# Suggestion regarding permissions & co **URL:** \ **Category:** Rails\ **Created:** [September 15, 2010, 11:51pm UTC](https://www.ruby-forum.com/t/suggestion-regarding-permissions-co/195056 "2010-09-15T23:51:49Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![tomtt](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/e47c2d/32.png) [@tomtt](https://www.ruby-forum.com/u/tomtt)\ **Post date:** [September 15, 2010, 11:51pm UTC](https://www.ruby-forum.com/t/suggestion-regarding-permissions-co/195056/1 "2010-09-15T23:51:49Z")
hi, since im not fully satisfied with all the permissions-systems out there i was wondering if there is another way to handle the whole thing. Based on my experience on what i have seen in bigger systems, permissions are usually handled a bit different. The Suggestion here (or my insanity) is coming from an ERP system which needs to handle _many_ tables for _many_ users with _many_ different needs & settings. im talking about userX who can do that and (NOT) see that and so and so forth. So here comes my suggestion as well with questions since im sure this is not fully thougth through. Lets assume we have something like a Sales-Order: SalesOrderHeader -belongs\_to: Customer -belongs\_to: ShippingAgent -belongs\_to: ShippingMethod -has\_one: Comment -has\_one: ShippingComment … SalesOrderLine -belongs\_to: SalesOrderHeader -belongs\_to: Stockkeepingunit -belongs\_to: Item -belongs\_to: ItemDiscountGroup -qty: integer … as u can see, a basic SalesOrder(SO) consists of 2 basic tables. The tricky part are the associations & the permissions: Suggestion A: Having a ‘Security’-Table (call it whatever u want), holding this data: - name\_of \_the\_table(or an ID id the models are somehow enumerated): String (value: eg SalesOrderHeader) - can\_create: boolean - can\_read: boolean - can\_delete: boolean - can\_update: boolean - filter: string (a reegular (my)sql-statemnt) (Value: eg: where Customer.Name != ‘Sony’) - user\_id > > - this gives the ability to set permissions for each user on what he can('t) do on that model, including a filter. - this would need to be done for each table / model defined by the association too q: just giving the user access to the salesorderheader would that be enough? because of all the associations the user would need (to have(?)) access to the related tables / models too, right!? Suggestion B Lets define a ‘virtual / verbal’ Permission-Model, eg: “SalesOrder”.Obviously, we would need to store it somewhere too, so lets do the same, but a bit differentlty: - name: String (value: eg SalesOrder) - can\_create: boolean - can\_read: boolean - can\_delete: boolean - can\_update: boolean - filter: string (a reegular (my)sql-statemnt) (Value: eg: where Customer.Name != ‘Sony’) - user\_id > > by giving him access to that he gets access (wr?) to all associated > > tables / models too. This needs to be stored too then. but then > > somethign > > else pops into my head: some people should be able to maintain basic > > maindata and some not, which kinda redirects back to Suggestion A… > > But maybe there is a way finding a merged solution out of both > > Suggestions, havent really thought through the whole thing though. Summary: i know this topic is a painful one, but def an important one, especially when u look into erntperise-scaled apps. ## Before i go further i would like to hear whatu guys think of “one cool” solutions which “just” fits. maybe we can come up with somehting, if not oh well.But i hope u guys got the drift. regards tom ps: forgot the other part: even if a user needs to have different permissions on different SalesORder, that would basically be covered by the merged in Y-Table, which represents the “security”. but thats part2 anyway ---
**Author:** ![tomtt](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/e47c2d/32.png) [@tomtt](https://www.ruby-forum.com/u/tomtt)\ **Post date:** [September 16, 2010, 2:10pm UTC](https://www.ruby-forum.com/t/suggestion-regarding-permissions-co/195056/2 "2010-09-16T14:10:26Z")
why dont you like declarative authorization or cancan? i dont see why you cant do what you described with any of those