Dynamic roles and permissions system in Rails app

Question

I need to create roles based permissions systems in my Rails app. I would be totally happy with CanCan, but the main problem - it has to be dynamic, so that Admin has to be able to assign permissions and to create new roles. The permissions can be simple controller/action restrictions, and can be data related, for example some users can edit only their own profiles, and some of them can edit the profiles of all the users in the particular group. And it would be really nice to allow Admin to create new permissions.

What I'm thinking about is to store in db a controller/action, and some data related restrictions (I'm really confused here about the way to define them). So could you please give me some advice, what would be the best way to organize permissions?

Any thoughts are much appreciated

Answer 1

If you like CanCan, then I think is best to use it. Here is a short tutorial about storing abilities in database so non-programmers can update them:

https://github.com/ryanb/cancan/wiki/Abilities-in-Database

If you really, really want to implement such system yourself. Depending on your needs, I will suggest for you to implement it as simple as possible.

In the case you need only users to have access to modules(certain controllers). You can do:

1. Store all users permissions in just like serialized fields -> http://apidock.com/rails/ActiveRecord/Base/serialize/class

   class User serialize :permissions, Array

   def access_to?(module) permissions.include? module.to_s end end

some check when setting this field would be nice.

2. Just make a check on top of every controller if the current user have access to this controller(section)

   class ApplicationController private

   def self.require_access_to(module)
      before_filter do |c|
        unless c.send(:current_user).try :access_to?(module)
          c.send :render_no_presmissions_page
        end
      end
   end
   

   end

   class AdminNewsController require_access_to :news end

Of course this is just a start position, from where you can easily evolve.