How to apply permissions

Question

I'm wondering how to implement some permission logic in a Rails 2.3.8 app.

For example, a user can only edit tasks the user created (aka "owns").

Should I do something like this:

user.can_edit_task(task)

or this:

task.can_be_edited_by?(user)
#Method needs to be passed in a user object (from controller). But then how 
#can I access the current user in a "before_save" filter as below : 

.

def User
  before_save: check_permissions!

  def check_permissions
    #this way?
    raise some_exception if task.can_be_edited_by?(user)
    #or this way?
    raise some_exception if self.can_edit_task?(task)
  end
end

Any tips on how to go about this?

Answer 1

Please try to adopt some of existing plugins like cancan

It will save your life.