Authorization Recipe

"Authorizing Users with Roles", Recipe 32 in Rails Recipes by Chad Fowler. (Published June 2006).

Builds from an existing User model, as described in Recipe 31 "Authenticating Your Users", or generated with
AAA.

This recipe builds two new models for Roles and Rights, such that Users have Roles, Roles have Rights: (HABTM =
has_and_belongs_to_many)
User HABTM roles
Role HABTM users
Role HABTM rights
Right HABTM roles

A right specifies a Controller name and Action name. Add a before_filter in your controllers to check_authorization,
which determines whether the current user has rights to the incoming action call. If not he's redirected to an error
page.

Simple enough, and bare bones. The implementation is not RESTful but that wouldn't be hard to change. More complexity
is left as an exercise to the reader.

URL:http://www.vaporbase.com/postings/Authorization_in_Rails