<p>copied from <a href="http://code.google.com/p/rolerequirement/">Google Code</a><br />
h2. Summary</p>
<p>RoleRequirement focuses on a simple approach to role-based authentication. You don’t have to learn a new language in order to specify roles; instead, RoleRequirement leverages the power of !Ruby to strike a marvelous balance between simplicity and flexibility.</p>
<p>Features:</p>
<ul>
<li>A user can have many roles or one role</li>
<li>Full test helpers to make it easy to test your controllers. (<a href="http://code.google.com/p/rolerequirement/wiki/TestingRoleRequirement">examples here</a>)</li>
<li>Squeaky clean implementation – don’t repeat yourself!</li>
<li>Code generators: spend more time coding and less time wading through installation instructions.</li>
</ul>
<h2>Usage</h2>
<p>Steps to using as easy as 1, 1.5, 2, 3!</p>
<h3>1. Install restful_authentication and role_requirement</h3>
<p>Install restful_authentication as usual, running your usual ‘script/generate authenticated user sessions’.</p>
script/plugin install git://github.com/technoweenie/restful-authentication.git
script/generate authenticated user sessions
<p>To install role_requirement:</p>
script/plugin install git://github.com/timcharper/role_requirement.git
<h3>2. Run the generator</h3>
script/generate roles Role User
<p>(where User is the name of your user model, and Role is the name of the roles model to create.)</p>
<p>Note: You’ll need to run rake db:migrate to actually modify the database</p>
<p><a href="http://code.google.com/p/rolerequirement/wiki/WhatTheGeneratorsDo">click here for a list of what the generators do</a></p>
<h3>3. Define your role requirements in your controllers</h3>
<p>Only allow administrators to access Users here.</p>
class Admin::Users < ApplicationController
require_role “admin”
…
end
<p>Require contractor role for everything, and then require admin role to destroy, and only let contractors access listings they have access to:</p>
class Admin::Listings < ApplicationController
require_role “contractor”
require_role “admin”, :for => :destroy # don’t allow contractors to destroy
<ol>
<li>leverage ruby to prevent contractors from updating listings they don’t have access to.<br />
require_role “admin”, :for => :update, :unless => "current_user.authorized_for_listing?(params[:id]) "<br />
…<br />
end</li>
</ol>
<p>Other examples:</p>
<p>allow everyone to access index, but only admin can access the rest</p>
require_role “admin”, :for_all_except => :index
<p>allow everyone to access show and index, but only admin can access the rest</p>
require_role “admin”, :for_all_except => [:index, :show]
<p>Help</p>
<p>Here’s how to get help</p>
<ul>
<li>Browse the Documentation</li>
<li>Install the plugin, generate the rdoc’s, and browse from there.</li>
<li>post an issue to the issue tracker</li>
<li>Fire off a message to the mailing list</li>
</ul>
<p>Author</p>
Tim C. Harper – irb(main):001:0> ( ‘tim_see_harperATgmail._see_om’.gsub(‘<em>see</em>’, ‘c’).gsub(‘AT’, ‘@’) )
2008-10-11T12:58:42-07:00
66056
usage
24558
Usage
2008-10-11T13:36:51-07:00
25921