Validate Object Ownership (user_id) in model, or in controller?

rubyonrails-talk
1

Quick best practices question ...

I have a number of models with a user_id attribute

I am using the acts_as_authenticated plugin which lets you use something like current_user to extract the current user from the session. I have used this in my controllers successfully.

Would it be "wrong" to use this as a model validation? How would I make this accessible to the model? I can't seem to get it to work from within a model.

I'd like to write something that checks every model update, and verifies ownership (previous owner is current owner)

Thanks in advance for your help

2

current_user is provided by acts_as_authenticated through the following method:

def current_user       @current_user ||= (session[:user] && User.find_by_id(session[:user])) || :false end

Because of the sessions usage, I don't think you want to use model validation.

In the controllers you can do current_user.widgets.find() (instead of just Widget.find() ) which will only bring up authenticated items,

thanks, C.