# Abstracting ownership verification out of Controller

**URL:** <https://www.ruby-forum.com/t/abstracting-ownership-verification-out-of-controller/71257>\
**Category:** Rails\
**Created:** [February 21, 2006, 2:09pm UTC](https://www.ruby-forum.com/t/abstracting-ownership-verification-out-of-controller/71257 "2006-02-21T14:09:10Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![SBSBSB](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ecccb3/32.png) [@SBSBSB](https://www.ruby-forum.com/u/SBSBSB)\
**Post date:** [February 21, 2006, 2:09pm UTC](https://www.ruby-forum.com/t/abstracting-ownership-verification-out-of-controller/71257/1 "2006-02-21T14:09:10Z")

</div>

Right now I have a controller for “events” that belong to a specific  
user. I only want the creator to be able to edit or delete the event.

I’ve got the proper foreign keys set up.

I’ve finally arrived at the point where I can take baby steps with  
code, but looks like my first steps are in flagrant violation of the  
DRY principle.

Here’s what I have so far in the “EventsController” and I know it’s  
ugly (but it works).

def update  
@event = Event.find(params[:id])  
if @event.user\_id == session[:user] &&  
@event.update\_attributes(params[:event])  
flash[:notice] = ‘Event was successfully updated.’  
redirect\_to :action =\> ‘show’, :id =\> @event  
else  
flash[:notice] = ‘You do not have permission to edit.’  
redirect\_to :action =\> ‘list’  
end  
end

def destroy  
@event = Event.find(params[:id])  
if @event.user\_id == session[:user]  
@event.destroy  
redirect\_to :action =\> ‘list’  
flash[:notice] = ‘Event was deleted.’  
else  
flash[:notice] = ‘You do not own this event.’  
redirect\_to :action =\> ‘list’  
end  
end

What I would like to do is extract the “if @event.user\_id ==  
session[:user]” kind of verification from controllers since I can  
imagine calling this a lot as I add more models with a variety of  
permissions?

Is there a better strategy to approach this?

Sam

---

<div class="post-metadata">

**Author:** ![SBSBSB](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ecccb3/32.png) [@SBSBSB](https://www.ruby-forum.com/u/SBSBSB)\
**Post date:** [February 21, 2006, 8:35pm UTC](https://www.ruby-forum.com/t/abstracting-ownership-verification-out-of-controller/71257/2 "2006-02-21T20:35:35Z")

</div>

On Tue, 21 Feb 2006 22:06:06 +0900, SB wrote:

> Right now I have a controller for “events” that belong to a specific  
> user. I only want the creator to be able to edit or delete the event.

Seems like Bill K.'s brand-new authorization DSL will help you, once  
somebody writes an implementation including permit\_set:

[http://www.billkatz.com/authorization](http://www.billkatz.com/authorization)

Jay L.

---

<div class="post-metadata">

**Author:** ![SBSBSB](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ecccb3/32.png) [@SBSBSB](https://www.ruby-forum.com/u/SBSBSB)\
**Post date:** [February 21, 2006, 9:37pm UTC](https://www.ruby-forum.com/t/abstracting-ownership-verification-out-of-controller/71257/3 "2006-02-21T21:37:40Z")

</div>

Sam-

```
Are you storing the whole user object in the session or just the

```

user.id? If you have the whole user object in thereyou can do it like  
this instead to limit the fin and update to the user who is owner:

@event = session[:user].events.find(params[:id])

```
What that will do is add this to your where clause in :conditions :

```

AND user\_id = whatever the session[:user].id is

If you dont have the user object in the session and just the id then  
you can have a method set up that sets the current\_user up:

def current\_user  
User.find(session[:user])  
end

And then you would do your Event finder like this:

@event = current\_user.events.find(params[:id])

Hope that helps

-Ezra

On Feb 21, 2006, at 5:06 AM, SB wrote:

> ugly (but it works).  
> flash[:notice] = ‘You do not have permission to edit.’  
> else
> 
> Is there a better strategy to approach this?
> 
> Sam
> 
> * * *
> 
> Rails mailing list  
> removed\_email\_address@domain.invalid  
> [http://lists.rubyonrails.org/mailman/listinfo/rails](http://lists.rubyonrails.org/mailman/listinfo/rails)

-Ezra Z.  
Yakima Herald-Republic  
WebMaster

> **[yakimaherald.com | Yakima, Washington - We Tell Your Stories](https://www.yakimaherald.com/)**

509-577-7732  
removed\_email\_address@domain.invalid

---

<div class="post-metadata">

**Author:** ![SBSBSB](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ecccb3/32.png) [@SBSBSB](https://www.ruby-forum.com/u/SBSBSB)\
**Post date:** [February 22, 2006, 5:56am UTC](https://www.ruby-forum.com/t/abstracting-ownership-verification-out-of-controller/71257/4 "2006-02-22T05:56:35Z")

</div>

Thank you all for the helpful suggestions, it definitely set me in the  
right direction.  
Yes, I did read all the resources suggested and it certainly gives me  
an indication of what’s ahead.

I ended up using “before\_filter” to accomplish this. Right now it’s  
right in the controller but if it crops up in other controllers, I  
might try to get it into “application.rb”.

Since I’m building up from scratch, I’d rather keep dependency on  
libraries and plugins to a minimum since I need to learn rails at the  
same time rather than rush something out the door or read third party  
code that’s beyond me.

One thing that throws me off with plugins, is that any given plugin  
might represent a couple styles of coding. This can be confusing for  
a beginner.

Here’s how I rewrote my code:

before\_filter :verify\_permission, :only =\> [:edit, :update, :destroy]

def update  
if @event.update\_attributes(params[:event])  
flash[:notice] = ‘Event was successfully updated.’  
redirect\_to :action =\> ‘show’, :id =\> @event  
else  
redirect\_to :action =\> ‘list’  
end  
end

def destroy  
@event.destroy  
redirect\_to :action =\> ‘list’  
flash[:notice] = ‘Event was deleted.’  
end

private  
def verify\_permission  
@event = Event.find(params[:id])  
if @event.user\_id == session[:user]  
return true  
else  
flash[:notice] = ‘You do not have permission for this event.’  
redirect\_to :action =\> ‘list’  
end  
end

Basically, I restored “update” and “destroy” to what it was before  
only taking out “@event = Event.find(params[:id])” since it was now  
part of “verify\_permissions”.

It gives me a warm feeling to post something on this list before bed  
and wake up to see responses. Now I know how the shoemaker felt when  
the elves came to the rescue.

And now for another session of solitary Subversion tag…

Sam

---

<div class="post-metadata">

**Author:** ![SBSBSB](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ecccb3/32.png) [@SBSBSB](https://www.ruby-forum.com/u/SBSBSB)\
**Post date:** [February 21, 2006, 11:22pm UTC](https://www.ruby-forum.com/t/abstracting-ownership-verification-out-of-controller/71257/5 "2006-02-21T23:22:15Z")

</div>

Hi !

2006/2/21, Ezra Z. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):

> ```
> Are you storing the whole user object in the session or just the
> 
> ```
> 
> user.id? If you have the whole user object in thereyou can do it like  
> this instead to limit the fin and update to the user who is owner:

This article on my blog might be interesting:  
[http://blog.teksol.info/articles/2005/10/21/model-serialization-in-session](http://blog.teksol.info/articles/2005/10/21/model-serialization-in-session)

Bye !

---

<div class="post-metadata">

**Author:** ![SBSBSB](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ecccb3/32.png) [@SBSBSB](https://www.ruby-forum.com/u/SBSBSB)\
**Post date:** [February 22, 2006, 8:58am UTC](https://www.ruby-forum.com/t/abstracting-ownership-verification-out-of-controller/71257/6 "2006-02-22T08:58:57Z")

</div>

On 2/21/06, Jay L. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> On Tue, 21 Feb 2006 22:06:06 +0900, SB wrote:
> 
> > Right now I have a controller for “events” that belong to a specific  
> > user. I only want the creator to be able to edit or delete the event.
> 
> Seems like Bill K.'s brand-new authorization DSL will help you, once  
> somebody writes an implementation including permit\_set:

Actually, the current plugin lets you handle Sam’s case pretty easily,  
even  
without permit\_set. The permission check would be handled by a  
user\_has\_role? method in the Event model class. We hardwire a  
‘moderator’  
role into the Event model.

class Event \< ActiveRecord::Base  
def user\_has\_role?( user, role )  
return true if role == ‘moderator’ and self.user\_id == user.id  
false  
end  
end

Then his controller looks like this:

class EventController \< ApplicationController  
permit “moderator of :event”, :only =\> [:edit, :update, :destroy]

def edit  
…  
end  
…  
end

This works because the “event” in the permission expression is checked  
against @event, any :event hash, and finally, if params[:id] is not nil,  
it  
uses Event.find(params[:id]). This is an added convention that  
facilitates  
standard use. I’ve just started working with Ezra on refining the  
authorization DSL, and we may decide to make things more explicit. But  
right  
now, the plugin at [http://www.billkatz.com/authorization](http://www.billkatz.com/authorization) will support  
authorizations like the above example.  
-Bill