Comments on: Recipe: Make request environment available to models in Rails

By: Logging in Ruby on Rails | Rohit's Blog

Logging in Ruby on Rails | Rohit's Blog — Thu, 19 Aug 2010 12:37:37 +0000

[...] You can get the User.current by using the Thread class provided by Rails. A detailed version of this is available here. [...]

By: LeipeLeon

LeipeLeon — Fri, 18 Dec 2009 17:05:34 +0000

hmm….

seems to me that Thread.current is the thread of the rails process.

what about when 2 different users update simultaneously?

By: Braxton Beyer

Braxton Beyer — Wed, 28 Oct 2009 01:53:57 +0000

Could you achieve this same thing using Rails.cache? (http://www.highdots.com/forums/ruby-rails-talk/best-way-store-global-variable-285504.html)

What are the pros/cons of each method?

By: James Bebbington

James Bebbington — Thu, 15 Oct 2009 11:34:14 +0000

Just adding a couple of manual trackbacks that are worth checking out:

http://stackoverflow.com/questions/1568218/access-to-currentuser-from-within-a-model-in-ruby-on-rails

http://www.pluitsolutions.com/2006/08/15/rails-auto-assign-created-by-and-updated-by/#comments

By: ginty

ginty — Tue, 03 Mar 2009 16:19:52 +0000

@Jo: Yep I agree, definitely part of the business logic and this definitely provides the means to put it where it belongs.

Thanks for the reply, I’m converting my app over to something like this as we speak.

I plan to do a slight variation on your approach and only access my models from the controller via new methods Model.all_available (replacing find_all from the controller) and Model.get (replacing find(x)).

Then within these I will put the permission checks to return only what the current user is entitled to.

Cheers!

By: Jo Hund

Jo Hund — Tue, 03 Mar 2009 05:22:52 +0000

@ginty: Yes, I use this approach in production. I had a quick conversation with lifo on his blog about this. It feels a bit dirty. Global state. Not very object oriented. I am still wrestling with this. I believe permissions need to be delegated to the model. I don’t care about MVC in this case. In a Graphics software, you do a lot of presentation work in the model, because that is the main concern of the software. So in a multi user web application, permissions are part of business logic and should be handled in the model.

The challenge is to give the model access to the current user. There are other solutions (sweepers), but using those for permissions feels just as much like a hack.

I am looking at other MVC implementations for inspiration. E.g. OS X software. What is Cocoa’s way of handling this? I didn’t dig very deep, however it seemed like you get get to the current user via a global accessor.

By: ginty

ginty — Tue, 03 Mar 2009 05:12:37 +0000

This is great stuff, thanks for that and your other related post.

Are you currently running this in production?

I’m just slightly nervous (but without a good reason) given some of the discussion about the use of Thread.current in some way being a hack.

I really don’t believe there is a better solution though, it makes so much sense to put the gatekeeper in the model, and it seems to be a violation of MVC to have to put that responsibility in the controller.

By: yawningman

yawningman — Sat, 20 Dec 2008 09:47:23 +0000

Thanks for this info, it was just what I needed to solve a similar problem of needing to store variables that where unique per request from within a rails plugin.