become

A while ago (Nov. 2006) was looking for a solution to Roles and Permissions for Ruby on Rails.  One idea on the RoR site is to create an Access Control List (ACL), create a before filter and allow certain roles to certain actions.   This seemed like a lot of extra work.  Especially if you have to do this to each controller.  Plus you have to maintain it!  I wanted something more dynamic–cooler.  Plus, it places an unnecessary dependency between me and my code.  I want to solve problems, not add/remove permissions.

Enter acts as role.  Written with my friend Jon Morton, AAR allows for role/permission simplicity through-out a Rails application.   We followed these guidelines when writing AAR - Had to:

• have model based security
• protect Controller actions
• simple to code in the View
• hide items easily in the View
• database driven, have no ACL list in the code
• allow multiple roles
• and handle permission conflict intelligently

Understanding Users/Roles/Permissions
AAR’s basic principle is that you should not give special permissions directly to the User.  All permissions are given to a Role.  If there is a snowflake** who needs X permission then I copy an existing Role and add the permission.  This way if (or when) that user is gone the permissions and are preserved.

Installation can be a simple as downloading the app, putting it in your vender/plugins directory and adding “include ActsAsRole” at the top of your controllers/application.rb.    Correction.  There are models and relationships that need to be set up that I have not explained.  I’ll work on updating the README to include this. And add some rake tasks to the plugin to create the models.  See the DB Schema PDF to see the model associations.

EXAMPLE of using AAR:

if has_access?(users_path)do something…end

OR

if has_access?(:controller => ‘users’, :action => ‘index’)do something…end

In Part 2, I’ll have a screencast and a test app.

Links:
git AAR
model schema diagram pdf

** Jon Bartels, fellow programmer who coined the edge cases as “snowflakes”…because everyone wants to be special and unique.

This entry was posted on Monday, November 17th, 2008 at 2:28 pm and is filed under Ruby on Rails. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.