I strongly prefer Pundit. Not that my opinion adds a whole lot to the conversation.
Role-based authorization in Rails
21–24 of 24 posts
Re: Role-based authorization in Rails
#22I like the approach to describe permissions but I also think that a good data model to sit behind this that includes roles and capabilities ultimately is needed in most applications. Users and use cases will almost always arise that require arbitrary roles with a mix of capabilities...
You are allowed to mix any roles in any combinations. This shows only a flat hierarchy, but I'd love to explore that in an example sooner than later :)
Re: Role-based authorization in Rails
#23I've been using Pundit, which is model-based, rather than role-based, and it works really nicely with Rails conventions. Model-based feels more natural than role based, IMO.
Indeed, the author is framing Access Granted against CanCan/CanCanCan, when Pundit has already picked up the torch of Rails authorization. Pundit made the design decision to be as close to pure Ruby as possible, and therefore is extremely flexible (similar to the design philosophy of Strong Parameters). Access Granted seems like a step backwards (toward a DSL) from Pundit. So it would take a strong argument to show w…
I personally dislike Pundit's way of defining permissions, but as always it's a preference.
I really wanted to keep CanCan's simplicity, but add roles while cleaning abilities/policies up.
Re: Role-based authorization in Rails
#24I think the pattern that needs to be explored is a rails engine that has a web interface to manage permissions for different models. Usually stakeholders want to control the roles and permissions.
Interesting, this is very project specific so might be tough to implement for general user-base.