Question

My Rails 3.2 project has a devise-generated user and a set of models that all contain data that’s specific to that user. I want a logged-in user to be able to access only his own data through the APIs exposed by the controllers.

Now, a brute-force way to enable this would be to change each and every controller from something like:

def index
  @stuff = Stuff.all

to

def index
  @stuff = Stuff.find_all_by_user_id current_user.id

And I have to repeat this for every single action of every single controller. Is there perhaps a more succinct and DRY way of achieving the same effect? The amount of boilerplate I have to write feels wrong.

Thanks!

Answer 1

Take a look at the CanCan gem.