# Philosophical question about MVC

**URL:** <https://www.ruby-forum.com/t/philosophical-question-about-mvc/187588>\
**Category:** Rails\
**Created:** [April 26, 2010, 11:23am UTC](https://www.ruby-forum.com/t/philosophical-question-about-mvc/187588 "2010-04-26T11:23:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Antonio\_Tapiador\_de](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/a183cd/32.png) [@Antonio\_Tapiador\_de](https://www.ruby-forum.com/u/Antonio_Tapiador_de)\
**Post date:** [April 26, 2010, 11:23am UTC](https://www.ruby-forum.com/t/philosophical-question-about-mvc/187588/1 "2010-04-26T11:23:07Z")

</div>

Hi folks,  
I am working on Station, a Rails Engine [1] that supports authorization  
among  
other things.

Using Station, you can ask a model about authorization, for example:

post.authorize?(permission, :to =\> current\_user)

My question rises when doing automatic Model - Controller mapping. How  
coupled  
should be the action in the controller with the permission authorized in  
the  
model?

Consider this resource:

class PostsController  
authorization\_filter  
end

This could map the authorization to the post instance this way:

- create  
Post.new.authorize?(:create, :to =\> current\_user)
- show  
Post.find(params[:id]).authorize?(:show, :to =\> current\_user)

I am not sure that the Controller actions should be mapped directly to  
the  
Model permissions. There are cases when an action requires several  
permissions, like:

- edit  
Post.find(params[:id]).authorize?(:show, :to =\> current\_user) &&  
Post.find(params[:id]).authorize?(:update, :to =\> current\_user)

Maybe this mapping could be declared in the controller, maybe in the  
model…

Can anyone shed light on this?

[1] [http://rstation.wordpress.com](http://rstation.wordpress.com)

---

<div class="post-metadata">

**Author:** ![Antonio\_Tapiador\_de](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/a183cd/32.png) [@Antonio\_Tapiador\_de](https://www.ruby-forum.com/u/Antonio_Tapiador_de)\
**Post date:** [April 26, 2010, 8:15pm UTC](https://www.ruby-forum.com/t/philosophical-question-about-mvc/187588/2 "2010-04-26T20:15:32Z")

</div>

Antonio Tapiador del Dujo wrote:

> Hi folks,  
> I am working on Station, a Rails Engine [1] that supports authorization  
> among  
> other things.
> 
> Using Station, you can ask a model about authorization, for example:
> 
> post.authorize?(permission, :to =\> current\_user)
> 
> My question rises when doing automatic Model - Controller mapping. How  
> coupled  
> should be the action in the controller with the permission authorized in  
> the  
> model?

Philosophically, I agree with Ryan B.’ approach in CanCan, which is  
to decouple authorization from everything, including all three layer of  
MVC.

> **[GitHub - ryanb/cancan: Authorization Gem for Ruby on Rails.](https://github.com/ryanb/cancan)**
>
> Authorization Gem for Ruby on Rails. Contribute to ryanb/cancan development by creating an account on GitHub.

I say “philosophically” since I have not add the opportunity to  
implement CanCan in any of my projects yet.

---

<div class="post-metadata">

**Author:** ![Antonio\_Tapiador\_de](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/a183cd/32.png) [@Antonio\_Tapiador\_de](https://www.ruby-forum.com/u/Antonio_Tapiador_de)\
**Post date:** [April 27, 2010, 10:06am UTC](https://www.ruby-forum.com/t/philosophical-question-about-mvc/187588/3 "2010-04-27T10:06:34Z")

</div>

Very interesting solution. And pretty similar to Station, btw.

Many thanks for the link Robert!