Need help with design of a Rails 2 app having two partitions

Question

I have models A,B,C,D, etc. I have my usual controllers/views/helpers for each of these models. These are accessed by a set of content authors in a form based application to populate data into the db. The content authors will also have categories like authors, publishers, super admins etc. Essentially we have built out a mini content management system.

A set of other users (unrelated to the above set) need to access data in some of these models. But the view for those are totally different. I also do not want these users to have the edit screens for the models they are allowed to view. Essentially these guys are end users who use the application as a read only/analytics data store.

How do I accomplish this? Should I create separate controllers and invoke these models for the user website? How do I ensure the website users do not have access to the cms screens? Any pointers, design principles, routing methods, gems for such an application?

Answer 1

How do I accomplish this? Should I create separate controllers and invoke these models for the user website?

I would create a different set of controllers for the backend and frontend. I would move the backend controller to a namespace. More Information on namespaces: http://guides.rubyonrails.org/routing.html#controller-namespaces-and-routing

How do I ensure the website users do not have access to the cms screens? Any pointers, design principles, routing methods, gems for such an application?

For this you need some kind of authentication and authorization. Some examples:

• authentication:
  • authlogic
  • devise
• authorization:
  • cancan
  • declarative_authorization
  • aegis
  • acl9

There are some good screencasts on this matter:

• Authlogic
• Declarative Authorization
• Authorization with CanCan
• Introducing Devise
• Customizing Devise

Answer 2

You need a layer of authentication.

The easiest way, and I'd say the most common one is to make separate controllers for each section, and add a before_filter method in each section authenticating and authorizing user to continue (usually a is_admin? method on the user model), or redirect back with an error message if the user is not allowed.

You can separate your controllers with namespaces (something like /admin/authors, /admin/books/1/edit and so on), and keep them RESTful this way.

If you need a more complex schema, you can use any of the authorization tools out there http://ruby-toolbox.com/categories/rails_authorization.html