radar/forem — Issue #119: Feature request: Access Control Lists
Author: rizzah
Created: 2012-01-06 19:04:28+00:00
State: open

I had opened a request previously for authorization by groups, that was closed, I assume due to me not updating. Now that the holidays have ramped down, here's a little proof of concept of what i was thinking....

I added a column to the categories table

add_column :forem_categories, :groups_view, :string, :default => nil

I then added something like this, which points to the ACL, in the model for forem_categories

serialize :groups_view
has_and_belongs_to_many :roles

I then store in the categories table an array of group ids that relate back to roles model and add the following in the users model...

def can_read_forem_category?(category)
role_id = "#{self.role_id}"
if category.groups_view.nil?
true
elsif role_id.nil? or role_id.blank?
false
elsif category.groups_view.include?(role_id)
true
else
false
end
end

Not the most elegant, but effective to control categories read access. I'm in the process of doing something similar for the other authorization methods you have outlined in the wiki. It makes more sense to have a Forem::Group class, like the Forem::User class in which people could define their own classes to do similar fine grained permissions.