6 ms·
Role-based authorization in Rails
- atomical 11y agoI think the pattern that needs to be explored is a rails engine that has a web interface to manage permissions for different models. Usually stakeholders want to control the roles and permissions.
- danmaz74 11y agoWe were recently working on designing a moderately complicated permissions system, and my impression is that it's impossible to create such a general-purpose engine and gem that covers enough of the cases that you'll have to manage, without creating something that is incredibly complicated to set up and manage. Except for a few standardized domains, you'll always have rules that are easier to express and maintain with some custom, domain-specific code.
- gkop 11y agoNeat idea, you might be able to quickly throw together a really compelling proof-of-concept by building off of https://github.com/RolifyCommunity/rolify https://github.com/RolifyCommunity/rolify, which seems to strike a nice balance of opinionated, flexible, and doing a fair amount of work for you (IE it gets involved in / takes care of the db data modeling).
- opiotrek 11y agoInteresting, this is very project specific so might be tough to implement for general user-base.
- ericrr 11y agoThere's also Rollout: https://github.com/FetLife/rollout https://github.com/FetLife/rollout
- atomical 11y agoThat doesn't have anything to do with roles and permissions.
- taf2 11y agoI like the approach to describe permissions but I also think that a good data model to sit behind this that includes roles and capabilities ultimately is needed in most applications. Users and use cases will almost always arise that require arbitrary roles with a mix of capabilities...
- opiotrek 11y agoYou are allowed to mix any roles in any combinations. This shows only a flat hierarchy, but I'd love to explore that in an example sooner than later :)
- wldcordeiro 11y agoCanCan + Rolify does exactly what the OP wants.
- seivan 11y agoI thought CanCan was abandoned when Rbates took some time off? https://github.com/ryanb/cancan https://github.com/ryanb/cancan
- kauboy 11y agoThe community revived it https://github.com/CanCanCommunity/cancancan https://github.com/CanCanCommunity/cancancan
- riffraff 11y agothere is a community maintained fork https://github.com/CanCanCommunity/cancancan https://github.com/CanCanCommunity/cancancan
- seivadmas 11y agoWhat happened with that guy? Did he ever come back?
- ch4s3 11y agoYeah, he's back online, but hasn't done any more casts or OSS work.
- ebola1717 11y agoI've been using Pundit, which is model-based, rather than role-based, and it works really nicely with Rails conventions. Model-based feels more natural than role based, IMO.
- Abundnce10 11y agoI've used Pundit in my last few projects and loved the simplicity of it. Would recommend to others.
- gkop 11y agoIndeed, the author is framing Access Granted against CanCan/CanCanCan, when Pundit has already picked up the torch of Rails authorization. Pundit made the design decision to be as close to pure Ruby as possible, and therefore is extremely flexible (similar to the design philosophy of Strong Parameters). Access Granted seems like a step backwards (toward a DSL) from Pundit. So it would take a strong argument to show why Access Granted is preferable to Pundit.
- carlosdp 11y agoYea I thought the same thing when reading this. Pundit is already well adopted and covers this use case, this seems like re-inventing the wheel a bit atm.
- opiotrek 11y agoI personally dislike Pundit's way of defining permissions, but as always it's a preference. I really wanted to keep CanCan's simplicity, but add roles while cleaning abilities/policies up.
- carlosdp 11y agoPundit is excellent, it doesn't tie you to any one model of authorization, it just gives you a standard way to implement your own in a very light-weight fashion.
- hopsoft 11y agoI do like the access-granted DSL. It seems to address some of CanCan's problems on larger more complex projects. Also... if you prefer a more OO style, I wrote a 50 line authorization lib that has proved workable on some of my larger projects. https://github.com/hopsoft/perm https://github.com/hopsoft/perm
- jph 11y agoNice work - your OO style and wrapper is well done. And the OO style makes it easier to do dynamic roles, such as DCI.
- Glyptodon 11y agoI strongly prefer Pundit. Not that my opinion adds a whole lot to the conversation.