How to program user preferences

Question

I'm using Ruby on Rails for an internal site. Different users of the site have access to a wide variety of data and highly disparate perspectives of the data. Within those different classes of users, there needs to be levels of access. Within the levels of access I need to be able to add features from other classes of users.

In the released "Version 1.0" of the intranet site I have implemented the general classes of users. I am now needed to implement much finer-grained control of a users access.

The question is how?

What is the generally accepted practice for coding up user preferences (display the map (or not); access to this feature, but not this feature) without exploding the database schema and populating the view code with <% if feature_allowed %> tags everywhere.

Answer 1

Have a look at this permissions topic

Answer 2

Another totally different approach would be to use acts_as_authenticated and authorization plugins. The tables will be built by the plugins (ie users, roles and roles_users). From the doc:

The authorization plugin provides the following:

• A simple way of checking authorization at either the class or instance method level using #permit and #permit?

• Authorization using roles for the entire application, a model class, or an instance of a model (i.e., a particular object).

• Some english-like dynamic methods that draw on the defined roles. You will be able to use methods like "user.is_fan_of angelina" or "angelina.has_fans?", where a 'fan' is only defined in the roles table.

• Pick-and-choose a mixin for your desired level of database complexity. For all the features, you will want to use "object roles table" (see below)

Answer 3

populating the view code with <% if feature_allowed %> tags everywhere.

I don't think you want to do that. Assuming none of the alternatives suggested are practicable, at the very least you should consider shifting those checks into your controllers, where you can refactor them into a before_filter.

See section 11.3 in "Agile Web Development With Rails" (page 158 in my copy of the 2nd edition) where they do exactly that.

Answer 4

This is much more of what I was looking for ... posted here for future reference.

http://metautonomo.us/2008/09/30/easy-role-based-authorization/