intridea/grape — pull request #219 by wyaeld (2012-07-31 22:42:09+00:00)
Title: Initial idea to add permission based whitelisting to params

This pull isn't really intended to be merged as-is, but more as a convenient way to start a dialogue around the concept. It does work and included tests.

This is conceptually similar to the new StrongParameters built for Rails, in this case for each endpoint you can add a list of parameters to the Endpoint via permit(:foo, :bar, :baz) that will deny anyone calling that endpoint with params not on the whitelist.

This initial example only handles the most simple path. The deep merging of params causes a problem, it would likely be necessary for a full solution to automatically filter permit params coming from rack. Currently I used a simple hack of passing an alternative params hash to this particular validator.

I personally agree with the emerging trend that parameter whitelisting is a concern for the controller/api layer, and you should have the flexibility to permit based on the particular action that is occuring, rather than just declaring accessible in the models. In complex applications that isn't always sufficient, especially if different endpoints in the API serve different levels of authorisation.

What do other people think?