smidig/conference-app — pull request #50 by badeball (2013-06-10 19:38:19+00:00)
Title: Whitelisting based authorization

This introduces a whole new concept of authorization in the application. Instead of blacklisting access to actions, all actions are inaccessible by default. The access to actions is modified using no_authorizaion!, authorize_user! and authorize_admin!, which are all fairly self explanatory.

In addition, there is a method called authorize! which is used to implement authorization logic that is not trivial. It takes the same arguments as the previously mentioned methods + a block. Within that block, you can assert access and do or not do call

**Note:** No levels of access has been changed, presumably. Tests in `authentication_spec.rb` confirms this.

Examples of controllers utilizing the new methods.

```ruby
class DummyController < ApplicationController
authorize! :only => :index do
permission_denied("No one can ever access dummy#indxex!")
end
end

class DummyController < ApplicationController
authorize_admin! :except => :index
authorize_user! :only => :index
end
```