Question

I am using the sentient_user gem to have access to the current_user object in my application. I want to override the default ActiveRecordBase queries to scope them to the current user.

For instance, I don’t want my users looking at, deleting, modifying other user’s orders.

I feel like I should be able to override a single (or couple) ActiveRecordBase methods to accomplish this, but I don’t know which or how.

Thanks in advance.

Answer 1

In your controllers, use queries like:

@orders = current_user.orders.find(params[:id])

That’ll scope the find query properly for you. You don’t want to include code related to the current_user in your models or in ActiveRecord::Base – it violates MVC.

Edit: I should mention that when you need to do this in the model layer you’ll use default_scope: http://ryandaigle.com/articles/2008/11/18/what-s-new-in-edge-rails-default-scoping

For example:

class Order < ActiveRecord::Base
  default_scope :order => 'created_at DESC', :conditions => { :processed => true }
end

Then, all Order queries will order by created_at descending, and only return records where processed = true, unless you override either of those options specifically.