Rails declarative_authorization project_admin role - ruby-on-rails-3

Question

I am trying to create project admin and project collaborator roles using the declarative_authorization gem.
I have a table called 'collaborators' which holds the users to projects mappings.
Models:
Project
has_many :collaborators
has_many :users, :through => :collaborators
User
has_many :collaborators
has_many :projects, :through => :collaborators
Collaborator
belongs_to :user
belongs_to :project
I need some guidance on defining the dsl for project_admin and project_collaborator role.
I have come up with the following:
authorization do
role :guest do
has_permission_on :users, :to => [:read]
end
role :project_admin do
has_permission_on :projects, :to => :manage do
if_attribute :project_admin => true
end
end
role :admin do
has_permission_on :users, :to => [:delete]
end
end
privileges do
privilege :manage do
includes :create, :read, :update, :delete
end
end
Appreciate any suggestions/help.
Thanks!

Answer 1

I would prefer something like that so that every user could become an project admin:
Project
has_many :collaborators
has_many :users, :through => :collaborators
belongs_to :admin, :table_name => 'users' # Maybe has_many?
authorization_rules.rb
authorization do
role :guest do
has_permission_on :users, :to => [:read]
end
role :user do
has_permission_on :projects, :to => :create
has_permission_on :projects, :to => :manage do
if_attribute :admin => is { user }
end
has_permission_on :projects, :to => :read do
if_attribute :collaborators => contains { user }
end
has_permission_on :files, :to => :manage do
if_permitted_to :read, :project
end
end
end
privileges do
privilege :manage do
includes :create, :read, :update, :delete
end
privilege :read, :includes => [:index, :show]
privilege :create, :includes => :new
privilege :update, :includes => :edit
privilege :delete, :includes => :destroy
end