Rails CanCan and dynamically generated Abilities

Question

I would like to use CanCan on top of a Mongoid based Rails 3 application. I would like to introduce general models for user, role and privilege. Essentially the authorization system shall authorize at a per action base. Therefore we want to store action x roles privilege objects.

Now when it comes to the ability DSL we could generate the abilities dynamically as an after_save hook in the proivilege model. But this results in a problem in production mode, cause these runtime changes only affect the server process where the privilege changes were made.

On the other hand one could reevaluate all (the users) abilities as before_filter in every controller. But that slowed down every request.

Just now, we are undecided how to solve this problem. I am thankful for every suggestion.

Regards Felix

Answer 1

CanCan uses a simple authorization system based on a role column on the User model.

Here are some good links: Abilities
Role Based Authorization

Why do you need to dynamically set up privileges? Unless you have a compelling reason to do so you are just introducing unnecessary complexity. Just define the roles you need to with the correct abilities (you can do this on a controller/action basis with cancan) and then assign those roles upon creation/update.