# Authorization with RESTful\_ACL (index)

**URL:** <https://www.ruby-forum.com/t/authorization-with-restful-acl-index/158393>\
**Category:** Rails\
**Created:** [January 22, 2009, 9:13pm UTC](https://www.ruby-forum.com/t/authorization-with-restful-acl-index/158393 "2009-01-22T21:13:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jmfreitas](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e79b87/32.png) [@jmfreitas](https://www.ruby-forum.com/u/jmfreitas)\
**Post date:** [January 22, 2009, 9:13pm UTC](https://www.ruby-forum.com/t/authorization-with-restful-acl-index/158393/1 "2009-01-22T21:13:32Z")

</div>

I’m using the latest RESTful\_ACL plugin -

> **[GitHub - mdarby/restful\_acl: Rails gem/plugin that provides contextual access...](https://github.com/mdarby/restful_acl)**
>
> Rails gem/plugin that provides contextual access control to RESTful resources. - GitHub - mdarby/restful\_acl: Rails gem/plugin that provides contextual access control to RESTful resources.

- and so far it has fulfilled my app needs…  
I control the access to the several models depending on the user’s  
role and the REST action.  
Although, I have a question:

For example, imagine that I have an User, each User can have many  
Numbers, and each Number can have many Profiles.  
A User can only access his Numbers and hence only the Profiles  
associated with each of those Numbers he owns.

Imagine that I have an User 1, which owns the Number 1, which has a  
Profile 1.  
And there’s another User 2, which owns the Number 2, which has a  
Profile 2.

I can protect the access to a particular Number and Profile using  
self.is\_readable\_by(user. object). User 1 is successfully blocked when  
trying to access /numbers/2 and /numbers/2/profiles/2  
But I’m having problems finding a way to _not_ allow a User to access  
the index of Profiles for a Number that he doesn’t own.

How could I protect the User 1 from accessing the index of Profiles  
belonging to User 2? /numbers/2/profiles

---

<div class="post-metadata">

**Author:** ![jmfreitas](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e79b87/32.png) [@jmfreitas](https://www.ruby-forum.com/u/jmfreitas)\
**Post date:** [January 23, 2009, 2:18pm UTC](https://www.ruby-forum.com/t/authorization-with-restful-acl-index/158393/2 "2009-01-23T14:18:46Z")

</div>

Thanks for using RESTful\_ACL!

What you’re trying to do is simple with v2.0+:

class Profile \< ActiveRecord::Base  
logical\_parent :number

belongs\_to :number

# This method checks permissions for the :index action

def self.is\_indexable\_by(user, parent = nil)  
user.number == parent  
end

end

---

<div class="post-metadata">

**Author:** ![jmfreitas](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e79b87/32.png) [@jmfreitas](https://www.ruby-forum.com/u/jmfreitas)\
**Post date:** [January 23, 2009, 7:46pm UTC](https://www.ruby-forum.com/t/authorization-with-restful-acl-index/158393/3 "2009-01-23T19:46:34Z")

</div>

Jm Freitas wrote:

> Many thanks for the reply, issue solved!!!  
> Keep up with the good work 🙂

1. Awesome.
2. Thanks 😉

---

<div class="post-metadata">

**Author:** ![jmfreitas](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e79b87/32.png) [@jmfreitas](https://www.ruby-forum.com/u/jmfreitas)\
**Post date:** [January 23, 2009, 5:09pm UTC](https://www.ruby-forum.com/t/authorization-with-restful-acl-index/158393/4 "2009-01-23T17:09:07Z")

</div>

Many thanks for the reply, issue solved!!!  
Keep up with the good work 🙂