This repo is no longer being supported. See README.
Ruby
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Failed to load latest commit information.
lib
rails
rdoc
spec/authorize_me
tasks
.gitignore
MIT-LICENSE
README.rdoc
Rakefile
authorize_me.gemspec

README.rdoc

THIS REPO IS NO LONGER MAINTAINED

We haven't used this for a while. If you would like to take over ownership of this repo, please let us know.

authorize_me

authorize_me is a gem for Rails to handle simple role-based authorization. It is similar in style to can-can. The largest difference is that authorization rules are defined in the model they protect rather than one centralized location.

Set up the user model

Tell the gem which model to treat as the “user”.

class User
  authorize_me
end

The following methods are generated:

User#can_create?(obj)
User#can_read?(obj)
User#can_update?(obj)
User#can_destroy?(obj)

Each of these methods can take a model class, instance, or symbol.

The user model is expected to have a role method that returns a string or symbol. It could be a DB column or a method you define. Here is an example:

def role
  if admin?
    :admin
  else
    user_type
  end
end

Declare authorization rules

Authorization rules are declared in each model where they apply

class Article
  authorization do |role|
    role.admin     :can => :manage
    role.publisher :can => :manage, :if => :author?
    role.publisher :can => [:read, :create]
    role.any       :can => :read
  end
end

In this example a publisher can always read and create articles, but they can only manage articles for which they are the author. This declaration assumes there is an Article#author? method which takes a user argument and returns a boolean.

:manage is shorthand for [:create, :read, :update, :destroy]

In your controllers

The unauthorized! method simply raises an AuthorizeMe::Unauthorized exception for you to handle as you choose.

def show
  @article = Article.find(params[:id])
  unauthorized! unless current_user.can_read?(@article)
end

In your views

<% if current_user.can_update?(@article) %>
  <%= link_to 'edit', edit_article_path(@article) %>
<% end %>

Copyright © 2010 Adam McCrea, released under the MIT license