# 1 table 2 models

**URL:** <https://www.ruby-forum.com/t/1-table-2-models/115392>\
**Category:** Rails\
**Created:** [September 24, 2007, 9:01pm UTC](https://www.ruby-forum.com/t/1-table-2-models/115392 "2007-09-24T21:01:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![doug](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/dbc845/32.png) [@doug](https://www.ruby-forum.com/u/doug)\
**Post date:** [September 24, 2007, 9:01pm UTC](https://www.ruby-forum.com/t/1-table-2-models/115392/1 "2007-09-24T21:01:17Z")

</div>

I have a single database which contains a single table. The general  
public will not have access to the table at all. I have 2 classes of  
users that will have access to the table. The ‘members’ class is to  
have read-only access. The ‘admins’ class is to have read and edit  
access.

My initial thought was that the way to handle this was to setup 2  
controllers (and 2 models) because it would be easier to control the  
access if each class having access to the table had their own separate  
controller. I’m having trouble with that approach getting  
ActiveRecord::StatementInvalid errors. I think I am beginning to see  
why.

My question is: When one has only one table and wants to provide 2  
different levels of access to it, what is the best strategy to employ?

Thanks for any input.

```
   ... doug
```

---

<div class="post-metadata">

**Author:** ![doug](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/dbc845/32.png) [@doug](https://www.ruby-forum.com/u/doug)\
**Post date:** [September 24, 2007, 9:17pm UTC](https://www.ruby-forum.com/t/1-table-2-models/115392/2 "2007-09-24T21:17:19Z")

</div>

I don’t know about best…

Use validate\_on\_update to reject the update if the user lacks  
permission.

---

<div class="post-metadata">

**Author:** ![doug](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/dbc845/32.png) [@doug](https://www.ruby-forum.com/u/doug)\
**Post date:** [September 24, 2007, 9:29pm UTC](https://www.ruby-forum.com/t/1-table-2-models/115392/3 "2007-09-24T21:29:21Z")

</div>

On 9/24/07, doug [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> controller. I’m having trouble with that approach getting  
> ActiveRecord::StatementInvalid errors. I think I am beginning to see  
> why.
> 
> My question is: When one has only one table and wants to provide 2  
> different levels of access to it, what is the best strategy to employ?

Having two models isn’t going to help you much. You need one model.

You can look at [http://perens.com/FreeSoftware/ModelSecurity/](http://perens.com/FreeSoftware/ModelSecurity/) for an  
interesting approach to employing security at the model level, but  
it’s tricky, so do your research.

In general, you use before\_filter in your controller to asses the  
current user’s level and allow or deny access to the appropriate  
actions. Having two controllers makes it simpler because you don’t  
have to do fine-grained declarations in your before\_filter statement.

---

<div class="post-metadata">

**Author:** ![doug](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/dbc845/32.png) [@doug](https://www.ruby-forum.com/u/doug)\
**Post date:** [September 25, 2007, 12:13am UTC](https://www.ruby-forum.com/t/1-table-2-models/115392/4 "2007-09-25T00:13:41Z")

</div>

> Having two controllers makes it simpler because you don’t  
> have to do fine-grained declarations in your before\_filter statement.

Exactly what I was thinking but articulated much better.

> Having two models isn’t going to help you much. You need one model.

So, I take it that you are suggesting 2 controllers and one model.  
Sounds  
good to me; and, in fact, at least initially that approach seems to  
work great.

I’m not sure that I have my mind completely wrapped around all this;  
but,  
at least it appears that things are beginning to clear up.

Thanks for the help.

```
   ... doug
```