Roll my own Role based permission or use CanCan Gem?


I am new to Rails and wanted to ask some of the veterans here what
they recommend for Role based permissions. I am working on an
application that has users and those users can have multiple roles.
Based on a users role various things are available/unavailable for
them to do. This access would be controlled at the controller, view
and model level at various points in the application. I would have a
screen in the admin section where I can view a persons roles, add or
remove roles, etc. Nothing real complicated.


On Thu, Jan 12, 2012 at 12:29, tmueller [email protected]

I am new to Rails and wanted to ask some of the veterans here what
they recommend for Role based permissions.

It depends on a number of factors. If this is a “real thing” for
work, or that you intend to put out for public use, definitely just go
with CanCan. (Or possibly one of the alternatives. CanCan does seem
to be the most popular though.)

On the other claw, if you’re just playing, do it with CanCan (or,
again, some alternative) the first time. That way, you get the idea
how that sort of thing generally works. After that, though, it can
be quite a good learning experience to try to duplicate the
functionality yourself. Meanwhile, having learned CanCan can’t hurt
either. :slight_smile: You could separate the authorization checks into some
wrapper class that would, under the hood, initially call CanCan, but
then you can remove CanCan (kick the CanCan?), and see what you have
to do to make the app work again. I suggest having particularly good
test coverage in that piece, so you know you’ve got it working right.


Dave A., President, Dave A. Software Engineering and Training
Ruby on Rails Freelancing (Northern Virginia, Washington DC, or Remote),,, & (NEW!)
Specialization is for insects. (Heinlein) - Have Pun, Will Babble! (me)

Hi Dave,

Thanks for the quick reply. I’ll give CanCan a go as from what I’ve
read it should cover most everything I need for role auth.


On Jan 12, 10:35am, Dave A. [email protected]

I’m fairly new to the Rails community and recently faced a similar
situation. First from what you describe, CanCan will most certainly
provide the functionality you desire.

Secondly, there is a nice screencast at that provides a
introduction, however some of processes in the screencast have been
updated/modified in more recent versions of the gem, so be sure to go by
the github documentation vs. the example in the screencast.

Thirdly, I would describe the learning curve for the CanCan gem as
moderate. I have a fairly complex use case and my CanCan Abilities
has gotten a little large. However, I’ve been amazed that each time I
initially thought CanCan was in error, when I worked it through, CanCan
accurate. Also, I was worried about a performance hit, but so far have
seen anything that indicates CanCan will not scale.

Highly recommended gem from my standpoint.

Hi Don,

Thanks for the write-up on CanCan. I’m currently trying out
declarative_authorization as I want to have the role info be
accessible in my models.

my app is ruby based but I am not using rails. Can I still use CanCan?

On 12 January 2012 17:29, tmueller [email protected] wrote:

I am new to Rails and wanted to ask some of the veterans here what
they recommend for Role based permissions.

If it’s a terribly simple permissions model, you can roll your own
with a small piece of code like this:

…I’ve used tweaked versions of this in the past.

But if you plan any kind of scaling up, it would probably be best to
stick to a tried and tested public gem…


CanCan is Rails specific - the docs on GitHub clearly state it is for
on Rails. From my limited experience, CanCan requires Gems that are
specific and relies on many aspects of Rail’s MVC structure. I estimate
would be a big job to rework CanCan to be not dependent on Rails
and work with whatever MVC structure (if any) you have in your app. It
would most likely be easier to roll your own.

Yes, CanCan is very “controller” centric. Sounds like the
declarative_autorization gem allows one to follow the “skinny
fat models” design mantra. I’ll have to check it out.