Question

If I’ve got a simple rails user model that has an array of roles, is it sufficient enough to control access to actions by simply checking the model’s role attribute for that role and blocking/proceeding accordingly?

Is there an advanced system that I ought to leverage due to unforeseen complexity?

Important: I’m not looking to authorize users/roles to models (I am already aware of CanCan). I’m looking to do security at the controller level so that I can break out the functionality in finer detail.

Even more important: Seriously, I’m not necessarily asking about CanCan, please read the question carefully and pay attention! 🙂

Answer 1

Question 1: YES, Question 2: NO.

I just keep this simple

If you check the models attribute in the controller, the controller will restrict all users that do not have this attribute set.

ex:

def create
  @user.find(params[:user_id]) 
  if @user.admin?
  @post.new(params[:post]) 
  @post.create!
  end
end

make a method in the user model

def admin?
  role == "Admin"
end

You should make better code than this. To much logic in the controller, but this will keep all, except admins out.