Rails%203%20In%20Action

This chapter covers
� Adding an authorization flag to a
database table
� Locking down access based on a
database flag
Basic access control
As your application now stands, anybody, whether they’re signed in or not, can create
new projects. As you did for the actions in the TicketsController, you must
restrict access to the actions in the ProjectsController. The twist here is that
you’ll allow only a certain subset of users—users with one particular attribute set in
one particular way—to access the actions.
You’ll track which users are administrators by putting a boolean field called
admin in the users table. This is the most basic form of user authorization, which is
not to be confused with authentication, which you implemented in chapter 6.
Authentication is the process users go through to confirm their identity, whereas
authorization is the process users go through to gain access to specific areas.
136