What is is the best way to manage edit/destroy/new links with authentication?

Question

I'm new to Rails and I'm trying to create a standard CRUD rails application for displaying text posts. It's pretty similar to blog where I would like authenticated users to be able to edit and destroy posts while visitors to the site can just see and browse the existing posts.

I would like to know what is the best way to manage this. So far I've been using two controllers the first has a before_filter so that each route requires authentication and the associated views have edit/destroy/new links. The second controller has no authentication filter and the views don't have links to edit or destroy the posts.

This solution works, but I don't think it's very DRY. I have a feeling that if stick with this situation things will get more and more complicated as I add more functionality. Is there a better way to manage this? I'm sure it must be common problem.

Answer 1

Ryan talks about this problem (RY by having admin controllers and regular user controllers) and a better solution in Railscast #19.

As an aside, I hope your second controller (the one without an authorization before_filter) doesn't have update or destroy actions. Even if you don't have the links in your view an unscrupulous person could create a request that would mess with your data.

Answer 2

You should give lockdown a try: http://stonean.com/page/lockdown

Lockdown is an authorization system for RubyOnRails (ver 2.x). It is designed to handle a simple public vs private configuration to very fine grained access controls.

Answer 3

I use role_requirement to control user access to given controller methods via "admin" and "user" roles. I use a hand rolled lib to make sure that a given user has permission to access/manipulate specific data. So for example, if you don't "own" a certain post (say #3), yet you try to drop its ID in /posts/destroy/3, you will get shut out.