# Auto-populate authorization rights

**URL:** <https://www.ruby-forum.com/t/auto-populate-authorization-rights/82882>\
**Category:** Rails\
**Created:** [January 22, 2007, 2:40am UTC](https://www.ruby-forum.com/t/auto-populate-authorization-rights/82882 "2007-01-22T02:40:26Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![jspencer78](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/f14d63/32.png) [@jspencer78](https://www.ruby-forum.com/u/jspencer78)\
**Post date:** [January 22, 2007, 2:40am UTC](https://www.ruby-forum.com/t/auto-populate-authorization-rights/82882/1 "2007-01-22T02:40:26Z")

</div>

I have implemented the Role-Right authorization recipe in Rails Recipes  
(recipe 32), which works fine, but I’d like to auto-populate the Rights  
table with all the actions in my system … since the system is rather  
large. Doing it manually, from a administrative interface or the  
console, is going to be annoying … and it would have to be updated  
every time I change the number of actions …

I attempted to write a migration to find all my controllers, load each  
one, and call “Controller.public\_methods - Controller.hidden\_actions” to  
give me the actions defined in that controller, but for a controller  
with one action, it definitely doesn’t give me just one action back …  
check this out 😛

irb:001:0\> Admin::HomeController.public\_methods -  
Admin::HomeController.hidden\_actions  
=\> [“cattr\_writer”, “prepend\_before\_filter”,  
“reset\_inheritable\_attributes”, “const\_defined?”, “skip\_filter”,  
“depend\_on\_without\_deprecation”, “cattr\_accessor”, “included\_modules”,  
“attr\_internal\_writer”, “parent”, “const\_missing”, “before\_filter”,  
“inherited\_with\_action\_controller”, “prepend\_before\_invocation”,  
“helper\_method”, “attr\_internal\_accessor”, “before\_filters”,  
“web\_client\_api”, “class\_variables”, “class\_inheritable\_reader”,  
“include?”, “append\_after\_filter”, “model”, “verify”, “helper\_attr”,  
“name”, “attr\_internal”, “depend\_on”, “access\_control”, “after\_filters”,  
“cache\_sweeper”, “class\_inheritable\_writer”, “ancestors”,  
“attr\_internal\_naming\_format”, “reloadable?”, “yaml\_tag\_read\_class”,  
“require\_web\_service\_api”, “included\_actions”,  
“attr\_internal\_naming\_format=”, “register\_protocol”,  
“class\_inheritable\_array\_writer”, “prepend\_after\_filter”,  
“append\_after\_invocation”, “service”, “method\_defined?”,  
“deprecated\_method\_warning”, “excluded\_actions”, “deprecate”,  
“class\_inheritable\_hash\_writer”, “after\_filter”,  
“public\_method\_defined?”, “dependencies\_on”, “prepend\_after\_invocation”,  
“yaml\_tag\_subclasses?”, “delegate”, “class\_inheritable\_option”,  
“remove\_subclasses”, “web\_service\_api\_with\_require”,  
“uses\_component\_template\_root”, “find\_filter”, “view\_class”,  
“superclass”, “class\_inheritable\_accessor”, “silence”, “\<=\>”,  
“append\_around\_filter”, “caches\_page”, “web\_service\_api”,  
“private\_method\_defined?”, “\<”, “deprecation\_horizon”, “benchmark”,  
“\>=”, “\>”, “\<=”, “web\_service\_api\_without\_require”, “allocate”,  
“class\_inheritable\_array”, “hidden\_actions”,  
“protected\_method\_defined?”, “model\_with\_deprecation”,  
“before\_invocation\_interceptors”, “filter\_excluded\_from\_action?”,  
“public\_class\_method”, “parents”, “action\_methods”, “subclasses”,  
“session\_store”, “class\_inheritable\_hash”, “hide\_action”,  
“add\_web\_service\_api\_callback”, “model\_without\_deprecation”,  
“after\_invocation\_interceptors”, “session\_store=”, “instance\_methods”,  
“uses\_component\_template\_root\_with\_deprecation”, “private\_class\_method”,  
“included\_in\_classes”, “view\_root”, “inherited”,  
“cached\_session\_options”, “inheritable\_attributes”,  
“prepend\_around\_filter”, “filter\_parameter\_logging”,  
“service\_with\_deprecation”, “included\_intercepted\_methods”,  
“public\_instance\_methods”,  
“uses\_component\_template\_root\_without\_deprecation”, “module\_eval”,  
“as\_load\_path”, “remove\_class”, “observer”, “new”,  
“session\_options\_for”, “autoload”, “in\_place\_edit\_for\_model”,  
“around\_filter”, “caches\_action”, “web\_service”,  
“service\_without\_deprecation”, “excluded\_intercepted\_methods”,  
“protected\_instance\_methods”, “auto\_complete\_for”, “class\_eval”,  
“alias\_method\_chain”, “yaml\_as”, “scaffold”, “js\_list\_for”,  
“write\_inheritable\_attribute”, “fragment\_cache\_store=”,  
“skip\_before\_filter”, “observer\_with\_deprecation”, “layout”,  
“private\_instance\_methods”, “rails\_original\_const\_missing”,  
“append\_before\_filter”, “autoload?”, “mattr\_reader”, “js\_generate\_code”,  
“write\_inheritable\_array”, “observer\_without\_deprecation”, “constants”,  
“instance\_method”, “process\_with\_exception”, “append\_before\_invocation”,  
“has\_web\_service?”, “method\_added”, “mattr\_writer”, “layout\_conditions”,  
“web\_services”, “dependencies\_on\_with\_deprecation”, “const\_get”,  
“in\_place\_edit\_for”, “web\_service\_scaffold”, “cattr\_reader”,  
“yaml\_tag\_class\_name”, “helper”, “mattr\_accessor”,  
“read\_inheritable\_attribute”, “skip\_after\_filter”,  
“add\_web\_service\_definition\_callback”,  
“dependencies\_on\_without\_deprecation”, “const\_set”, “alias\_attribute”,  
“session\_options”, “add\_template\_helper”, “attr\_internal\_reader”,  
“write\_inheritable\_hash”, “default\_layout”, “exempt\_from\_layout”,  
“depend\_on\_with\_deprecation”]

Now these are definitely not the actions my controller is capable of  
responding to … is there any way to find out exactly what actions a  
controller responds to?. Any ideas? If this is the wrong approach, any  
suggestions on another? Anything obvious I’m missing?

~Jimmy

---

<div class="post-metadata">

**Author:** ![jspencer78](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/f14d63/32.png) [@jspencer78](https://www.ruby-forum.com/u/jspencer78)\
**Post date:** [January 22, 2007, 3:38am UTC](https://www.ruby-forum.com/t/auto-populate-authorization-rights/82882/2 "2007-01-22T03:38:27Z")

</div>

> Any ideas? If this is the wrong approach, any  
> suggestions on another? Anything obvious I’m missing?
> 
> ~Jimmy

Ok, I came up with a semi-suitable solution. Since I’m not turning this  
on yet, I stuck this in my ApplicationController to store rights as the  
system handles actions:

before\_filter :store\_right

def store\_right  
Right.find\_or\_create\_by\_name\_and\_controller\_and\_action(controller\_name

- " - " + action\_name, controller\_path, action\_name)  
end

Of course, not perfect … since my migrations don’t capture this data  
… and it doesn’t ensure that all actions are represented. So, I’m  
looking for a solution better than this 🙂

~Jimmy

---

<div class="post-metadata">

**Author:** ![jspencer78](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/f14d63/32.png) [@jspencer78](https://www.ruby-forum.com/u/jspencer78)\
**Post date:** [January 22, 2007, 4:12am UTC](https://www.ruby-forum.com/t/auto-populate-authorization-rights/82882/3 "2007-01-22T04:12:47Z")

</div>

James Schementi wrote:

> –  
> Posted via [http://www.ruby-forum.com/](http://www.ruby-forum.com/).

The user\_engine has a rake task that basically does this.

However… I have found that unless you really expect that the roles  
and permissions will be changing a lot, that the database approach to  
this is 1) slower, because of the extra queries required, 2) a royal  
PITA, precisely because it is so sensitive to the database setup.

I’d consider hard wiring in the roles and authorization. This is  
faster and it’s easy to see at a glance through the source code, which  
roles should be able to access which actions.

\_Kevin

---

<div class="post-metadata">

**Author:** ![jspencer78](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/f14d63/32.png) [@jspencer78](https://www.ruby-forum.com/u/jspencer78)\
**Post date:** [January 22, 2007, 4:50am UTC](https://www.ruby-forum.com/t/auto-populate-authorization-rights/82882/4 "2007-01-22T04:50:50Z")

</div>

This will give you the difference between a controller and its parent:  
Admin::HomeController.public\_instance\_methods -  
HomeController.public\_instance\_methods

BUT (there has to be one), if the parent controller has a method of the  
same name it will not be listed - so the array may be incomplete…

---

<div class="post-metadata">

**Author:** ![jspencer78](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/f14d63/32.png) [@jspencer78](https://www.ruby-forum.com/u/jspencer78)\
**Post date:** [January 23, 2007, 8:56am UTC](https://www.ruby-forum.com/t/auto-populate-authorization-rights/82882/5 "2007-01-23T08:56:13Z")

</div>

James Schementi wrote:

> I have implemented the Role-Right authorization recipe in Rails Recipes  
> (recipe 32), which works fine, but I’d like to auto-populate the Rights  
> table with all the actions in my system … since the system is rather…

I have a piece of code that does exactly that at the end of this  
article…

[http://blog.wolfman.com/articles/2006/05/20/role-based-authentication-admin-page](http://blog.wolfman.com/articles/2006/05/20/role-based-authentication-admin-page)

–  
Jim M., [http://blog.wolfman.com](http://blog.wolfman.com)

---

<div class="post-metadata">

**Author:** ![jspencer78](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/f14d63/32.png) [@jspencer78](https://www.ruby-forum.com/u/jspencer78)\
**Post date:** [January 22, 2007, 4:16pm UTC](https://www.ruby-forum.com/t/auto-populate-authorization-rights/82882/6 "2007-01-22T16:16:27Z")

</div>

hello,  
you can use a rake task to pre-populate your database from fixture  
files. There are a few reference tables in my system that rarely  
change (but are too large to hardcode…be careful of that route; it  
can also be very brittle), so this works really well for me.  
[http://pastie.caboo.se/34809](http://pastie.caboo.se/34809)

Adam

---

<div class="post-metadata">

**Author:** ![jspencer78](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/f14d63/32.png) [@jspencer78](https://www.ruby-forum.com/u/jspencer78)\
**Post date:** [January 31, 2007, 11:22pm UTC](https://www.ruby-forum.com/t/auto-populate-authorization-rights/82882/7 "2007-01-31T23:22:15Z")

</div>

Jimmy,  
The public\_methods method will give you everything in the inheritance  
chain. If you want to look at just the methods defined for the current  
class, you could explicitly remove every method that is in the parent  
class, presumably ApplicationController.

You might also want to look at my Authorization plugin:  
[http://www.writertopia.com/developers/authorization](http://www.writertopia.com/developers/authorization)

The plugin allows class-level permits in a fashion similar to  
before\_filter.  
-Bill