# Data from DB based on role

**URL:** <https://www.ruby-forum.com/t/data-from-db-based-on-role/163961>\
**Category:** Rails\
**Created:** [March 26, 2009, 2:19pm UTC](https://www.ruby-forum.com/t/data-from-db-based-on-role/163961 "2009-03-26T14:19:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![serpico](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/7feea3/32.png) [@serpico](https://www.ruby-forum.com/u/serpico)\
**Post date:** [March 26, 2009, 2:19pm UTC](https://www.ruby-forum.com/t/data-from-db-based-on-role/163961/1 "2009-03-26T14:19:46Z")

</div>

I’m creating a rails app requiring an ACL system to grant different  
priviledges to users, but I have some doubts on how to structure it.

Right now I have three users: Administrator \> Area manager \> Employee

I’m able to distinguish between users and block certain actions or  
controllers based on the role. What I don’t get is how to manage in a  
clean way situations where different kind of users access the same  
action, but have to display and get different data from the database.

Example:

An employee has\_many :documents , and in the index action of the  
documents\_controller I have to get HIS documents (something like  
current\_user.documents), but an area manager accessing the same action  
has to get ALL the documents (Document.find(:all))

I can’t think of a clean way to implement this avoiding conditions in  
the controller like “if the user is a X, find(something) else  
find(something else)”

Thanks in adavance for your suggestions

---

<div class="post-metadata">

**Author:** ![serpico](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/7feea3/32.png) [@serpico](https://www.ruby-forum.com/u/serpico)\
**Post date:** [March 26, 2009, 3:30pm UTC](https://www.ruby-forum.com/t/data-from-db-based-on-role/163961/2 "2009-03-26T15:30:37Z")

</div>

You’ll have to scope the find at some point, and if this requirement is  
really pervasive, I’d recommend creating a find\_using\_role\_or\_id method  
(or something like that) which at least lets you write and maintain that  
“find scoping” code in a single place, not in every controller’s index  
method.

Patch it in to ActiveRecord, or create an abstract class that sits  
between ActiveRecord and the rest of your models and implements the  
method.

---

<div class="post-metadata">

**Author:** ![serpico](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/7feea3/32.png) [@serpico](https://www.ruby-forum.com/u/serpico)\
**Post date:** [March 26, 2009, 3:35pm UTC](https://www.ruby-forum.com/t/data-from-db-based-on-role/163961/3 "2009-03-26T15:35:20Z")

</div>

Ar Chron wrote:

> You’ll have to scope the find at some point, and if this requirement is  
> really pervasive, I’d recommend creating a find\_using\_role\_or\_id method  
> (or something like that) which at least lets you write and maintain that  
> “find scoping” code in a single place, not in every controller’s index  
> method.
> 
> Patch it in to ActiveRecord, or create an abstract class that sits  
> between ActiveRecord and the rest of your models and implements the  
> method.

Thanks for your reply. It’s a good suggestion, but in fact the scope is  
not limited to the find, sometimes I have to perform some code in the  
controller not related to AR but different from user to user.

In the past in thos situations I used to create a different namespace  
for every user, with shared views, but this has the disadvantage to have  
a lot of controllers which are really similar