Tuersteher¶ ↑

Security-Layer for Rails-Application acts like a firewall. It’s check your URL’s or Modells to have the rights for this.

Install¶ ↑

gem install tuersteher

Usage¶ ↑

Create in your Rails-Application the rules-file “config/access_rules.rb” (or copy the sample from samples-directory and modify)

Here is as small sample for “config/access_rules.rb”

# Path-Acces-Rules
path('/').grant.method(:get)
path(:all).grant.role(:ADMIN)
path('/user/lock').deny.role(:USER).role(:APPROVER)

# Model-Acces-Rules
model(Dashboard).grant.method(:view)

model(Todo) do
  grant.method(:view)
  grant.method(:full_view).role(:ADMIN)
  grant.method(:update).role(:EDITOR).extension(:owned_by?) # calls Todo.owned_by?(current_user)
  grant-method(:delete).not.role(:ADMIN)
end

Then extend your ApplicationController with:

include Tuersteher::ControllerExtensions
before_filter :check_access # methode is from Tuersteher::ControllerExtensions

Check if your authendicate-system has implemented the methods:

* current_user
* access_denied

and the current_user should have a method

* has_role?(role)

If not, just implemen it (see samples/application_controller.rb)

License¶ ↑

LGPL V3 (see license.txt)