# Factories, Authentication, and Roles, oh my!

**URL:** <https://www.ruby-forum.com/t/factories-authentication-and-roles-oh-my/181146>\
**Category:** Rails\
**Created:** [January 6, 2010, 10:18am UTC](https://www.ruby-forum.com/t/factories-authentication-and-roles-oh-my/181146 "2010-01-06T10:18:41Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Curtis\_C](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/ea5d25/32.png) [@Curtis\_C](https://www.ruby-forum.com/u/Curtis_C)\
**Post date:** [January 6, 2010, 10:18am UTC](https://www.ruby-forum.com/t/factories-authentication-and-roles-oh-my/181146/1 "2010-01-06T10:18:41Z")

</div>

I’m pretty new to rails, but I’ve had many years programming in Java.  
What I’m looking to find is the rails way of implementing some clean  
way of controlling what the user sees based on the user’s role.

The Rails Recipes book has a nice clean implementation of user roles  
and I’ve implemented that. What I want to avoid is stuff like

\<% if user.admin? %\>  
show admin stuff  
\<% else %\>  
show normal user stuff  
\<% end %\>

all over my code. I can think of a couple of ways to do it, but I feel  
like I’d be reinventing the wheel and someone certainly has cracked  
this nut and at least blogged it some where.

I’ve tried some Google searches, but it’s a hard problem to define in  
few enough words to get good results.

Anyone know of any good references for this problem?

---

<div class="post-metadata">

**Author:** ![Curtis\_C](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/ea5d25/32.png) [@Curtis\_C](https://www.ruby-forum.com/u/Curtis_C)\
**Post date:** [January 6, 2010, 2:56pm UTC](https://www.ruby-forum.com/t/factories-authentication-and-roles-oh-my/181146/2 "2010-01-06T14:56:05Z")

</div>

Well, the purpose of Helpers is to keep your views nice and DRY, so you  
could make some helpers with common code that comes up because of this,  
that  
takes a user.

Your helpers still end up looking like this, though, so it’s not super  
ideal, but you’ve at least pushed the ugly down as far as possible. I  
haven’t found a better solution than that.

---

<div class="post-metadata">

**Author:** ![Curtis\_C](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/ea5d25/32.png) [@Curtis\_C](https://www.ruby-forum.com/u/Curtis_C)\
**Post date:** [January 7, 2010, 1:16am UTC](https://www.ruby-forum.com/t/factories-authentication-and-roles-oh-my/181146/3 "2010-01-07T01:16:02Z")

</div>

You can use a gem called declarative\_authorization to clean this up  
nicely. Its an implementation of rbac (role based access control for non  
security types), which I’m pretty sure is what you need, … You can do:

If has\_role(:admin?)  
Show admin stuff  
-or-  
If permitted\_to(:show, @stuff)  
Show admin stuff

Sent via BlackBerry by AT&T

---

<div class="post-metadata">

**Author:** ![Curtis\_C](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/ea5d25/32.png) [@Curtis\_C](https://www.ruby-forum.com/u/Curtis_C)\
**Post date:** [January 7, 2010, 6:46pm UTC](https://www.ruby-forum.com/t/factories-authentication-and-roles-oh-my/181146/4 "2010-01-07T18:46:49Z")

</div>

is there a way to combine those think with field-level security? i  
think i saw once a plugin, but didnt need it at that time.  
thx