{"comment":{"created_at":"2011-10-11T20:01:25Z","body":"I develop an engine that similar to forem and I need authorization system too. I think we need a special gem that can give us convenient way to organize authorization in mountable engines.","updated_at":"2011-10-11T20:01:25Z","url":"https://api.github.com/repos/radar/forem/issues/comments/2370445","id":2370445,"user":{"avatar_url":"https://secure.gravatar.com/avatar/9a878f08b4fabd6ec196af1a212dc129?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","url":"https://api.github.com/users/tanraya","id":201753,"login":"tanraya"}},"action":"created","issue":{"number":53,"created_at":"2011-10-02T04:15:33Z","pull_request":{"diff_url":null,"patch_url":null,"html_url":null},"body":"Last week, I spoke with somebody was interested to know if Forem had any kind of authorization system. I told him it didn't, because I didn't know how to build one for it as applications can have their own authorization system.\r\n\r\nSo I spent some time thinking about this on the plane ride back from Chicago. Here are my thoughts in no particular order. It would be great if I could get some feedback on this issue:\r\n\r\n### Permission system for forem\r\n\r\nIn many other forum systems out there, there are permission systems built into them. Forem is unique in that it's an engine and supposed to be pluggable into other applications, rather than being something standalone such as (my understanding) how phpBB and vBulletin work.\r\n\r\nThis complicates things. By creating our own permission system we would limit those people who may have their own permissions systems within their applications. This is definitely not ideal. Forem is already able to adapt to different *authentication* systems, so why not *authorization* also?\r\n\r\nI propose that we build a flexible authorization system into Forem so that people can set up permissions on their forem installs in the easiest way possible using their own authorization if that's what they have, or suggesting to use CanCan instead.\r\n\r\n#### How it works\r\n\r\nI think that we should have methods on the `User` class which define the permissions that people have. For example, there would be a `can_read_forum?` method which would take one argument and do something like this:\r\n\r\n    def can_read_forum?(forum)\r\n      permissions.where(:object => forum, :permission_type => \"read\")\r\n    end\r\n\r\nThe code inside the `can_read_forum?` method will be application-specific, but the API for the permissions is something that we should provide.\r\n\r\nThere could even be a possibility that we provide a `Forem::Permissions::Default` module which, when included into a `User`-like class, would then provide defaults for these permission methods, which then can be overridden in the model as the application designers wish. I think it would be best to have a blacklist-by-default, but I am open to ideas on this one on why it's a bad idea if anybody thinks so.\r\n\r\n#### Alternative API\r\n\r\nAlternatively we get them to include a module called `Forem::Permissions` which then provides the following API:\r\n\r\n   can_read_forum do\r\n     permissions.where(:object => forum, :permission_type => \"read\")\r\n   end\r\n\r\nThis then will store the given block which will be executed (using `instance_eval`) on the `current_user` object.\r\n\r\n#### Caveats\r\n\r\nWith this kind of permission system I cannot think of a clean way that you could allow anonymous access to forums (for example). How could we fix that?\r\n\r\nThanks lads!","comments":2,"title":"Authorization system","updated_at":"2011-10-11T20:01:25Z","url":"https://api.github.com/repos/radar/forem/issues/53","id":1794300,"assignee":null,"milestone":null,"closed_at":null,"user":{"avatar_url":"https://secure.gravatar.com/avatar/9a2a53db8e9b4476038c94a64b32833f?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","url":"https://api.github.com/users/radar","id":2687,"login":"radar"},"html_url":"https://github.com/radar/forem/issues/53","labels":[],"state":"open"},"legacy":{"issue_id":1794300,"comment_id":2370445}}