Complex abilities and scoping of records

rubyonrails-talk
1

I have the following scenario.

Users have various levels of ability. They can only view and edit their own records (their profile). Their managers can only view and edit their employees records. The regional managers can view and edit only the people in their regions and the corporate headquarters can view and edit all records. There are multiple regions so somebody can be the manager of the north region and somebody is the manager of the south region. They both have the role of "regional manager".

Of course this also applies to any of the child relations as well (addresses, phone numbers etc).

I am struggling with a clean way to write a controller which would only show the records they have the right to on the index method. I want to avoid silly and complex case statements and I also want avoid roles like "regional manager north".

I figure somebody here has run into this problem. What is the most elegant way to solve this problem.

Cheers.

2

Is this a fully hierarchical network? If so then you could use a child parent arrangement such that a user at one level can access all the users below him.

Colin

3

Have you been looking at CanCan?

I’ve implemented a similar situation with CanCan. It will not cover your needs for 100% but it will do a lot.

4

Yes I have been looking at cancan. I have also been looking at Consul. Of the two Consul seems to have a little more power and is scope based so it's probably worth giving a shot but it looks like cancan has won the popularity war anyway.