# May a model know about the "outside world"?

**URL:** <https://www.ruby-forum.com/t/may-a-model-know-about-the-outside-world/117749>\
**Category:** Rails\
**Created:** [October 19, 2007, 9:59pm UTC](https://www.ruby-forum.com/t/may-a-model-know-about-the-outside-world/117749 "2007-10-19T21:59:18Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![josh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/45deac/32.png) [@josh](https://www.ruby-forum.com/u/josh)\
**Post date:** [October 19, 2007, 9:59pm UTC](https://www.ruby-forum.com/t/may-a-model-know-about-the-outside-world/117749/1 "2007-10-19T21:59:18Z")

</div>

Hi all

Most of my models have the attribute creator\_id which is a foreign key  
to a member. Also many have the attribute owner\_id, which is a foreign  
key to a member, too.

When being created, both attributes (if available) should get the ID of  
the currently logged in member.

To implement this, I could “just” send the currently logged in member’s  
ID to the model:

@my\_model = MyModel.new(params[:my\_model])  
@my\_model.creator = logged\_in\_member  
@my\_model.owner = logged\_in\_member  
@my\_model.save

Another way would be to leave it to the model itself to take care of  
this, because when creating a new instance of it _always_ a member is  
logged in, so the model could somehow get the logged\_in\_member itself.

But now, would this injure the MVC principle? As far is I know the model  
should not know anything about the “outside world”, right?

Or would you suggest a wholy different approach?

Thanks for your opinion  
Josh

---

<div class="post-metadata">

**Author:** ![josh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/45deac/32.png) [@josh](https://www.ruby-forum.com/u/josh)\
**Post date:** [October 19, 2007, 10:09pm UTC](https://www.ruby-forum.com/t/may-a-model-know-about-the-outside-world/117749/2 "2007-10-19T22:09:46Z")

</div>

How would the model know about the logged in user if you don’t specify?  
The  
model doesn’t have access to controller or session information.

A cleaner way would be:

logged\_in\_member.my\_models.create(params[:my\_model])

then in the MyModel#before\_save:

if self.owner.nil?  
self.owner = self.creator  
end

Jason

---

<div class="post-metadata">

**Author:** ![josh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/45deac/32.png) [@josh](https://www.ruby-forum.com/u/josh)\
**Post date:** [October 19, 2007, 10:09pm UTC](https://www.ruby-forum.com/t/may-a-model-know-about-the-outside-world/117749/3 "2007-10-19T22:09:47Z")

</div>

There’s a way to hack rails to make this happen. It violates every MVC  
convention known and is a horrible idea.

The best approach is to do what you suggested… set it in the  
controller.

---

<div class="post-metadata">

**Author:** ![josh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/45deac/32.png) [@josh](https://www.ruby-forum.com/u/josh)\
**Post date:** [October 19, 2007, 10:15pm UTC](https://www.ruby-forum.com/t/may-a-model-know-about-the-outside-world/117749/4 "2007-10-19T22:15:06Z")

</div>

Thank you both for your anwers. 🙂

---

<div class="post-metadata">

**Author:** ![josh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/45deac/32.png) [@josh](https://www.ruby-forum.com/u/josh)\
**Post date:** [October 19, 2007, 11:17pm UTC](https://www.ruby-forum.com/t/may-a-model-know-about-the-outside-world/117749/5 "2007-10-19T23:17:38Z")

</div>

On 10/19/07, Brian H. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> There’s a way to hack rails to make this happen. It violates every MVC  
> convention known and is a horrible idea.

Yikes!

I don’t think it’s such a horrible idea if implemented properly. I’m  
successfully using a slightly modified version of Bruce P.’  
ModelSecurity library quite successfully.

The very high-level idea is:

- The User model (or its equivalent) has a “current” method that  
returns a User object representing the currently logged-in user. All  
model code that needs to know the current user accesses User.current

- A before\_filter in ApplicationController assigns User.current

- Thread-local storage is used to hold the value, since globals aren’t  
thread-safe.