Comments on: Recipe: RESTful permissions for Rails

By: Jeff K. Ward

Jeff K. Ward — Wed, 22 Oct 2008 06:22:30 +0000

Great recipe. I’ve started a new project this week and am setting everything up as you’ve outlined here. Very clear and concise instructions and lots to chew on.

I initially shrugged off using make_resourceful but now that I have all these “raise PermissionViolation” lines everywhere I can see how it will help keep it DRY. Works well together.

Oh, and your gist link still has Person in the code instead of User.

Thanks again for another amazing post. Keep ‘em coming!

By: ActsAsFlinn

ActsAsFlinn — Mon, 13 Oct 2008 13:26:07 +0000

@Jo Hund nice thanks!

By: Jo Hund

Jo Hund — Fri, 10 Oct 2008 16:43:03 +0000

@ActsAsFlinn: Rails uses Thread.current to store the current Timezone. Check out the Rails source for more info (lines 14 - getter and 37 - setter). @emerb: Not sure how you use method_missing. As a safeguard for permission checks you haven't implemented? You return false by default? I use method_missing as little as possible. Jay Fields has convinced me in one of his articles

By: emerb

emerb — Fri, 10 Oct 2008 15:33:31 +0000

I implemented something similar (more general though), in my implementation I use the method missing to return false when the method ends with ‘?’, I think you could do that as well

By: ActsAsFlinn

ActsAsFlinn — Fri, 10 Oct 2008 15:08:43 +0000

In your intro you mentioned that Rails does something like this somewhere:

Thread.current[:user]

Can you point that out so I can better understand the context.

By: jhund

jhund — Mon, 29 Sep 2008 22:29:43 +0000

@Anthony: Yes, if you go with the standard naming for restful_authentication, then you have to use ‘User’ instead of ‘Person’.

I prefer to use Person (even with restful_authentication). It seems a bit more personal than ‘user’.

I am in the process of updating this recipe and will push it to github pretty soon. That’s where I will maintain these recipes. Makes managing changes easier.

Thanks for your interest.

By: Anthony Underwood

Anthony Underwood — Mon, 29 Sep 2008 22:09:20 +0000

I like the idea and it is already making my app DRYer. However using restful_authentication, should actor.is_a?(Person) not be actor.is_a?(User)?

The latter worked for me whereas the former failed to ever give permission.