Question

Are there are any authorization gems/examples for multi-tenancy applications?

I looked at CanCan and CanTango, but I wasn’t able to find what I am looking for.

My app has Account, User, Relationship model. The relationship model has a relationship_type column which determines authorization level. Its value can be owner, moderator, editor, perhaps more in the future. Users can own/moderate many accounts, and an account can have many owners/moderators.

All the examples I found describe a single tenant application, whereas my app’s authorization has to be scoped through the current account being viewed. A user can be a guest on one account and an owner of another, for example.

I’m starting to think my Relationship model is bad design and might have drawbacks, but I’m not sure what is a better alternative.

Answer 1

CanCan can indeed handle this because it lets you define arbitrary ruls. Your ability file might look like this:

def initialize(user)

  can :read, BlogPost do |blog_post|
    blog_post.account == user.account and user.relationship.in?([:owner, :moderator])
  end

end