change view and action for announcement ,Lin checked. Also add validation for object_auth make sure for each object,the object will be unique for each action.

app/controllers/admin/module_apps_controller.rb

@@ -101,7 +101,7 @@ class Admin::ModuleAppsController < ApplicationController
     end
       #user is not permited to do that
       flash[:notice] = t('admin.app_auth.operation_not_permitted')
-      redirect_to :action => "edit"   # [TODO] maybe need to redirect to some other page
+      render :nothing => true, :status => 403 
   end
   
   
@@ -113,7 +113,7 @@ class Admin::ModuleAppsController < ApplicationController
     end
       #user is not permited to do that
       flash[:notice] = t('admin.app_auth.operation_not_permitted')
-      redirect_to :action => "edit"   # [TODO] maybe need to redirect to some other page
+      render :nothing => true, :status => 403 
   end
   
 end

app/controllers/admin/object_auths_controller.rb

@@ -27,8 +27,13 @@ class Admin::ObjectAuthsController < ApplicationController
   
   def create
     obj = eval(params[:object_auth][:type]).find params[:object_auth][:obj_id]
-    @object_auth=obj.object_auths.create :title=> params[:object_auth][:title]
-    redirect_to edit_admin_object_auth_path(@object_auth)
+    @object_auth=obj.object_auths.build :title=> params[:object_auth][:title]
+    if @object_auth.save
+      redirect_to edit_admin_object_auth_path(@object_auth)
+    else
+      flash[:error] = t('admin.object.a_object_must_have_only_one_object_auth_profile_for_each_action')
+      redirect_to (:back)
+    end
   end
 
   def create_role

app/models/object_auth.rb

@@ -1,5 +1,6 @@
 class ObjectAuth  < PrototypeAuth
   include OrbitCoreLib::ObjectTokenUnility
+  validates_uniqueness_of :obj_authable_type,:scope => :title #{ |c| }
   belongs_to :obj_authable, polymorphic: true
   # > - Something.find_with_auth(query)
   # > - or Something.find(query).auth

app/views/admin/components/_user_role_management.html.erb

@@ -1,7 +1,7 @@
 <div id="open_for_all_user">
 	<h1>All User</h1>
 	<%= form_tag(submit_url) do %>
-	<%= check_box_tag 'auth_all',true,auth.all  %><%= submit_tag 'Add Role' %><br/>
+	<%= check_box_tag 'auth_all',true,(auth.all rescue true)  %><%= submit_tag 'Add Role' %><br/>
 	<% end %>
 </div>