# Roles, STI and convention

**URL:** <https://www.ruby-forum.com/t/roles-sti-and-convention/170832>\
**Category:** Rails\
**Created:** [June 23, 2009, 9:30am UTC](https://www.ruby-forum.com/t/roles-sti-and-convention/170832 "2009-06-23T09:30:00Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![tachekent](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/7993a0/32.png) [@tachekent](https://www.ruby-forum.com/u/tachekent)\
**Post date:** [June 23, 2009, 9:30am UTC](https://www.ruby-forum.com/t/roles-sti-and-convention/170832/1 "2009-06-23T09:30:00Z")

</div>

Hi,  
I have been using the restful\_authentication plugin and the default  
roles setup that it came with. I have a system with 1 admin, 20-30  
clients(customers) and 500+ users all of whom can login. I found that  
often when using certain role-based functions like user.has\_role?,  
mysql would send an IN() query with the id of every user in the system  
(500+). This seemed a lot of overkill for what it was doing. There’s  
no overlap between roles, and all of the user types authenticate at  
the User object level rather than the subclass. Now I’m using STI and  
running checks on the type(role) of the current\_user with user.class  
instead. Somehow this seems a bit wrong, but I don’t know why. Is it  
inherently a bad thing to do?