# Restful\_ACL db structure

**URL:** <https://www.ruby-forum.com/t/restful-acl-db-structure/169846>\
**Category:** Rails\
**Created:** [June 9, 2009, 3:09pm UTC](https://www.ruby-forum.com/t/restful-acl-db-structure/169846 "2009-06-09T15:09:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![shahroon\_ali](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ed655f/32.png) [@shahroon\_ali](https://www.ruby-forum.com/u/shahroon_ali)\
**Post date:** [June 9, 2009, 3:09pm UTC](https://www.ruby-forum.com/t/restful-acl-db-structure/169846/1 "2009-06-09T15:09:45Z")

</div>

Hi All,  
I am going to use restful\_acl in my application on every record  
in  
simple words i want to implement record based acl. I explored  
restful\_acl  
and I applied it too, but so for I am not successful in doing so.  
I have question regarding restful\_acl  
Does this plugin (now gem) needs any backend (database) configurations?  
if  
yes then what kind of database structure? I just need a table structure

Thanks,

Shahroon

---

<div class="post-metadata">

**Author:** ![shahroon\_ali](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ed655f/32.png) [@shahroon\_ali](https://www.ruby-forum.com/u/shahroon_ali)\
**Post date:** [June 10, 2009, 2:12pm UTC](https://www.ruby-forum.com/t/restful-acl-db-structure/169846/2 "2009-06-10T14:12:37Z")

</div>

On Jun 9, 9:09 am, shahroon ali [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Shahroon  
> RESTful\_ACL doesn’t require any database setup. It’s only requirement  
> is the existence of a @current\_user variable, normally set by  
> something like restful\_authentication.

---

<div class="post-metadata">

**Author:** ![shahroon\_ali](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ed655f/32.png) [@shahroon\_ali](https://www.ruby-forum.com/u/shahroon_ali)\
**Post date:** [June 11, 2009, 7:36am UTC](https://www.ruby-forum.com/t/restful-acl-db-structure/169846/3 "2009-06-11T07:36:02Z")

</div>

Thanks Darby,  
So you mean I dont need a single field in my db structure…but its  
confusing how this plugin is managing some complex kind of acl like I  
want  
to restrict some people from accessing a particular record, deleting a  
record and updating a record…let say I have scenario  
Model(Lead)----\>Record(Xdocs)  
(there is a polymorphic association between these two)  
(Xdocs)

Read rights = admin,user 1,user 2,user 3 …etc  
Write rights = admin,user 1,user 2,user 3 …etc  
Update rights =admin, author  
Delete rights = admin,author

how your plugin is managing all these things? without any database  
interaction? And I am using restful\_authentication …so I have that  
@current\_user as well…

Thanks,

Shahroon

---

<div class="post-metadata">

**Author:** ![shahroon\_ali](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ed655f/32.png) [@shahroon\_ali](https://www.ruby-forum.com/u/shahroon_ali)\
**Post date:** [June 17, 2009, 12:59pm UTC](https://www.ruby-forum.com/t/restful-acl-db-structure/169846/4 "2009-06-17T12:59:09Z")

</div>

RESTful\_ACL restricts actions based on the five methods you define in  
your model:  
class Issue \< ActiveRecord::Base  
logical\_parent :some\_model\_name

```
# This method checks permissions for the :index action
def self.is_indexable_by(user, parent = nil)

end

# This method checks permissions for the :create and :new action
def self.is_creatable_by(user, parent = nil)

end

# This method checks permissions for the :show action
def is_readable_by(user, parent = nil)

end

# This method checks permissions for the :update and :edit action
def is_updatable_by(user, parent = nil)

end

# This method checks permissions for the :destroy action
def is_deletable_by(user, parent = nil)

end

```

end

This is all in the readme on github, BTW…