Unit 6: Namespacing, Authentication, Authorization, ActiveSupport

Feb 21, 2011

Objectives

Learn more about the Rails framework by reading about the fundamentals and ActiveSupport.

Learn about authentication (who are you?), authorization (permissions) and how simple namespacing allows you to "scope" different areas of your application.

Recap / Prerequisites

Whew! You should have completed Project 5. Be sure to continually improve your subsequent projects according to the feedback you have received.

Summary

This is our last "mini application" project that tests your ability to implement common Web application features. Our goal this week is to create a basic application with public, admin and members' areas that leverages well-known gems to implement authentication and authorization.

Topics & Resources

Be sure to view the following screencasts before engaging in Project 6.

General topics for this week

• Caching with instance variables. Be aware of this Rubyism.
• Find through Association. Be aware of this handy ActiveRecord syntax.
• Move Find into Model. Always seek to clean up your controller/view code by pushing as many details into the model as possible. A good place to start is any time you have a custom finder method. Want more? See named_scope.
• Using with_scope. More on creating custom finder methods in your model.

Topics Related to Project 6

First, a couple preliminaries:

• Filtering Sensitive Logs. Make sure sensitive data (such as passwords) are not present in your logs.
• Dangers of Model in Session. Don't store a User object in the session, just store the id.

Next, these three videos show one approach to controlling application access. These are important to study and understand, but realize that our approach for project 6 is different.

• Where Administration Goes.
• Restricting Access.
• Simple Authentication.

Lastly, these videos are directly related to project 6.

• Counter Cache Column. There are a couple places where this should be used in your application to reduce DB calls.

• Authentication from Scratch. I recommend not rolling your own, but this video is important to study in order to understand what gems like authlogic are doing for you.
• Authlogic. I recommend this gem for all Rails 2 apps. (optional: see devise)
• Declarative Authorization. Permissions are often thought of as declarative rules (eg, "Admins can access the admin area, regular members cannot.") so why use a procedural or programmatic implementation of authorization? Use a declarative system, such as the one provided by declarative_auth. (optional: see CanCan)