mx3/mx — Issue #31: Review, fix minor issue, and potentially update login system
Author: mjy
Created: 2011-12-07 05:38:42+00:00
State: open
Labels: tasks

We might consider updating to a gem based authorization/roles project at this point. At present everything actually works except users can view/edit projs (the project record itself) they don't belong to.

I don't see a huge need to change, except perhaps to get some OPENIDesqe functionality integrated (login with my whatever account), and we might position ourselves to better define roles for future feature requests. Comments/thoughts welcome.

Quick overview of the required functionality, the setup is pretty basic:

A request either comes from a logged in user, or it doesn't. All those controllers in /api or /public do not require login, all other controllers require login.

In addition controllers 'admin', 'namespaces', 'image_views' can only be CRUD viewed by a person with is_admin = 1. Other methods internal to them must be accessible in some cases (e.g. autocomplete_for_image_views).

A logged in user can only view resources that belong to a proj that he/she is a member of. This is checked (presently) in the appliccation_controller by comparing the session[:person] to the users in @proj. @proj is currently set on every request (perhaps we could memcache it for a speedup?).