Securing a layered Rails model

Question

I need to do the following in Rails to mirror a desktop application:

The user and the department "own" the record, if you don't own the record at the user or office level, you are in the public world.

user reads, writes, deletes model record office reads / writes / deletes model record other or public gets read / write / delete to model record

eg.

UserA owns a read / write / delete model OfficeA owns a read / write model other / public read

I was wondering if a plugin / gem exists to provide this functionality?

+2

user330710 May 02 '10 at 7:42

3 answers

Joshua partogi · Answer 1 · 2010-05-02T08:16:08+0000

You need an authorization framework like cancan or declarative_authorization for this.

Leopd · Answer 2 · 2012-04-27T00:00:32+0000

It sounds like you want it to work at the model level. So select "yes" in the "M" column.

Isaac Hollander McCreery · Answer 3 · 2013-10-15T14:23:08+0000

I recommend using Grant . It is an easy-to-use, albeit rather bare, model-level security model. I'll describe in more detail in this answer .