为带有外部应用程序的模型创建Rails数据库条目

Question

I am creating a Rails app that will have User and File models. A user "has many" files. The catch is that the files are never created by the user explicitly through the web application. I am building desktop applications to monitor the filesystem (think Dropbox) and create/update File records.

Is the correct way to do this to have the desktop applications make the appropriate POST requests to my Rails application and just not supply a view for creating File records in the web app.

Also, would it be sufficiently secure to require a user-specific security token to be sent in the POST request made by the desktop applications to authenticate a user's file record?

Answer 1

It sounds like you're on the right track. Your Rails app is essentially exposing an API that takes an uploaded file and created the associated model on the user's behalf to track the file metadata. You could still expose a view in your webapp to edit file metadata and delete files, perhaps.

Security is a whole topic of its own. At a minimum, you'll probably want all communication to happen over SSL, and expire the token on a set timeout. Devise can do this for you with their TokenAuthenticatable implementation. You'll probably also want to limit file upload size and throttle requests.