No PhD

I’ve been looking around for a simple gem to handle basic Rails controller authorisation but I didn’t really get on with any of the maintained gems out there. They mostly rely on additional tables in your DB, cover hundreds of cases I don’t care about and generally seem a lot of effort.

The fruits of this frustration are here. My main aims with authoritah were providing a simple declarative DSL for specifying your permission rules that you customise to hook in to whatever authentication system you use.

Here’s an example:

class WidgetController < ApplicationController
  permits :current_user => :admin?, :to => [:create, :destroy]
  permits :current_user => :logged_in?, :to => :show
end

Authoritah relies on you providing a method or methods on your controller that result in an object you can query for authorisation information. In these examples we’re following the restful_authentication/authlogic approach of a current_user method that returns the currently logged in user.

At present you can’t just do the following:

class WidgetController < ApplicationController
  permits :logged_in?
end

which would imply you want the action to be permitted as long as there is a user logged in (i.e. you have a logged_in? method on your controllers). I’ll fix this soon though.

For more information see the gems home at http://github.com/indmill/authoritah.