# Role based restriction for fields (not views or actions)

**URL:** <https://www.ruby-forum.com/t/role-based-restriction-for-fields-not-views-or-actions/133297>\
**Category:** Rails\
**Created:** [March 29, 2008, 8:44pm UTC](https://www.ruby-forum.com/t/role-based-restriction-for-fields-not-views-or-actions/133297 "2008-03-29T20:44:24Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![schof](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/8dc957/32.png) [@schof](https://www.ruby-forum.com/u/schof)\
**Post date:** [March 29, 2008, 8:44pm UTC](https://www.ruby-forum.com/t/role-based-restriction-for-fields-not-views-or-actions/133297/1 "2008-03-29T20:44:24Z")

</div>

I have an application that requires some complex access rules.  
Certain fields can only be edited by certain roles. I am using  
restful\_authentication and role\_requirement plugins so I am fine with  
restricting an entire controller or specific action based on a role.

I am trying to come up with a solution that would allow me to specify  
something as a text field but make it just plain text if the user does  
not have edit permissions. Anyone have any ideas on fine grain  
access control like this? Can you point me to a project that uses  
something like this?

TIA,

Sean

---

<div class="post-metadata">

**Author:** ![schof](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/8dc957/32.png) [@schof](https://www.ruby-forum.com/u/schof)\
**Post date:** [March 30, 2008, 4:34am UTC](https://www.ruby-forum.com/t/role-based-restriction-for-fields-not-views-or-actions/133297/2 "2008-03-30T04:34:13Z")

</div>

Sean,

I don’t have any leads for you, but I’m very interested in this  
myself. I do have one thought: I imagine you could roll your own text  
field helper method (and then probably helper methods for the other  
form elements). Something like:

require ‘active\_support/inflector.rb’  
module ActionView  
module Helpers  
module FormHelper  
def secured\_text\_field(object\_name, method, options = {})  
current\_user.has\_role?(options[:required\_role]) ?  
“\<div id=”#{object\_name}\_#{method}  
“\>#{object\_name.instance\_eval(method.to\_s)}” :  
text\_field(object\_name, method, options)  
end  
end  
end  
end

# (I added the above to the ApplicationHelper.rb file but not within

the Module namespace… i.e. after it.)

And you’d call it with something like:

\<% form\_for(@foo) do |f| %\>

\<%= f.label :name %\>  
 \<%= secured\_text\_field @foo, :name, :required\_role =\> "admin" %\>

\<% end %\>

If the current\_user has the “admin” role, then you’d get:

Name

But if the current\_user has any other role, you’d get:

Name

Some Name

I’m sure there’s a cleaner way, but the above works. I tried doing it  
within the FormBuilder constrains (i.e. “f.secured\_text\_field…”) but  
I don’t understand that code… lots of meta-programming there.

Anyway, I tested the above and it works. Hopefully that gets you  
started.

-Danimal

---

<div class="post-metadata">

**Author:** ![schof](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/8dc957/32.png) [@schof](https://www.ruby-forum.com/u/schof)\
**Post date:** [March 30, 2008, 4:46am UTC](https://www.ruby-forum.com/t/role-based-restriction-for-fields-not-views-or-actions/133297/3 "2008-03-30T04:46:05Z")

</div>

Heh… I’m still learning.

The namespacing was unnecessary. Slap it right in the middle of the  
ApplicationHelper module, I.e.:

module ApplicationHelper  
def secured\_text\_field(object\_name, method, options = {})  
options[:required] == “yes” ? content\_tag(:div,  
“#{object\_name.instance\_eval(method.to\_s)}”, :id =\>  
“#{object\_name.class.to\_s.underscore}\_#{method}”) :  
text\_field(object\_name, method, options)  
end  
end

There’s probably a cleaner way to get “foo\_name” for the ID but the  
above works… and is terse and to the point.

-Danimal

---

<div class="post-metadata">

**Author:** ![schof](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/8dc957/32.png) [@schof](https://www.ruby-forum.com/u/schof)\
**Post date:** [March 30, 2008, 3:27pm UTC](https://www.ruby-forum.com/t/role-based-restriction-for-fields-not-views-or-actions/133297/4 "2008-03-30T15:27:45Z")

</div>

Hi,

i think there is a ruby gem called model\_security which provides such  
fine grained access control from within the model.  
I don’t know though if it’s mantained and up to date and/or runs  
nicely on rails 2.

Hops that helps.

Cheers!  
Alberto.

---

<div class="post-metadata">

**Author:** ![schof](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/8dc957/32.png) [@schof](https://www.ruby-forum.com/u/schof)\
**Post date:** [March 31, 2008, 2:45pm UTC](https://www.ruby-forum.com/t/role-based-restriction-for-fields-not-views-or-actions/133297/5 "2008-03-31T14:45:07Z")

</div>

There’s also the acl2 plugin from Ezra.  
[http://opensvn.csie.org/ezra/rails/plugins/dev/acl\_system2/](http://opensvn.csie.org/ezra/rails/plugins/dev/acl_system2/)

It has a view helper, \<% restrict\_for “role” do %\> which will let you  
only show what is part of the code block in the view.

Hope this helps.

Serge