authority

Kudos on picking up and moving forward an existing Rails plugin gem rather than writing yet another. Too many Rails gems get left in the dust after a few years. CanCan is a great library, and is well-documented! That being said, I've found (the hard way) that how CanCan declares "abilities" isn't flexible enough. The declarations got out of hand as my app grew larger and the maze of who can do what got more complex. CanCan tries to reduce complex authorization logic down to a very simple DSL. I applaud the effort, but it falls apart on larger apps. (I am perfectly willing to admit that I probably just "did it wrong", but in the end, I decided something less clever and more along the lines of "just Ruby" would be more up my alley.) I've switched over to using the Authority gem [1] for authorization, which doesn't try to be quite so clever.

>> One of the simplest and most fundamental rules of effective security is to close everything down by default and only open things up as required, after careful consideration. Which is why my Rails authorization library takes a whitelisting approach. https://github.com/nathanl/authority#default_methods

+1. If I wanted to rummage through a pile of classes and methods to figure out where to start, I'd just read the code. I want a conceptual overview, usage examples, and some discussion of edge cases. I've rabidly documented my Rails authorization library, and I'd attribute most of the attention it's gotten to the documentation. https://github.com/nathanl/authority

I'm also a big fan of ASCII diagrams. The ones I use to explain my Rails authorization gem, Authority (https://github.com/nathanl/authority#the-flow-of-authority), were made using a great tool called Asciiflow: http://www.asciiflow.com/

Authority is my new Rails authorization plugin. Why another one? Some things that make it different: - 100% ORM neutral - No new DSL to learn; just plain Ruby methods - Authorization logic goes in authorizer classes, so any inheritance pattern you want is fine - Helps you organize your logic, but that logic can be anything you can write in Ruby: check permissions in a database, or how many points a user has (like StackOverflow), or a weather report from London for all it cares. Extensive tests and friendly documentation await you at the repo: http://github.com/nathanl/authority

Authority is my new Rails authorization plugin. Why another one? Some things that make it different: - 100% ORM neutral - No new DSL to learn; just plain Ruby methods - Authorization logic goes in authorizer classes, so any inheritance pattern you want is fine - Helps you organize your logic, but that logic can be anything you can write in Ruby: check permissions in a database, or how many points a user has (like StackOverflow), or a weather report from London for all it cares. Extensive tests and friendly documentation await you at the repo: http://github.com/nathanl/authority