# Adding 'author' functionality to UserEngine / RBAC roles

**URL:** <https://www.ruby-forum.com/t/adding-author-functionality-to-userengine-rbac-roles/62754>\
**Category:** Rails\
**Created:** [June 7, 2006, 9:00pm UTC](https://www.ruby-forum.com/t/adding-author-functionality-to-userengine-rbac-roles/62754 "2006-06-07T21:00:29Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![igrigorik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/e68b1a/32.png) [@igrigorik](https://www.ruby-forum.com/u/igrigorik)\
**Post date:** [June 7, 2006, 9:00pm UTC](https://www.ruby-forum.com/t/adding-author-functionality-to-userengine-rbac-roles/62754/1 "2006-06-07T21:00:29Z")

</div>

I’m trying to add / extend the default UserEngine schema  
(Guest/User/Admin) to support author only Update/Delete functions. At  
the moment, I allow ‘Guest’ to read/view all records, and User  
additionaly has access to create/edit/destroy, however this means that  
any registered user is able to modify any record.

My first thought was to add another filter in the chain after the  
UserEngine’s authorize\_action. So, I added:

prepend\_after\_filter :author\_permission, :except =\> [:show, …]

In my author\_permission i simply check a conditional:  
session[:user].id != @object.user\_id

And based on that output error messages etc. Now, this seems to work  
when I try to call ‘edit’ on an object, I get redirected and get my  
notification which says that I’m not an author, hence I can’t edit.  
However, destroy, which does not render anything seems to pass right  
through. So it seems like the action is performed right after  
:authorize\_action and :author\_permissions is not checked. Is there  
something I’m missing in the the filter chaining rules?

– Another thought that crossed my mind would be to add an ‘Author’ role  
in UserEngine, but then I’m not clear how to check the permissions.  
Would I have to create a ‘permission’ object for each ‘object’ that i  
try to protect and then assign them to an author role?

Any suggestions/pointers?

You can see my :author\_permissions @  
[http://rafb.net/paste/results/cv5XMC30.html](http://rafb.net/paste/results/cv5XMC30.html)

Cheers,  
Ilya