# Need help with n\<-\>n authorization

**URL:** <https://www.ruby-forum.com/t/need-help-with-n-n-authorization/166194>\
**Category:** Rails\
**Created:** [April 22, 2009, 5:36pm UTC](https://www.ruby-forum.com/t/need-help-with-n-n-authorization/166194 "2009-04-22T17:36:21Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![patrick](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/b2d939/32.png) [@patrick](https://www.ruby-forum.com/u/patrick)\
**Post date:** [April 22, 2009, 5:36pm UTC](https://www.ruby-forum.com/t/need-help-with-n-n-authorization/166194/1 "2009-04-22T17:36:21Z")

</div>

Hi folks,

I’m trying to implement an authorization system with users, roles and  
permissions. Each user can have multiple roles, each role multiple  
permissions and users can have multiple ‘snowflake’ permissions as  
well.

This is my migration schema:

############################  
create\_table “permissions”, :force =\> true do |t|  
t.string “name”  
t.string “controller”  
t.boolean “c”  
t.boolean “u”  
t.boolean “d”  
t.datetime “created\_at”  
t.datetime “updated\_at”  
end

create\_table “permissions\_roles”, :force =\> true do |t|  
t.integer “role\_id”  
t.integer “permission\_id”  
end

create\_table “roles”, :force =\> true do |t|  
t.string “name”  
t.datetime “created\_at”  
t.datetime “updated\_at”  
end

create\_table “roles\_users”, :force =\> true do |t|  
t.integer “user\_id”  
t.integer “role\_id”  
end

create\_table “snowflakes”, :force =\> true do |t|  
t.integer “user\_id”  
t.integer “permission\_id”  
t.datetime “due\_date”  
t.datetime “created\_at”  
t.datetime “updated\_at”  
end

create\_table “users”, :force =\> true do |t|  
t.string “login”, :null =\> false  
t.string “crypted\_password”, :null =\> false  
…  
end  
############################

As you can see, the user-\>role-\>permission-path is solved with  
has\_and\_belongs\_to\_many connections and the user-\>permission-path with  
has\_many, :through snowflakes connections.

What is the best way to authorize a user?

I have various ideas, but I don’t know how to implement them in Rails  
and which of them are the best in case of performance and security. I  
thought of a prepared statement with all permissions by user or an  
array with all permissions stored and cached. But I don’t know how I  
can do something like array.find\_by\_controller().

Can anybody help me with a clean and straight solution for that  
problem?

Thank you very much in advance!

Pat

---

<div class="post-metadata">

**Author:** ![patrick](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/b2d939/32.png) [@patrick](https://www.ruby-forum.com/u/patrick)\
**Post date:** [April 24, 2009, 11:08am UTC](https://www.ruby-forum.com/t/need-help-with-n-n-authorization/166194/2 "2009-04-24T11:08:14Z")

</div>

I really need help with this problem. Is there any better approach?