Question

I’m about to start building a Rails app that will eventually need to vary CRUD access by user (i.e. which pages do they see, which can they edit, etc).

Is there a best stage of the development cycle to incorporate this?

Part of me feels like it should be the very first thing, since almost every piece of the interface will in some way rely on checking the user’s ID, and it will be an inherent part of the DB structure.

Another part feels that this would overcomplicate things to start out with, and that I should instead build the core parts of the app, then layer on the authentication/authorization later.

Are there any best practices around this sort of thing?

Answer 1

I would say that if your system will rely on some kind of authentication… Why wait?

Let’s say that you start developing your application without the authentication layer but at the same time you know that at some point you will have to do it. That means that at some point you will develop the authentication layer, and most likely you will have to refactor what you have already built to adapt it to this new layer.

Also, to try to convince you a little bit more…When you say:

I should instead build the core parts of the app

You should consider that the authentication module might be a core part of the app too…