# Restful\_authentication with two models suggestion/help

**URL:** <https://www.ruby-forum.com/t/restful-authentication-with-two-models-suggestion-help/161920>\
**Category:** Rails\
**Created:** [March 3, 2009, 8:59pm UTC](https://www.ruby-forum.com/t/restful-authentication-with-two-models-suggestion-help/161920 "2009-03-03T20:59:33Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![bagadoughnuts](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/71c47a/32.png) [@bagadoughnuts](https://www.ruby-forum.com/u/bagadoughnuts)\
**Post date:** [March 3, 2009, 8:59pm UTC](https://www.ruby-forum.com/t/restful-authentication-with-two-models-suggestion-help/161920/1 "2009-03-03T20:59:33Z")

</div>

Hi all,

I’m working on trying to create a login system via subdomains for a  
teacher/students.

I have two models at the moment. teacher.rb and student.rb. The fields  
in both tables are almost identical. Now I’ve come add  
restful\_authentication and I realize this could be a pain with two  
tables. I basically want to have one login screen where both the teacher  
and/or student can login to the site. If it’s a teacher they can access  
teacher specific pages/data and students will see student specific  
pages/data.

Is it better to combine both teachers AND students into one table (users  
table for example)? Or is there a way to keep both tables and still use  
restful\_authentication?

Many thanks. Let me know if you need any more code or specifics.

-Tony

---

<div class="post-metadata">

**Author:** ![bagadoughnuts](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/71c47a/32.png) [@bagadoughnuts](https://www.ruby-forum.com/u/bagadoughnuts)\
**Post date:** [March 3, 2009, 9:17pm UTC](https://www.ruby-forum.com/t/restful-authentication-with-two-models-suggestion-help/161920/2 "2009-03-03T21:17:01Z")

</div>

Just make a users table, and create a polymorphic relationship between  
users and students or teachers. Then, when the user logs in, check if  
they have a student or teacher record associated with them and  
redirect properly.

---

<div class="post-metadata">

**Author:** ![bagadoughnuts](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/71c47a/32.png) [@bagadoughnuts](https://www.ruby-forum.com/u/bagadoughnuts)\
**Post date:** [March 3, 2009, 9:44pm UTC](https://www.ruby-forum.com/t/restful-authentication-with-two-models-suggestion-help/161920/3 "2009-03-03T21:44:11Z")

</div>

Andrew B. wrote:

> Just make a users table, and create a polymorphic relationship between  
> users and students or teachers. Then, when the user logs in, check if  
> they have a student or teacher record associated with them and  
> redirect properly.

Thanks for the reply Andrew.

I’ll look into how to go about doing that. Any hints/suggestions from  
anyone would be helpful in the meantime. Thanks!

-Tony

---

<div class="post-metadata">

**Author:** ![bagadoughnuts](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/71c47a/32.png) [@bagadoughnuts](https://www.ruby-forum.com/u/bagadoughnuts)\
**Post date:** [March 4, 2009, 3:26am UTC](https://www.ruby-forum.com/t/restful-authentication-with-two-models-suggestion-help/161920/4 "2009-03-04T03:26:57Z")

</div>

Hey guys,

Hate to be annoying about this, but is unifying these two tables the  
best way to go about this?

Obviously students will have completely different levels of access to  
the site than teachers. Students will be able to log in and pay fees,  
view grades, print homework, etc. Teachers will be able to see log in  
and see all of their students, see whose paid or not, grade students,  
etc. Having both students and teachers in the same table worries me a  
bit with security.

If moving these tables into one is the best way to go about this, any  
hints on how to tell teachers apart from students? For example, having a  
“Teacher page” and a “Student page”

Or should I just keep this current structure (teacher table and student  
table) and…

1. Find a way to have one restful\_authentication form check both  
students AND teachers (according to the subdomain) and log them in.
2. Have a page with two forms. Where student and teachers log in through  
their respective form section.
3. Have a specific page for teachers to log in to and another for  
students to log in to (I’d hate to do this)

Thanks for the advice/suggestions,  
Tony

---

<div class="post-metadata">

**Author:** ![bagadoughnuts](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/71c47a/32.png) [@bagadoughnuts](https://www.ruby-forum.com/u/bagadoughnuts)\
**Post date:** [March 4, 2009, 10:40pm UTC](https://www.ruby-forum.com/t/restful-authentication-with-two-models-suggestion-help/161920/5 "2009-03-04T22:40:05Z")

</div>

On Mar 3, 9:26 pm, Tony T. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> bit with security.
> 
> If moving these tables into one is the best way to go about this, any  
> hints on how to tell teachers apart from students? For example, having a  
> “Teacher page” and a “Student page”

The pattern I’ve used before is to have a base User class (essentially  
what  
restful\_authentication generates), and then derive the various types  
of users from  
that class. You’ll need to add a string column named ‘type’ to your  
users table for this  
to work.

So your Teacher class would be declared as:  
class Teacher \< User

# teacher specific stuff

end

This works great for cases where users are cleanly divided into roles  
(ie, Teachers are never Students). It also makes it easy to add access  
control: define methods to check access on the user models, and then  
call them in the views.

Example (viewing grades):

# user.rb

class User \< ActiveRecord::Base  
def can\_view\_grades?(student)  
false  
end  
end

# student.rb

class Student \< User  
def can\_view\_grades?(student)  
# more if needed here…  
self == student  
end  
end

# teacher.rb

class Teacher \< User  
def can\_view\_grades?(student)  
true  
end  
end

That makes the check in GradesController very short:  
class GradesController \< ApplicationController  
def index  
# assumes that grades are a nested resource under student  
@student = Student.find(params[:student\_id]  
return access\_denied unless current\_user.can\_view\_grades?  
(@student)  
# etc  
end  
end

This also makes it easy to add, say, an Admin user type that can view  
_everybody’s_ grades. Just create another subclass!  
It also allows different types of users to have different associations

- for example:

class Teacher \< User  
has\_many :student\_class\_assignments  
has\_many :students, :through =\> :student\_class\_assignments  
end

class StudentClassAssignment \< ActiveRecord::Base  
belongs\_to :teacher  
belongs\_to :student

# adding another association here to indicate which section/class

this is is left to the reader  
end

class Student \< User  
has\_many :student\_class\_assignments  
has\_many :teachers, :through =\> :student\_class\_assignments  
end

It’s also handy to have methods to check the type of a user; in this  
case, “teacher?” and “student?”.

Finally, on the navigation issue, it’s relatively straightforward to  
check the type of current\_user and pick what to display. In several of  
my apps, there’s an individualized nav partial per user type, but your  
case may be different.

Hope this helps!

–Matt J.

---

<div class="post-metadata">

**Author:** ![bagadoughnuts](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/71c47a/32.png) [@bagadoughnuts](https://www.ruby-forum.com/u/bagadoughnuts)\
**Post date:** [March 5, 2009, 4:33am UTC](https://www.ruby-forum.com/t/restful-authentication-with-two-models-suggestion-help/161920/6 "2009-03-05T04:33:40Z")

</div>

Matt J. wrote:

> On Mar 3, 9:26�pm, Tony T. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:
> 
> > bit with security.
> > 
> > If moving these tables into one is the best way to go about this, any  
> > hints on how to tell teachers apart from students? For example, having a  
> > “Teacher page” and a “Student page”
> 
> The pattern I’ve used before is to have a base User class (essentially  
> what  
> restful\_authentication generates), and then derive the various types  
> of users from  
> that class. You’ll need to add a string column named ‘type’ to your  
> users table for this  
> to work.
> 
> –Matt J.

VERY HELPFUL! I wasn’t aware of this. Thank you VERY much! 🙂

-Tony