# Restricting a FIND based on the results of another

**URL:** <https://www.ruby-forum.com/t/restricting-a-find-based-on-the-results-of-another/107970>\
**Category:** Rails\
**Created:** [June 27, 2007, 11:11pm UTC](https://www.ruby-forum.com/t/restricting-a-find-based-on-the-results-of-another/107970 "2007-06-27T23:11:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rjsquire](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/74df32/32.png) [@rjsquire](https://www.ruby-forum.com/u/rjsquire)\
**Post date:** [June 27, 2007, 11:11pm UTC](https://www.ruby-forum.com/t/restricting-a-find-based-on-the-results-of-another/107970/1 "2007-06-27T23:11:44Z")

</div>

If anyone could help me figure this out, I’d appreciate it alot.

I’m playing around with the Scriptaculous autocomplete function, which  
per the demonstration on their page looks like this in the controller:

def auto\_complete\_responder\_for\_contacts(value)

```
    @results = People.find(:all,
                       :conditions => [ 'LOWER(fullname) LIKE ?','%'

```

- value.downcase + ‘%’ ],  
:order =\> ‘fullname ASC’,  
:limit =\> 8)  
render :partial =\> ‘contacts’ and return

There are three database tables…

1. People - id, fullname, email  
(Stores the contact information of the people)

2. Access - id, people\_id, user\_id  
(If a user has access to particular contact, it records that contact and  
that user’s id in a new row)

3. User - id, username, password, etc.  
(Stores the user account data)

In short, not all users get access to the same contacts although there  
will be some overlap, which prevents me from assigning any particular  
contact simply to one user alone.

The question:

How could this controller be modified so that users only see contacts  
that they have access to? Ideally, this would be because there is a  
matching pair in the Access table. Once the system finds a match between  
the user input and the database in question, it then checks to make sure  
that there is a row in the Access table that has both the people\_id and  
user\_id necessary. If not, discards it.

Thank you for your time!

---

<div class="post-metadata">

**Author:** ![rjsquire](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/74df32/32.png) [@rjsquire](https://www.ruby-forum.com/u/rjsquire)\
**Post date:** [June 28, 2007, 12:23am UTC](https://www.ruby-forum.com/t/restricting-a-find-based-on-the-results-of-another/107970/2 "2007-06-28T00:23:05Z")

</div>

Robert,

This it really depends on what the relationships are between these  
tables. One way would be to use a has\_many, or has\_many :through  
relationship between users and people… Use :through if you want to  
add other information to your access table… like this:

class User \< ActiveRecord::Base  
has\_many :access  
has\_many :people, :through =\> :access  
end

… Then you could get all the people like this:

user = User.find(some\_id)  
@people = user.people

or like:

user = User.find(some\_id)  
@people = user.people.find(:all, :conditions =\> blah)

Not sure if this is the exact syntax… find more here:  
[http://wiki.rubyonrails.org/rails/pages/ThroughAssociations](http://wiki.rubyonrails.org/rails/pages/ThroughAssociations)

It sounds like what you really want is RBAC (Role Based Authentication  
Control).  
Have a look at ActiveRBAC: [http://active-rbac.rubyforge.org/](http://active-rbac.rubyforge.org/)

Good luck,  
Peter

On Jun 27, 2:11 pm, Robert S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![rjsquire](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/74df32/32.png) [@rjsquire](https://www.ruby-forum.com/u/rjsquire)\
**Post date:** [June 28, 2007, 3:37am UTC](https://www.ruby-forum.com/t/restricting-a-find-based-on-the-results-of-another/107970/3 "2007-06-28T03:37:22Z")

</div>

Peter,

Thank you! The Through Associations worked perfectly.