Question

We have an application which is multi-tenant (lots of users all accessing their own data, similar to something like Basecamp).

Question is, what is the simplest and easiest way in Rails to ensure that users can only see their own accounts data? Is it a case of going and checking every single query?

Answer 1

A way to make that happen:

• Use subdomains, so its customer.domain.com …. Then in your Application controller, have a before filter that will find the subdomain and set a @customer variable
• Always get data from the customer, so you say @customer.quotes.find(params[:id]) … rather than Quote.find(params[:id])

So, yes, in a multi-tenant database, you need to check every query.