How do I implement Row Level Security in Rails?
I've been testing Rails in the last months and it's amazing! But I have a question on how to do RLS (row level security), which is critical to me. I thought I should be using ActiveRecord callbacks, but these can be simply fired before or after the object state changes, as they say.
I'm going to use PostGresSQL, so I have to use Views so that a specific user / organization can only see its rows, but I would rather implement my RLS logic in rails instead of directly inserting it into my database ...
a source to share
I am currently working on a project that uses Grant . While not incredibly mature, it seems to block things pretty well in models rather than controllers, which is why most other security modules for Rails require you to supply logic.
Controller-level security really only dictates where users can go, not what they see. If you accidentally put the wrong resource on a page, you could inadvertently convey information that you didn't want.
However, for a small project, I am using CanCan and it works well as long as you are careful not to include resources in views that are not validated.
Either way, you need an authentication system to log in and log out users. There are several: Devise is probably the most widely used.
a source to share
If for "row-level security" you mean to allow a user to access a specific row based on their role for the selected row, you could take a look at declarative_authorization (RailsCast) , which allows you to define access rules using a high-level DSL. You can even define rules based on the values of the "rows" attributes.
a source to share
I ended up using the user_id from Devise authentication as I added it to my database tables where I wanted to limit the row.
I wrote something about this: http://marktmilligan.tumblr.com/post/78996534776/adding-row-level-security-to-your-rails-app
a source to share