Controlled access and routing

Question

I have a rails application and I want to manage access to the application in a controlled way. The client user would have access to only certain views in the application, whereas the admin can access any page. In future, I may also add some semi-admins who might have access to a subset of pages that were accessed by the admin. I already have a login authentication but I want a better solution to control user access to certain pages in my application.

Answer 1

use before_filter

users_controller.rb

  class UsersController < ApplicationController
    before_filter :login_required, :except=>[:show]
    before_filter :required_admin, :only=>[:all_users]

    def show

    end

    def all_users

    end

    def edit

    end

  end

application_controller.rb

  class ApplicationController < ActionController::Base

    def current_user
       session[:user]
    end

    def login_required
      if current_user
        return true
      else
        flash[:notice]='Please login to continue.'
        redirect_to :controller => "logins"
      end
    end

    def required_admin
      if current_user && current_user.is_admin?  #check here if current user is admin or not
        return true
      else
        flash[:notice]='Please login as admin.'
        redirect_to :controller => "logins"
      end
    end
  end

1. Show method can see anyone with & without login

2. only admin can see all_users method

3. edit method can see any login user (i.e user admin)

Answer 2

It appears you have the basics of authentication down, but just need a role-based authorization solution. You might want to take a look at CanCan, it works well with most authentication packages. There is a good railscast on how to use it.

Hope this helps.