# Session variable in default\_scope

**URL:** <https://discuss.rubyonrails.org/t/session-variable-in-default-scope/67608>\
**Category:** rubyonrails-talk\
**Created:** [August 12, 2013, 7:30pm UTC](https://discuss.rubyonrails.org/t/session-variable-in-default-scope/67608 "2013-08-12T19:30:26Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![11155](https://avatars.discourse-cdn.com/v4/letter/1/d26b3c/32.png) [@11155](https://discuss.rubyonrails.org/u/11155)\
**Post date:** [August 12, 2013, 7:30pm UTC](https://discuss.rubyonrails.org/t/session-variable-in-default-scope/67608/1 "2013-08-12T19:30:26Z")

</div>

I have a project model which I'd like to set the default\_scope to filter out projects where the user doesn't have permission to view them.

Think something along the lines of the projects having a list of teams and companies that the user must be in to access the data.

default\_scope seems to work well if I hard code it as I really don't want a dev to accidentally not have these permissions filters in use. The lists of teams and companies a user is in is stored in the session.

How can I marry these up? Thanks in advance.

---

<div class="post-metadata">

**Author:** ![11155](https://avatars.discourse-cdn.com/v4/letter/1/d26b3c/32.png) [@11155](https://discuss.rubyonrails.org/u/11155)\
**Post date:** [August 12, 2013, 8:58pm UTC](https://discuss.rubyonrails.org/t/session-variable-in-default-scope/67608/2 "2013-08-12T20:58:09Z")

</div>

I've tried following the pattern from the accepted answer here:

> <https://stackoverflow.com/questions/10680845/owner-filtered-model-objects-on-rails-3>

But I'm left with a problem in that I populate the session variables on User.after\_database\_connection (when I'd assumed, probably incorrect, that we first know who the user is) and the scope is called before then.