Rails Design Question: How should I structure my controllers for multiple privilege levels?

I am writing a site with multiple levels of privileges. There are basically 3 kinds of users in my system. They are Admin, Business, and Consumers (normal users). Let's just say that I am building an advertising site.

So I have a model "Campaign" which has a RESTful API that comes with rails scaffold. Businesses can create campaigns开发者_如何学编程, users can only see which campaigns they want to join, and admins can do everything.

Now, I know how to apply before_filter and check rigorously for the type of users that can access a particular view.

However, each level of privilege has its own unique views.

Businesses can see the insights and analytics of their campaigns. (let's call this campaigns/analytics) Consumers can see all the campaigns that they have participated in. (let's call this campaigns/your) And admins have special views where they can monitor the site's activity. (let's call this campaigns/monitor_businesses).

Right now, my CampaignController has the usual RESTful views + analytics + your + monitor_businesses. Of course, I have multiple data models (not just campaigns) and this makes my RESTful controllers for those data models to be really messy.

What should I do? I am seriously considering starting a ConsumerController and then a BusinessController and put all associated views in these controllers. I don't know if this violates "RESTful" principles but I want to know what better patterns exists to deal with my problem.

I am open to all kinds of suggestions.

Why dont you try the CanCan gem for role management? You can install as you would any gem using bundler.

It is easy to set up and keeps you from creating the same boilerplate code that you normally would by creating extra controllers or actions.

To get you started I suggest that you visit the documentation on the main page. There is more information about defining what a user can do here and you can see how to check for abilities here. You also need to add one line to controllers you want to enforce permissions on which you can read about here.

If the standard documentation isnt enough to get you started why don't you take a look at Railscast 192. It shows you how to get up and running with CanCan and it is a great source because Ryan Bates is the creator of the screencast as well as the creator of CanCan. If the video moves too fast for you there is a text version here.

y dont you try the cancan gem for role management http://rubygems.org/gems/cancan

or do gem install cancan I hope this helps.