A permissions plugin for Rails.

It lets you mark specific controller methods as accessible only by users who are members of specific groups.

script/plugin install git://github.com/epitron/permissions.git

This plugin adds the permit classmethod to ActionController::Base, so that you can specify permissions in your controllers. It works almost the same as before_filter.

permit(roles, options={})

For example:

permit :user, :only=>[:show, :index]

This rule gives users access to read in your standard CRUD controller.

You can specify multiple roles at the same time:

permit [:admin, :manager]

This will permit admin and managers for all actions.

The plugin checks the user's permissions by reading current_user.roles and seeing if any of the roles on the user match the roles on the rule. If they do, the rule becomes active.

You can specify a rule that applies to all users with the special role :all.

The options you can pass are:

• :only => <symbol or array of symbols> -- only protect specified method(s)
• :except => <symbol or array of symbols> -- protect everything except specified method(s)

Allow all users to access all methods (overrides previous permissions):

permit :all

Allow the user with role :role to access only the "show" method:

permit :role, :only => :show

Users with the roles :role2 or :role3 can access all methods except :method1 and :method2.

permit [:role2, :role3], :except => [:method1, :method2]