Question

I want to be able to edit and delete resources myself, but not allow users of the application to do so.

Is there an easy way of doing this in Rails?

An incomplete solution would be just to remove the “delete” and “edit” buttons from the index view, but that doesn’t disable their ability to do so via direct HTTP requests.

Running Rails 2.2.2 and ruby 1.8.7

Answer 1

Add a before_filter in your controller as shown below:

class PostsController < ApplicationController

  before_filter :require_god, :only => [:edit, :update, :destroy]

private  
  def require_god
    unless current_user.id == (@@god ||= User.find_by_login("phleet")).id
      flash[:notice] = "You don't have access to this page"
      redirect_to root_path
      return false
    end
  end

end