# Limiting who and see/update which record

**URL:** <https://www.ruby-forum.com/t/limiting-who-and-see-update-which-record/173613>\
**Category:** Rails\
**Created:** [August 12, 2009, 1:09am UTC](https://www.ruby-forum.com/t/limiting-who-and-see-update-which-record/173613 "2009-08-12T01:09:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![nik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/6de8d8/32.png) [@nik](https://www.ruby-forum.com/u/nik)\
**Post date:** [August 12, 2009, 1:09am UTC](https://www.ruby-forum.com/t/limiting-who-and-see-update-which-record/173613/1 "2009-08-12T01:09:47Z")

</div>

Hello, all,

Say I own a freelance article editing company that help my clients  
editing their articles to a certain standard. And my employees are  
editors. a Article Model, an Assignment Model, and then an Editor  
Model. Most of the time one article is edited by one Editor ( and this  
arrangement is called an Assignment). Sometimes, things get rushy and  
we put a few editors for one article.

so I guess I will have a many Editors to many Articles relationship by  
using the Has\_many :through =\> :assignments

class Editor \< ActiveRecord::Base  
has\_many :assignments  
has\_many :articles, :through =\> :assignments  
end

class Assignment \< ActiveRecord::Base  
belongs\_to :article  
belongs\_to :editor  
end

class Article \< ActiveRecord::Base  
has\_many :assignments  
has\_many :editors, :through =\> :assignments  
end

If I want only relevant editor(s) to see an article–relevant being  
defined as the editor(s) is assigned to that very artcile–and also to  
update that artcile, as needed for editing it, where would one put  
such a mechanism (ApplicationController / Model / elsewhere)? And how  
would such a mechanism work?

Thanks@

---

<div class="post-metadata">

**Author:** ![nik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/6de8d8/32.png) [@nik](https://www.ruby-forum.com/u/nik)\
**Post date:** [August 12, 2009, 3:04am UTC](https://www.ruby-forum.com/t/limiting-who-and-see-update-which-record/173613/2 "2009-08-12T03:04:30Z")

</div>

Nik wrote:  
[…]

> If I want only relevant editor(s) to see an article–relevant being  
> defined as the editor(s) is assigned to that very artcile–and also to  
> update that artcile, as needed for editing it, where would one put  
> such a mechanism (ApplicationController / Model / elsewhere)? And how  
> would such a mechanism work?

You might want to take a look at the rails\_authorization plugin.

> Thanks@

## Best,

Marnen Laibow-Koser  
[http://www.marnen.org](http://www.marnen.org)  
removed\_email\_address@domain.invalid

---

<div class="post-metadata">

**Author:** ![nik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/6de8d8/32.png) [@nik](https://www.ruby-forum.com/u/nik)\
**Post date:** [August 12, 2009, 7:44pm UTC](https://www.ruby-forum.com/t/limiting-who-and-see-update-which-record/173613/3 "2009-08-12T19:44:19Z")

</div>

Thanks Marnen, I will check it out.

On Aug 11, 9:04 pm, Marnen Laibow-Koser \<rails-mailing-l…@andreas-