[Question] Preventing unauthorized access to a resource's stream about motion HOT 2 CLOSED

@mrrooijen You have exactly the right idea! 🎉

Just like in ActionCable, only code on the server can call stream_from/stream_for and you are free to guard that with whatever application logic that you would like.

However, Motion takes this a step further by allowing you to to choose exactly what about each message is available to the client. Since only the rendered markup is exposed, anything that you do not explicitly choose to display will not be visible to the client. In fact, if you choose to ignore a message completely (by not changing the component's state at all in response to it), it isn't even possible for the client to observe that a broadcast was received:

def new_message(message) 
  return if message.hidden_from?(current_user)

  @messages << message
end

Unrelated: You probably do not need to pass in the current_user explicitly in this context.

from motion.

Brilliant. Thanks for clarifying!

Unrelated: You probably do not need to pass in the current_user explicitly in this context.

Yeah, you probably don't even have to perform checks at this stage in many cases. The fact that you're rendering the component likely means that the current_user has access to the resources in the first place.

from motion.