Rails 4 user roles and permissions

Something that was suggested to me that we are now using is the petergate gem. Easy to use and very clean looking with a great rails feel.

Works well with devise.

Here is some examples from the readme.

If you're using devise you're in luck, otherwise you'll have to add following methods to your project:

user_signed_in?
current_user
after_sign_in_path_for(current_user)
authenticate_user! 

This comes in your User.rb. Adding more roles is as easy as adding them to the array.

petergate(roles: [:admin, :editor], multiple: false)

Instance Methods

user.role => :editor
user.roles => [:editor, :user]
user.roles=(v) #sets roles
user.available_roles => [:admin, :editor]
user.has_roles?(:admin, :editors) # returns true if user is any of roles passed in as params.

Controller access syntax.

access all: [:show, :index], user: {except: [:destroy]}, company_admin: :all

Your first guess was right, use cancancan and you'll be good with it.

EDIT Jul 24, 2015

I've been using cancancan for a long time now and it was always working great. I've recently started working on a project where Pundit is used for authorization.

It is awesome. It prompts you to define the policy for each resource and it feels more natural than one bloated Ability class.

For bigger projects, I would definitely recommend Pundit.

To control access to actions I'd recommend Action Access, it boils down to this:

class UsersController < ApplicationController
  let :admin, :all
  let :user, [:index, :show]

  # ...
end

This will automatically lock the controller, allowing admins to access every action, users only to show or index users and anyone else will be rejected and redirected with an alert.

If you need more control, you can use not_authorized! inside actions to check and reject access.

It's completely independent of the authentication system and it can work without User models or predefined roles. All you need is to set the clearance level for the current request:

class ApplicationController < ActionController::Base
  def current_clearance_level
    session[:role] || :guest
  end
end

You can return whatever you app needs here, like current_user.role for example.

Although it isn't required, it bundles a set of handy model additions that allow to do things like:

<% if current_user.can? :edit, :team %>
  <%= link_to 'Edit team', edit_team_path(@team) %>
<% end %>

Here :team refers to TeamsController, so the link will only be displayed if the current user is authorized to access the edit action in TeamsController. It also supports namespaces.

You can lock controllers by default, customize the redirection path and the alert message, etc.

It's very straightforward and easy, I hope you find it useful.