn\u0131 zamanda uygulaman\u0131z\u0131n mimarisini de g\u00fc\u00e7lendirir.<\/p>\n<h3>SSS (S\u0131k Sorulan Sorular)<\/h3>\n<h4>1. CanCanCan, model d\u0131\u015f\u0131 kaynaklar\u0131 yetkilendirirken performans\u0131 nas\u0131l etkiler?<\/h4>\n<p>CanCanCan, <code>authorize! :action, :symbol<\/code> gibi kullan\u0131mlarda do\u011frudan veritaban\u0131 sorgusu yapmad\u0131\u011f\u0131 i\u00e7in genellikle performans\u0131 olumsuz etkilemez. Ancak, <code>Ability<\/code> s\u0131n\u0131f\u0131ndaki bloklar i\u00e7inde karma\u015f\u0131k ve optimize edilmemi\u015f veritaban\u0131 sorgular\u0131 \u00e7al\u0131\u015ft\u0131r\u0131rsan\u0131z, bu durum performans\u0131 d\u00fc\u015f\u00fcrebilir. <code>accessible_by<\/code> kullan\u0131m\u0131, model tabanl\u0131 sorgularda performans\u0131 optimize etmenin anahtar\u0131d\u0131r.<\/p>\n<h4>2. <code>CanCan::AccessDenied<\/code> hatas\u0131n\u0131 \u00f6zelle\u015ftirebilir miyim?<\/h4>\n<p>Evet, <code>ApplicationController<\/code> i\u00e7inde <code>rescue_from CanCan::AccessDenied do |exception| ... end<\/code> blo\u011funu kullanarak hatay\u0131 yakalayabilir ve kullan\u0131c\u0131ya \u00f6zel bir mesaj g\u00f6sterebilir, farkl\u0131 bir sayfaya y\u00f6nlendirebilir veya farkl\u0131 bir HTTP durumu d\u00f6nd\u00fcrebilirsiniz. <code>exception.message<\/code> varsay\u0131lan hata mesaj\u0131n\u0131 i\u00e7erir.<\/p>\n<h4>3. CanCanCan'\u0131 bir API uygulamas\u0131yla kullan\u0131rken nelere dikkat etmeliyim?<\/h4>\n<p>API uygulamalar\u0131nda <code>CanCan::AccessDenied<\/code> hatas\u0131n\u0131 bir HTML sayfas\u0131na y\u00f6nlendirmek yerine, genellikle uygun bir HTTP durum kodu (\u00f6rne\u011fin, 403 Forbidden veya 401 Unauthorized) ile JSON format\u0131nda bir hata mesaj\u0131 d\u00f6nd\u00fcrmek daha iyidir. Ayr\u0131ca, <code>authenticate_user!<\/code> yerine API token'lar\u0131 veya di\u011fer kimlik do\u011frulama mekanizmalar\u0131n\u0131 kullanman\u0131z gerekebilir.<\/p>\n<h4>4. <code>Ability<\/code> s\u0131n\u0131f\u0131 \u00e7ok b\u00fcy\u00fcrse ne yapmal\u0131y\u0131m?<\/h4>\n<p><code>Ability<\/code> s\u0131n\u0131f\u0131 \u00e7ok karma\u015f\u0131k hale gelirse, onu daha k\u00fc\u00e7\u00fck, y\u00f6netilebilir mod\u00fcllere ay\u0131rabilirsiniz. \u00d6rne\u011fin, her kullan\u0131c\u0131 rol\u00fc veya belirli bir kaynak grubu i\u00e7in ayr\u0131 bir mod\u00fcl olu\u015fturup bunlar\u0131 <code>Ability<\/code> s\u0131n\u0131f\u0131nda <code>include<\/code> edebilirsiniz. Bu, kodun okunabilirli\u011fini ve bak\u0131m\u0131n\u0131 kolayla\u015ft\u0131r\u0131r.<\/p>\n<pre><code class=\"language-ruby\">\n# app\/models\/abilities\/admin_ability.rb\nmodule Abilities\n  module AdminAbility\n    def initialize_admin_abilities(user)\n      can :manage, :all\n      can :access, :admin_dashboard\n    end\n  end\nend\n\n# app\/models\/ability.rb\nclass Ability\n  include CanCan::Ability\n  include Abilities::AdminAbility # Mod\u00fcl\u00fc dahil et\n\n  def initialize(user)\n    user ||= User.new\n\n    if user.admin?\n      initialize_admin_abilities(user)\n    elsif user.editor?\n      # ...\n    end\n  end\nend\n<\/pre>\n<p><\/code><\/p>\n","protected":false},"excerpt":{"rendered":"Bu kullan\u0131c\u0131y\u0131 silemezsiniz.","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1342],"tags":[],"class_list":{"0":"post-38724","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-ai","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v20.5 (Yoast SEO v25.3.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Rails Authorization Beyond Models: CanCanCan ile G\u00f6sterge Panolar\u0131 ve Servis Kontrolc\u00fclerinin G\u00fcvenli\u011fini Sa\u011flama - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/rails-authorization-beyond-models-cancancan-ile-gosterge-panolari-ve-servis-kontrolculerinin-guvenligini-saglama\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Rails Authorization Beyond Models: CanCanCan ile G\u00f6sterge Panolar\u0131 ve Servis Kontrolc\u00fclerinin G\u00fcvenli\u011fini Sa\u011flama\" \/>\n<meta property=\"og:description\" content=\"Bu kullan\u0131c\u0131y\u0131 silemezsiniz.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/rails-authorization-beyond-models-cancancan-ile-gosterge-panolari-ve-servis-kontrolculerinin-guvenligini-saglama\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2026-02-06T09:00:38+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"13 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/rails-authorization-beyond-models-cancancan-ile-gosterge-panolari-ve-servis-kontrolculerinin-guvenligini-saglama\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/rails-authorization-beyond-models-cancancan-ile-gosterge-panolari-ve-servis-kontrolculerinin-guvenligini-saglama\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"Rails Authorization Beyond Models: CanCanCan ile G\u00f6sterge Panolar\u0131 ve Servis Kontrolc\u00fclerinin G\u00fcvenli\u011fini Sa\u011flama\",\"datePublished\":\"2026-02-06T09:00:38+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/rails-authorization-beyond-models-cancancan-ile-gosterge-panolari-ve-servis-kontrolculerinin-guvenligini-saglama\/\"},\"wordCount\":1783,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"articleSection\":[\"AI\"],\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/rails-authorization-beyond-models-cancancan-ile-gosterge-panolari-ve-servis-kontrolculerinin-guvenligini-saglama\/#respond\"]}],\"copyrightYear\":\"2026\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/rails-authorization-beyond-models-cancancan-ile-gosterge-panolari-ve-servis-kontrolculerinin-guvenligini-saglama\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/rails-authorization-beyond-models-cancancan-ile-gosterge-panolari-ve-servis-kontrolculerinin-guvenligini-saglama\/\",\"name\":\"Rails Authorization Beyond Models: CanCanCan ile G\u00f6sterge Panolar\u0131 ve Servis Kontrolc\u00fclerinin G\u00fcvenli\u011fini Sa\u011flama - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2026-02-06T09:00:38+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/rails-authorization-beyond-models-cancancan-ile-gosterge-panolari-ve-servis-kontrolculerinin-guvenligini-saglama\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/rails-authorization-beyond-models-cancancan-ile-gosterge-panolari-ve-servis-kontrolculerinin-guvenligini-saglama\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/rails-authorization-beyond-models-cancancan-ile-gosterge-panolari-ve-servis-kontrolculerinin-guvenligini-saglama\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Rails Authorization Beyond Models: CanCanCan ile G\u00f6sterge Panolar\u0131 ve Servis Kontrolc\u00fclerinin G\u00fcvenli\u011fini Sa\u011flama\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Rails Authorization Beyond Models: CanCanCan ile G\u00f6sterge Panolar\u0131 ve Servis Kontrolc\u00fclerinin G\u00fcvenli\u011fini Sa\u011flama - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/rails-authorization-beyond-models-cancancan-ile-gosterge-panolari-ve-servis-kontrolculerinin-guvenligini-saglama\/","og_locale":"tr_TR","og_type":"article","og_title":"Rails Authorization Beyond Models: CanCanCan ile G\u00f6sterge Panolar\u0131 ve Servis Kontrolc\u00fclerinin G\u00fcvenli\u011fini Sa\u011flama","og_description":"Bu kullan\u0131c\u0131y\u0131 silemezsiniz.","og_url":"https:\/\/fatihsoysal.com\/blog\/rails-authorization-beyond-models-cancancan-ile-gosterge-panolari-ve-servis-kontrolculerinin-guvenligini-saglama\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2026-02-06T09:00:38+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"13 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/rails-authorization-beyond-models-cancancan-ile-gosterge-panolari-ve-servis-kontrolculerinin-guvenligini-saglama\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/rails-authorization-beyond-models-cancancan-ile-gosterge-panolari-ve-servis-kontrolculerinin-guvenligini-saglama\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"Rails Authorization Beyond Models: CanCanCan ile G\u00f6sterge Panolar\u0131 ve Servis Kontrolc\u00fclerinin G\u00fcvenli\u011fini Sa\u011flama","datePublished":"2026-02-06T09:00:38+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/rails-authorization-beyond-models-cancancan-ile-gosterge-panolari-ve-servis-kontrolculerinin-guvenligini-saglama\/"},"wordCount":1783,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"articleSection":["AI"],"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/rails-authorization-beyond-models-cancancan-ile-gosterge-panolari-ve-servis-kontrolculerinin-guvenligini-saglama\/#respond"]}],"copyrightYear":"2026","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/rails-authorization-beyond-models-cancancan-ile-gosterge-panolari-ve-servis-kontrolculerinin-guvenligini-saglama\/","url":"https:\/\/fatihsoysal.com\/blog\/rails-authorization-beyond-models-cancancan-ile-gosterge-panolari-ve-servis-kontrolculerinin-guvenligini-saglama\/","name":"Rails Authorization Beyond Models: CanCanCan ile G\u00f6sterge Panolar\u0131 ve Servis Kontrolc\u00fclerinin G\u00fcvenli\u011fini Sa\u011flama - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2026-02-06T09:00:38+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/rails-authorization-beyond-models-cancancan-ile-gosterge-panolari-ve-servis-kontrolculerinin-guvenligini-saglama\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/rails-authorization-beyond-models-cancancan-ile-gosterge-panolari-ve-servis-kontrolculerinin-guvenligini-saglama\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/rails-authorization-beyond-models-cancancan-ile-gosterge-panolari-ve-servis-kontrolculerinin-guvenligini-saglama\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Rails Authorization Beyond Models: CanCanCan ile G\u00f6sterge Panolar\u0131 ve Servis Kontrolc\u00fclerinin G\u00fcvenli\u011fini Sa\u011flama"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/38724","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=38724"}],"version-history":[{"count":0,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/38724\/revisions"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=38724"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=38724"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=38724"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}