# Realising a rights management

**URL:** <https://www.ruby-forum.com/t/realising-a-rights-management/149662>\
**Category:** Rails\
**Created:** [September 27, 2008, 5:30pm UTC](https://www.ruby-forum.com/t/realising-a-rights-management/149662 "2008-09-27T17:30:41Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![msmsms](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/34f0e0/32.png) [@msmsms](https://www.ruby-forum.com/u/msmsms)\
**Post date:** [September 27, 2008, 5:30pm UTC](https://www.ruby-forum.com/t/realising-a-rights-management/149662/1 "2008-09-27T17:30:41Z")

</div>

Hi,

this is my first post, so hello folks! 🙂 I am thinking about a rights  
management for my ruby on rails application. As usual, there will be  
roles, groups, allowed actions, etc. At the moment, I try to imagine,  
how this thing should work in detail. If there’s an action named  
“create comment” for example, i could do following (some pseudo-code):

1. if RightsController.checkAction(CREATE\_COMMENT) then (…)
2. if RightController.checkAction() then (…)

Whereby the method in example no. 2 looks in the stack to find out the  
calling method and the appropriate class to check whether the action  
is allowed.

Maybe I can connect this to some before filter, I am relatively new to  
ror, so I don’t know exactly, if that’s possible.

Besides this internal check, I plan to mask out all gui elements which  
could cause actions not allowed. So it’s for double-checking.

I look forward to your comments and suggestions about this topic.

Thank you alot!  
ms

---

<div class="post-metadata">

**Author:** ![msmsms](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/34f0e0/32.png) [@msmsms](https://www.ruby-forum.com/u/msmsms)\
**Post date:** [September 27, 2008, 10:54pm UTC](https://www.ruby-forum.com/t/realising-a-rights-management/149662/2 "2008-09-27T22:54:06Z")

</div>

As I understand you are talking about permissions, user permissions.  
It seams logic to me to have a UserPremission model to deal with it.  
It could have a list of action it is permit to perform and a way to  
check public actions.

You can look at [http://redmine.org](http://redmine.org) solution of this issue in their  
application source.  
You can learn a lot from the others.