Alternative for CanCan? [closed]

Closed. This question is seeking recommendations for books, tools, software libraries, and more. It does not meet Stack Overflow guidelines. It is not currently accepting answers.

---

开发者_JS百科

We don’t allow questions seeking recommendations for books, tools, software libraries, and more. You can edit the question so it can be answered with facts and citations.

Closed 7 years ago.

Improve this question

I use rspec, devise and cancan at the moment. To be honest, I find cancan to be very confusing and I am encountering a lot difficulties in picking it up and using it effectively. The docs are not very in depth making this extremely difficult for me to debug (check my past questions).

Is there an alternative to CanCan that's also easily integratable in the other tools I am using?

---

As of early 2014, Pundit is a popular alternative to CanCan (and the successor CanCanCan). Pundit matches each controller with a policy object. Unlike CanCan, there's no central rule file for all access control. It's simpler than CanCan. There's an example app from the RailsApps project:

Rails Pundit Example

I've also written a tutorial on Rails Authorization with Pundit.

Another alternative is the Authority gem from Nathan Long. All your rules logic goes in Ruby classes called "authorizers" that are associated with models.

---

Some guys are continuing the development of cancan. Check it out:

https://github.com/CanCanCommunity/cancancan

---

For the same reason i've done this: http://mcasimir.github.com/checkin/.

Checkin is an authorization gem that is independent from the role/authentication library you use.

You can express even complex rules rather simply with a declarative/cascading permissions DSL.

I found it very handy. The debug is also supported via the explain method that will log the authorization process on every request.

Here are some of the features:

• Handy DSL to define roles and permissions with a declarative approach
• Check authorization for CRUD operations automatically
• Standard way to rescue from Authorization errors
• Authorization subject decoupled from model (compatible with any autentication system)
• Role-based authorization decoupled from role system (compatible with any role system)
• Decorator for current_user and other subject objects
• Scoped authorization rules
• Cascading authorization rules
• Simple: even complex authorization behaviour is understandable at glimpse and easily predictable
• Support for controller based mass assignment protection

Here is a very simple example of the DSL:

class UserSubject < Checkin::Subject

      role :guest, :alias => :anonymous do
          !subject_model
      end

      role :logged_in, :alias => [:connected] do
          !!subject_model
      end

      role :owner, :require => [:logged_in], :method => :own do |object|
          object && ( object.respond_to?(:author) && ( subject_model == object.author ) ) ||  ( object.respond_to?(:owner) && ( subject_model == object.owner ) )
      end

      role :administrator, :require => :logged_in, :alias => :admin do
          subject_model.has_role?(:administrator)
      end

      #
      # Permissions
      #

      permissions :for => :comments do
        allow :administrators
        allow :logged_in, :to => [:create]
        deny
      end

      # Admin

      scope :admin do
        permissions do
          allow :administrators
          allow :owners,  :to => [:edit, :update]
          deny
        end
      end

end

Checking roles and permissions:

subject = UserSubject.new(User.first, :scope => :admin)
subject.logged_in?
subject.guest?
subject.own?(Post.first)
subject.can_edit?(Post.first)

I apologize for being so wordy.

---

I found https://github.com/stffn/declarative_authorization to be rather complete. And it's logical to use.

---

Sounds like Pundit may be coming up strong. It has a less 'magic', more straightforward approach.

https://github.com/elabs/pundit

---

I am currently exploring Heimdallr. The one feature it has that most of these cancan alternatives don't are restricted scopes for index actions.

---

You also might want to check out this "ultra lite authorization library" - six

---

Check TheRole gem. very interesting alternative for cancan

---

I'd recommend Action Access, it's much simpler and straightforward, has seamless integration with Rails and it's very lightweight. It boils down to this:

class ArticlesController < ApplicationController
  let :admin, :all
  let :user, [:index, :show]

  # ...
end

This will automatically lock the controller, allowing admins to access every action, users only to show or index articles and anyone else will be rejected and redirected with an alert.

If you need more control, you can use not_authorized! inside actions to check and reject access.

This makes controllers to be self contained, everything related to the controller is within the controller. This also makes it very modular and avoids leaving forgotten trash anywhere else when you refactor.

It's completely independent of the authentication system and it can work without User models or predefined roles. All you need is to set the clearance level for the current request:

class ApplicationController < ActionController::Base
  def current_clearance_level
    session[:role] || :guest
  end
end

You may return whatever your app requires, like current_user.role for example.

It also bundles a set of handy model additions that allow to extend user models and do things like:

<% if current_user.can? :edit, :article %>
  <%= link_to 'Edit article', edit_article_path(@article) %>
<% end %>

Here :article refers to ArticlesController, so the link will only be displayed if the current user is authorized to access the edit action in ArticlesController. It supports namespaces too.

It allows to lock controllers by default, customize the redirection path and the alert message, etc. Checkout the documentation for more.

---

There's also Consul.

You create a Power class with methods that return only those objects the user has access to, instead of loading objects and check permissions on them. Talk by the author.