# Help with object level roles & permissions

**URL:** <https://www.ruby-forum.com/t/help-with-object-level-roles-permissions/136913>\
**Category:** Rails\
**Created:** [May 7, 2008, 11:03am UTC](https://www.ruby-forum.com/t/help-with-object-level-roles-permissions/136913 "2008-05-07T11:03:13Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![chunkyslink](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/f0a364/32.png) [@chunkyslink](https://www.ruby-forum.com/u/chunkyslink)\
**Post date:** [May 7, 2008, 11:03am UTC](https://www.ruby-forum.com/t/help-with-object-level-roles-permissions/136913/1 "2008-05-07T11:03:13Z")

</div>

I have an authentication system set up via the activefx tutorial for  
restful\_authentication. I now need to implement roles and permissions on  
a per object basis, as opposed to site wide, ‘Is this user an  
administrator?’, permissions.

There are two types of objects, Groups and Channels, and they each have  
one Admin, many Notables, and many Members. I’m presuming it could be  
bad to mix my site wide roles/permissions in with the Group & Channel  
roles/permissions, although it could potentially keep things tidier if  
my Roles table simply has Administrator, Notable, Member (for Site,  
Group, Channel objects) and then the Permissions table handles what has  
been assigned to Site, Groups or Channels. In fact, I’ve just been  
testing this approach via a polymorphic association in the Permissions  
table so that the Groups and Channels are Permissionable (the  
Permissions table has role\_id, user\_id, permissionable\_id,  
permissionable\_type). However, calling a has\_many through on the  
permissionable polymorphic association seems to be causing problems (I  
just keep getting an error message from AR telling me I cannot have a  
has\_many :through association on the polymorphic object).

Firstly, do I need to avoid mixing site permissions in with object  
permissions? If so, do I differentiate between the two, maybe by keeping  
site permissions in the Permissions table, and keeping object  
permissions in a new Memberships table (this is a naming convention that  
I’d be happy with). Secondly, is it going to be possible to use a  
Permissionable polymorphic assocation on the object permissions, or do I  
just want to create separate group\_permissions and channel\_permissions  
tables to avoid any issues with a has\_many through on the polymorphic  
association?

---

<div class="post-metadata">

**Author:** ![chunkyslink](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/f0a364/32.png) [@chunkyslink](https://www.ruby-forum.com/u/chunkyslink)\
**Post date:** [September 18, 2008, 11:09am UTC](https://www.ruby-forum.com/t/help-with-object-level-roles-permissions/136913/2 "2008-09-18T11:09:12Z")

</div>

I would separate it… keep the roles and permission you have with  
activefx’s tutorial. Then your

group or channel  
has\_one :administrator,   
has\_many :notables,   
has\_many :members, :through =\> :memberships,   
has\_many :memberships

Maybe even the membership model can contain what capacity the user is  
in the group? This just popped into my head now… not too sure if  
this would work. Sounds okay though.

On Wed, May 7, 2008 at 5:03 PM, Neil C.  
[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> my Roles table simply has Administrator, Notable, Member (for Site,  
> Firstly, do I need to avoid mixing site permissions in with object
> 
> >

–  
Ramon T.

---

<div class="post-metadata">

**Author:** ![chunkyslink](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/f0a364/32.png) [@chunkyslink](https://www.ruby-forum.com/u/chunkyslink)\
**Post date:** [September 18, 2008, 12:23pm UTC](https://www.ruby-forum.com/t/help-with-object-level-roles-permissions/136913/3 "2008-09-18T12:23:00Z")

</div>

Ramon T. wrote:

> I would separate it… keep the roles and permission you have with  
> activefx’s tutorial. Then your
> 
> group or channel  
> has\_one :administrator,   
> has\_many :notables,   
> has\_many :members, :through =\> :memberships,   
> has\_many :memberships
> 
> Maybe even the membership model can contain what capacity the user is  
> in the group? This just popped into my head now… not too sure if  
> this would work. Sounds okay though.
> 
> On Wed, May 7, 2008 at 5:03 PM, Neil C.  
> [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:
> 
> > my Roles table simply has Administrator, Notable, Member (for Site,  
> > Firstly, do I need to avoid mixing site permissions in with object
> > 
> > >
> 
> –  
> Ramon T.

Thanks, Ramon. This is quite an old post - I’ve been happily working  
along with permissions for a while now. In fact, right now, I’m  
integrating per-permission notifications options, whereby a user can  
specify which activities they want to be notified about (email) on a  
per-group basis.

If you’re interested, I posted a question about notifications &  
named\_scopes, in Railsforum a couple of minutes ago. I’ve since found a  
solution for the first question, but, I know there’s room for  
improvement;

[http://railsforum.com/viewtopic.php?id=22509](http://railsforum.com/viewtopic.php?id=22509)

Also, my friend Ryan, from [ThinkRefresh.com](http://ThinkRefresh.com), made a screencast about  
polymorphic permissions after I posed the same question to him;

[http://thinkrefresh.com/posts/7/polymorphic-permissions](http://thinkrefresh.com/posts/7/polymorphic-permissions)

Maybe that’ll help anyone else who comes across this post…