# Setting up access rules

**URL:** <https://www.ruby-forum.com/t/setting-up-access-rules/162536>\
**Category:** Rails\
**Created:** [March 11, 2009, 2:41am UTC](https://www.ruby-forum.com/t/setting-up-access-rules/162536 "2009-03-11T02:41:47Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![neubyr](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/c37758/32.png) [@neubyr](https://www.ruby-forum.com/u/neubyr)\
**Post date:** [March 11, 2009, 2:41am UTC](https://www.ruby-forum.com/t/setting-up-access-rules/162536/1 "2009-03-11T02:41:47Z")

</div>

I am referring to this wonderful post:  
[http://pivotallabs.com/users/nick/blog/articles/272-access-control-permissions-in-rails/comments](http://pivotallabs.com/users/nick/blog/articles/272-access-control-permissions-in-rails/comments)  
for creating access rules for my application.

So from my controller and views I am calling method in user model as:  
@currentuser.topic\_admin?(topic)

### User model has this method:

## def topic\_admin?(topic) topic.can\_admin?(self) end

### Topic model has this method:

## def can\_admin?(user) valid\_roles = %w{admin editor} if valid\_roles.include?(user.role.name) return true else return false end end

The @currentuser is returned by a method in topic controller:  
def current\_user  
@currentuser = User.find(session[:user])  
end

Everything works fine as long as some user is logged in. If no one is  
logged in then session has no data and I get error regarding nil.object  
called…

How can I solve this problem? Am I going the wrong way? I wrote another  
method to check if user is logged in and then only call current\_user  
method or topic\_admin method. However, calling logged\_in? method before  
current\_user is useless and calling it before topic\_method means too  
much code in the view. Any other alternatives? Any clues?

Thanks,  
CS.

---

<div class="post-metadata">

**Author:** ![neubyr](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/c37758/32.png) [@neubyr](https://www.ruby-forum.com/u/neubyr)\
**Post date:** [March 11, 2009, 10:15am UTC](https://www.ruby-forum.com/t/setting-up-access-rules/162536/2 "2009-03-11T10:15:34Z")

</div>

One solution would be to provide a guest user in the database that is  
returned by current\_user when no-one is logged in, that enables you to  
give  
the guest user whatever roles you desire. Alternatively test  
@currentuser  
before calling topic\_admin. As an aside I would suggest setting up  
@topic\_admin true or false in controller rather than calling it from  
view,  
or even better if possible setup the data to be displayed in the  
controller/model and remove the logic from the view entirely.

2009/3/11 Carlos S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![neubyr](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/c37758/32.png) [@neubyr](https://www.ruby-forum.com/u/neubyr)\
**Post date:** [March 11, 2009, 2:27pm UTC](https://www.ruby-forum.com/t/setting-up-access-rules/162536/3 "2009-03-11T14:27:43Z")

</div>

Thanks Colin…

I am using ternary operator on @currentuser:  
@currentuser ? can\_admin?(topic) : false .

User model method: topic\_admin changed to can\_create  
Topic model method: can\_admin changed to can\_be\_created\_by

@currentuser.can\_create?(topic)

### User model has this method:

## def can\_create?(topic) topic.can\_be\_created\_by?(self) end

### Topic model has this method:

## def can\_be\_created\_by?(user) valid\_roles = %w{admin editor} if valid\_roles.include?(user.role.name) return true else return false end end

Problem -  
I have nested resources in my application - (topic has\_many items). And  
on my show topic page I have a link to ‘Add new item’. I would like to  
show this link only to users with certain roles. However, I am not able  
to pass this resource (item) as it has not been initialized. So how can  
I call method like: @currentuser.can\_create?(item) from my show topic  
page. I am initializing resource objects within the controller, but how  
can I initialize these from my view? Do I need to? Any clues?

- 

CS

Colin L. wrote:

> One solution would be to provide a guest user in the database that is  
> returned by current\_user when no-one is logged in, that enables you to  
> give  
> the guest user whatever roles you desire. Alternatively test  
> @currentuser  
> before calling topic\_admin. As an aside I would suggest setting up  
> @topic\_admin true or false in controller rather than calling it from  
> view,  
> or even better if possible setup the data to be displayed in the  
> controller/model and remove the logic from the view entirely.
> 
> 2009/3/11 Carlos S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![neubyr](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/c37758/32.png) [@neubyr](https://www.ruby-forum.com/u/neubyr)\
**Post date:** [March 11, 2009, 3:01pm UTC](https://www.ruby-forum.com/t/setting-up-access-rules/162536/4 "2009-03-11T15:01:53Z")

</div>

2009/3/11 Carlos S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

> return true  
> to pass this resource (item) as it has not been initialized. So how can  
> I call method like: @currentuser.can\_create?(item) from my show topic  
> page. I am initializing resource objects within the controller, but how  
> can I initialize these from my view? Do I need to? Any clues?

Are there different types of Topic? If not then can\_create? does not  
need to  
be given a topic. Make can\_be\_created\_by? a class method rather than an  
instance method, so it is called by Topic.can\_be\_created\_by?(user).

Colin

---

<div class="post-metadata">

**Author:** ![neubyr](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/c37758/32.png) [@neubyr](https://www.ruby-forum.com/u/neubyr)\
**Post date:** [March 11, 2009, 3:49pm UTC](https://www.ruby-forum.com/t/setting-up-access-rules/162536/5 "2009-03-11T15:49:07Z")

</div>

Its getting more complex than I thought…

May it will be easier to make ‘can\_de\_\*ted\_by’ methods as Class methods  
and call them directly bypassing the user model ‘can\_\*t[e]’ methods.

However this gives less control over the topics and items. I also have  
an index action, where in front of each topic name there  
edit/update/delete actions. Many users may have ‘topic admin’ role,  
however only the user who created particular topic should be able to  
delete it…

Thanks,  
CS.

Colin L. wrote:

> 2009/3/11 Carlos S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)
> 
> > return true  
> > to pass this resource (item) as it has not been initialized. So how can  
> > I call method like: @currentuser.can\_create?(item) from my show topic  
> > page. I am initializing resource objects within the controller, but how  
> > can I initialize these from my view? Do I need to? Any clues?
> 
> Are there different types of Topic? If not then can\_create? does not  
> need to  
> be given a topic. Make can\_be\_created\_by? a class method rather than an  
> instance method, so it is called by Topic.can\_be\_created\_by?(user).
> 
> Colin