# Managing user accounts and data records

**URL:** <https://www.ruby-forum.com/t/managing-user-accounts-and-data-records/158991>\
**Category:** Rails\
**Created:** [January 30, 2009, 3:52am UTC](https://www.ruby-forum.com/t/managing-user-accounts-and-data-records/158991 "2009-01-30T03:52:50Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![magic6435](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/57b2e6/32.png) [@magic6435](https://www.ruby-forum.com/u/magic6435)\
**Post date:** [January 30, 2009, 3:52am UTC](https://www.ruby-forum.com/t/managing-user-accounts-and-data-records/158991/1 "2009-01-30T03:52:50Z")

</div>

Hi,  
I am looking for a simple way to implement a form of “data ownership”  
in a Rails application. Basically, I’d like for users / accounts to  
only be able to view or operate on model data that they have created  
themselves and to not have any sort of awareness of the data created  
by other users / accounts.

My initial thought is that I will need something like account\_id on  
all of the models and each request will check that the searched for  
model id is owned by the currently authenticated account. Has anyone  
done anything like this and is there a simpler way?

Thanks

---

<div class="post-metadata">

**Author:** ![magic6435](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/57b2e6/32.png) [@magic6435](https://www.ruby-forum.com/u/magic6435)\
**Post date:** [January 30, 2009, 6:56am UTC](https://www.ruby-forum.com/t/managing-user-accounts-and-data-records/158991/2 "2009-01-30T06:56:31Z")

</div>

Google model scoping.

Basically you get:

For ‘dogs’ list your list action

You hve a before filter to authorize and set the logged in user then:

logged\_in\_user.dogs

The show action has:

logged\_in\_user.dogs.find(params[:id])

That way people can’t look up the wrong records

Sent from my iPhone