Question

I have a Repository model as follows:

class Repository < ActiveRecord::Base

  belongs_to :user
  has_many :members, :class_name => :users
  has_many :datum

end

It has a private boolean attribute, that indicates if it’s a public repository, i.e., visible for everyone. Or if it’s a private repository and only visible to his members.

What is the best way to retrieve only repositories users are allowed to see?

The logic is: if it’s public, just retrieve it. If it’s private, check if the user is on member list.

I believe I just need to create a method to check this on Repository controller, and use it to verify if user has access to it. But I can’t figure out the best way to do it!

Answer 1

Easy way is to use authorization library. I use CanCan in all my projects.

You can declare access right in a clean readable way.

can :read, Project, :active => true, :user_id => user.id

And then later check authorization. This line displays link only if current_user has access to the project.

<%= link_to 'A project', @project if can? :read, @project %>

For more information read cancan’s wiki.