# What sort of business logic should go in a model?

**URL:** <https://www.ruby-forum.com/t/what-sort-of-business-logic-should-go-in-a-model/157555>\
**Category:** Rails\
**Created:** [January 13, 2009, 2:53am UTC](https://www.ruby-forum.com/t/what-sort-of-business-logic-should-go-in-a-model/157555 "2009-01-13T02:53:19Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![oldbug](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/c0e974/32.png) [@oldbug](https://www.ruby-forum.com/u/oldbug)\
**Post date:** [January 13, 2009, 2:53am UTC](https://www.ruby-forum.com/t/what-sort-of-business-logic-should-go-in-a-model/157555/1 "2009-01-13T02:53:19Z")

</div>

Suppose I have a classic blog application augmented with something like  
restful authentication so that users must log in to create blog posts  
and to  
issue comments on other blog posts.

I would like to give a user the option of deleting blog posts, but only  
those that (s)he has created.

Do I put that logic in my Post model or in the controller? Or does it  
go in  
the User model? Or should it go (somehow) in the session controller? In  
principal, the Post model only knows about users to the extent that it  
belongs\_to :user. It doesn’t have any notion of who is currently logged  
in  
– that’s the business of the session controller. But the user views  
all of  
the posts through the #index view of the session controller – it seems  
very  
logical to add a “Delete” link/icon next to the current user’s posts in  
the  
list.

I am curious to learn what other folks have done, and what your opinions  
are  
on this issue.

Thanks for giving me the opportunity to ask 🙂

–wpd

---

<div class="post-metadata">

**Author:** ![oldbug](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/c0e974/32.png) [@oldbug](https://www.ruby-forum.com/u/oldbug)\
**Post date:** [January 13, 2009, 3:04am UTC](https://www.ruby-forum.com/t/what-sort-of-business-logic-should-go-in-a-model/157555/2 "2009-01-13T03:04:25Z")

</div>

On 13 Jan 2009, at 01:52, Patrick D. wrote:

> the extent that it belongs\_to :user. It doesn’t have any notion of  
> who is currently logged in – that’s the business of the session  
> controller. But the user views all of the posts through the #index  
> view of the session controller – it seems very logical to add a  
> “Delete” link/icon next to the current user’s posts in the list.

Post could easily have a can\_delete? method that might look something  
like

def can\_delete?(current\_user)  
user == current\_user || current\_user.admin?  
end

Fred

---

<div class="post-metadata">

**Author:** ![oldbug](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/c0e974/32.png) [@oldbug](https://www.ruby-forum.com/u/oldbug)\
**Post date:** [January 13, 2009, 3:34am UTC](https://www.ruby-forum.com/t/what-sort-of-business-logic-should-go-in-a-model/157555/3 "2009-01-13T03:34:53Z")

</div>

Blatantly answering only the subject line:

Anything a user can do to your back-end (database, flat-files, wire  
APIs, etc.)…

…a unit test can do to a Model object, in generally the same way.

If, for example, your users can see a list of items, and can pick one  
item to  
operate on, then your unit tests should force your Item class to find a  
list of  
appropriate items, and should force your Item model to expose a method  
that  
operates on that item.

This rule should limit your controllers to mere patch-boards. Their only  
purpose  
is to glue this or that Model method to this or that View.

How does this answer apply to the details of your question?

–  
Phlip

---

<div class="post-metadata">

**Author:** ![oldbug](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/c0e974/32.png) [@oldbug](https://www.ruby-forum.com/u/oldbug)\
**Post date:** [January 13, 2009, 3:55am UTC](https://www.ruby-forum.com/t/what-sort-of-business-logic-should-go-in-a-model/157555/4 "2009-01-13T03:55:24Z")

</div>

On Mon, Jan 12, 2009 at 9:03 PM, Frederick C. \<  
removed\_email\_address@domain.invalid\> wrote:

> On 13 Jan 2009, at 01:52, Patrick D. wrote:
> 
> Post could easily have a can\_delete? method that might look something  
> like
> 
> def can\_delete?(current\_user)  
> user == current\_user || current\_user.admin?  
> end

Ok, that works for me. But when you do that, do you also add a  
parameter to  
the destroy method for the model (can I do that?) that takes a  
current\_user  
parameter as well?

> purpose  
> is to glue this or that Model method to this or that View.
> 
> How does this answer apply to the details of your question?

I’m not sure – in my case I would like users to be able to delete  
records  
from the back-end (database), but only certain users should be able to  
delete certain records. Are you suggesting that a good practice would  
be  
for me to define a #destroy\_if\_allowed method? Then my patch-board  
controller would call that instead of the traditional #destroy method.

Is this the common practice?

–wpd

---

<div class="post-metadata">

**Author:** ![oldbug](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/c0e974/32.png) [@oldbug](https://www.ruby-forum.com/u/oldbug)\
**Post date:** [January 13, 2009, 3:57am UTC](https://www.ruby-forum.com/t/what-sort-of-business-logic-should-go-in-a-model/157555/5 "2009-01-13T03:57:09Z")

</div>

I would define can\_delete? on the user model, not the post model.

User.rb

def can\_delete?(post)

# code here

end

user.can\_delete? makes more sense to me than post.can\_delete?..

You could rename the method to can\_be\_deleted\_by? for clarity though.