Question

I don’t know if this is possible, but I’m writing an application that allows anonymous users to create records and update them. Now I only want them to be able to update a record within a few minutes after creating it.

Is there any kind of timeout method I can use with, say cancan for example?

Or would a better option be to associate the model with the user’s IP address and only let the same IP edit the record? Since the end goal is preventing a malicious user from editing any and all records.

Thanks

Answer 1

You can use callback validation with your own custom function.
If you created model using the rails generate commands, every model will have a created_at column in the database.

Model Book
    before_update: check_time

    def check_time
        if created_at < 10.seconds.ago
            return false
        else 
            return true
        end
    end
end