# How to have users who can only view his/her own stuff

**URL:** <https://www.ruby-forum.com/t/how-to-have-users-who-can-only-view-his-her-own-stuff/140343>\
**Category:** Rails\
**Created:** [June 13, 2008, 2:33am UTC](https://www.ruby-forum.com/t/how-to-have-users-who-can-only-view-his-her-own-stuff/140343 "2008-06-13T02:33:00Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![nik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/6de8d8/32.png) [@nik](https://www.ruby-forum.com/u/nik)\
**Post date:** [June 13, 2008, 2:33am UTC](https://www.ruby-forum.com/t/how-to-have-users-who-can-only-view-his-her-own-stuff/140343/1 "2008-06-13T02:33:00Z")

</div>

I know that it is better to have codes when asking questions here, but  
I have none, which is kind of why I am asking.

I want to make a to-do list for my friends and family, I learned from  
the Agile Development With Rails to make an administrator login. But I  
don’t seem to be able to figure out how to create users each of which  
is restricted to view his or her own pages within the application.

Is there any tutorials/book on this?

Thank You

---

<div class="post-metadata">

**Author:** ![nik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/6de8d8/32.png) [@nik](https://www.ruby-forum.com/u/nik)\
**Post date:** [June 13, 2008, 2:43am UTC](https://www.ruby-forum.com/t/how-to-have-users-who-can-only-view-his-her-own-stuff/140343/2 "2008-06-13T02:43:32Z")

</div>

On 13 Jun 2008, at 01:32, Nik wrote:

> I know that it is better to have codes when asking questions here, but  
> I have none, which is kind of why I am asking.
> 
> I want to make a to-do list for my friends and family, I learned from  
> the Agile Development With Rails to make an administrator login. But I  
> don’t seem to be able to figure out how to create users each of which  
> is restricted to view his or her own pages within the application.

Slightly open ended question, but if you’re asking what I think you  
are then typically you just let the association methods do the work  
for you. Eg if User has\_many :foos then instead of using  
Foo.find :all, use some\_user.foos.find :all, which guarantees that you  
will only ever get things belonging to that user (it behaves like a  
regular find apart from that, so you can pass conditions, a specific  
id etc…)

Fred

---

<div class="post-metadata">

**Author:** ![nik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/6de8d8/32.png) [@nik](https://www.ruby-forum.com/u/nik)\
**Post date:** [June 13, 2008, 3:01am UTC](https://www.ruby-forum.com/t/how-to-have-users-who-can-only-view-his-her-own-stuff/140343/3 "2008-06-13T03:01:40Z")

</div>

On Jun 12, 2008, at 5:42 PM, Frederick C. wrote:

> > is restricted to view his or her own pages within the application.
> 
> Slightly open ended question, but if you’re asking what I think you  
> are then typically you just let the association methods do the work  
> for you. Eg if User has\_many :foos then instead of using  
> Foo.find :all, use some\_user.foos.find :all, which guarantees that you  
> will only ever get things belonging to that user (it behaves like a  
> regular find apart from that, so you can pass conditions, a specific  
> id etc…)

For more on that line of thought…

[http://www.therailsway.com/reference](http://www.therailsway.com/reference)  
[http://jamesgolick.com/2008/2/11/an-introduction-to-association-proxy](http://jamesgolick.com/2008/2/11/an-introduction-to-association-proxy)

– gw

---

<div class="post-metadata">

**Author:** ![nik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/6de8d8/32.png) [@nik](https://www.ruby-forum.com/u/nik)\
**Post date:** [June 13, 2008, 9:03am UTC](https://www.ruby-forum.com/t/how-to-have-users-who-can-only-view-his-her-own-stuff/140343/4 "2008-06-13T09:03:08Z")

</div>

Hi

I will just explain u with simple basic logic…When u want to restrict  
the page or make something available to the related user only u can  
easily give user restriction…

each and every user have their own id…So first u can fetch the id of  
the user that has logged in and after that u can check in the user table  
whose id is that…

once u have completed that work u just need to fire a query which will  
display all the tast where user = to the current user who has logged  
in…

this is the simple login which can be easily translated into code…even  
with the basic rails knowlege

Thanks

Dhaval P.  
Software Engineer

> **[RailsHouse : Ruby on Rails Development & Consulting, Waterloo, Canada](https://railshouse.com)**
>
> RailsHouse is Waterloo, Ontario based Ruby on Rails Consultancy firm which provides RoR Development, Migration, Staffing, Maintenace and Support Services

sales(AT)railshouse(DOT)com

---

<div class="post-metadata">

**Author:** ![nik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/6de8d8/32.png) [@nik](https://www.ruby-forum.com/u/nik)\
**Post date:** [June 16, 2008, 5:18pm UTC](https://www.ruby-forum.com/t/how-to-have-users-who-can-only-view-his-her-own-stuff/140343/5 "2008-06-16T17:18:19Z")

</div>

> I have thought about the limiting all tasks found according to the  
> logged-in user ID, hence  
> @errands = Errand.find(:all, :condition =\>‘user\_id =?’,‘logged\_in\_id’)
> 
> But is this better(?):  
> @errands = User(logged\_in\_id).errands?

you mean

> @errands = User.find(logged\_in\_id).errands?

which is the better one.  
Only that most people would either use a plugin for the login stuff or  
at least  
put that in helpers and before\_filters

something like:

def current\_login  
@current\_login ||= Login.find(session[:login]) if session[:login]  
end

in application.rb

then  
current\_login.errands

or whatever you look for.  
From security view it’s all the same, as long as you  
make sure only to list errands that have the user\_id of the logged in  
user  
(And this must be the one stored in the session after authentication,  
no id that comes from the browser)  
The association like thing current\_login.errands is just more Ruby  
like  
and better to read.

---

<div class="post-metadata">

**Author:** ![nik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/6de8d8/32.png) [@nik](https://www.ruby-forum.com/u/nik)\
**Post date:** [June 16, 2008, 4:58pm UTC](https://www.ruby-forum.com/t/how-to-have-users-who-can-only-view-his-her-own-stuff/140343/6 "2008-06-16T16:58:25Z")

</div>

My most sincere thanks to you all.

All GREAT!. And they will serve me to unveil the eventual codes that  
will get me to the target functionality.

I have thought about the limiting all tasks found according to the  
logged-in user ID, hence  
@errands = Errand.find(:all, :condition =\>‘user\_id =?’,‘logged\_in\_id’)

But is this better(?):  
@errands = User(logged\_in\_id).errands?

I mean, they fetch the same errands, but security-wise, which would  
you prefer and if it is not too much trouble, why?

Hope you had a nice weekend!  
And really, thanks so much for writing back! If you’re in Berlin, let  
me buy you a bier.

All my best,

On Jun 13, 9:03 am, Dhaval P. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![nik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/6de8d8/32.png) [@nik](https://www.ruby-forum.com/u/nik)\
**Post date:** [June 26, 2008, 4:48pm UTC](https://www.ruby-forum.com/t/how-to-have-users-who-can-only-view-his-her-own-stuff/140343/7 "2008-06-26T16:48:48Z")

</div>

Sure, that’s a has\_and\_belongs\_to\_many thing then.  
This can be done two ways.  
The simple one (needs no model):  
create a relation table named users\_tasks which contains user\_id and  
task\_id

Users model:  
has\_and\_belongs\_to\_many :tasks

Tasks model:  
has\_and\_belongs\_to\_many :users

Then you can use all the common functions  
@user.tasks \<\< Task.new(…params…)  
@user.tasks.each do |task|…  
and so on

Disadvantage of this approach is, that you can’t store more  
information  
in the intermediate table and can’t access it in other ways, since it  
has no  
model of it’s own.  
Lots of Rails programmers (if not most) go another way, slightly more  
work to setup, but with more options:

Create a model name UserTasks (columns: id, user\_id, :task\_id and  
whatever information you may need), then  
User model:  
has\_many :user\_tasks  
has\_many :tasks :through :user\_tasks

Task:  
has\_many :user\_tasks  
has\_many :users :through :user\_tasks

UserTasks:  
belongs\_to :user  
belongs\_to :task

The tricky part (ok, not so tricky) is the through option which  
defines  
relations over the intermediate table, so in the end you can again do  
@user.tasks  
and get them all

---

<div class="post-metadata">

**Author:** ![nik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/6de8d8/32.png) [@nik](https://www.ruby-forum.com/u/nik)\
**Post date:** [June 26, 2008, 4:26pm UTC](https://www.ruby-forum.com/t/how-to-have-users-who-can-only-view-his-her-own-stuff/140343/8 "2008-06-26T16:26:29Z")

</div>

Thanks for your help Thorsten, – I was on a 25 hour day schedule and  
put off this until today. — I used the “login system” provided as an  
example in the book Agile Web D. with Rails. I think it works  
okay so far.

May I ask one more (tougher) question?

Well, my co-worker and I were to work on this Macro for the office, so  
I added a task in my own account, but it 'd be great if she can see  
it, too, in her account. So it’s sort of like collaborating, but of  
course, this is just a piece of read-only information to ‘collaborate’  
on. So now, I have this One User Can Have Many Tasks, AND One Task Can  
Belong To Multiple Users thing. Is there an easy way to pull this off?

Thank You !  
Merci!  
Danke!  
Nik