Problem with rails + json

my controller admin

  def index_all_for_question_id

      @answers      = Question.find(params[:id]).answers


    respond_to do |format|
      format.ext_json { rend开发者_高级运维er :json => @answers.to_ext_json(:class => Answer, :include => [:respondent]) }
    end
  end

my dataStore in extJS

 var answers_datastore = new Ext.data.Store({
    autoLoad: true,
    proxy: new Ext.data.HttpProxy({
       url: '/answers/index_all_for_question_id/<%= @questions.first.id %>?format=ext_json',
        method: 'GET'}),
        reader: answers_reader
        });

My question is: When i trying to enter localhost:3000/answers/index_all_for_question_id/551?format=ext_json for example,

I get :

{"results":2,"answers":[{"answer":{"scale":1,"inquiry_id":277,"created_at":"2011-05-30T07:10:22Z","updated_at":"2011-05-30T07:10:22Z","text":"dfgfdghfdhfdh","id":275,"respondent":{"created_at":"2011-05-16T06:47:08Z","updated_at":"2011-05-16T06:47:08Z","id":109,"user_id":6,"email":"xxx@xxx"}}},{"answer":{"scale":1,"inquiry_id":278,"created_at":"2011-05-31T12:33:36Z","updated_at":"2011-05-31T12:33:36Z","text":"lolololol","id":290,"respondent":{"created_at":"2011-05-25T11:22:55Z","updated_at":"2011-05-25T11:22:55Z","id":110,"user_id":6,"email":"xxx@xxx"}}}]}

SO i dont what it! Every user can enter this line i get answers (if he not an admin). How i can solve this problem? Only admins can see this, for others should be redirect on some page or appears text "Sorry!".

Thank you

Hi I think that the simplest solution is to write custom before_filter where you can check if user has admin role and redirect to some page if no also you can use CanCan for authorization purposes

I'd use HTTP authentication. Redirect is a bit tricky to implement, here's an example (using sessions):

class AdminController < ApplicationController
  before_filter :authenticate

  USER_NAME = "admin"
  PASSWORD = "xyz" # PS: you should use hashed passwords

  def admins_only
    render :text => "TOP SECRET STUFF!"
  end

  protected

  def authenticate
    if authenticate_with_http_basic { |u,p| u == USER_NAME && p == PASSWORD }    
      true
    else
      if session[:http_auth_requested]
        session[:http_auth_requested] = nil
        redirect_to '/sorry_page' and return false
      end

      session[:http_auth_requested] = 1
      request_http_basic_authentication
    end
  end
end