Rails Design Pattern for Multiple Devise Log-Ins Managing One Set of Data

Question

---

EDIT: What's the design pattern for an app that does the following: A business sets up an account with the app. The business then creates "employees" in the app that can log in separately and CRUD the business's data, except for what their employer marks as off limits?

I've run into a problem with the hostel app. Here we go:

My app, a hostel management SaaS, has many users. These are hostels. The owner of the hostel signs up for my app via Devise. current_user is always the hostel itself.

Hostels have_many guests and each guest belongs_to a user(the hostel). These are people who call/email and want to spend a night in the hostel. Thanks a ton to everyone for helping me with the availability calendar.

All is fine and dandy now. Normally, the hostel owner or manager logs into my app, books rooms, emails guests, sends invoices, upload financials, you name it. However, many have been requesting the ability to add employees that can log in separately and create reservations, send emails, etc, but NOT view financial info. Enter CanCan.

Here's where I'm stuck. It's easy enough to delegate abilities and authorizations. Devise also gives me the ability to set up multiple devise models. However, I'm stuck with how I can give the employee, once they log in, access to their employer's data. The current_user.id is going to be different than their employer's ID(the business that signed up), so how can I tell Devise to use the ID of their user?

class User
  has_many :employees
end

#should I do something like this?
class Employee
  belongs_to :user

  has_many :guests, :through => users
  has_many :reservations, :through => users
  has_many :rooms, :through => users
end

I thought about doing something like this below:

current_user.id = current_employee.user.id

The only problem is, it smells. There must be a better way. Once the employee logs in, everything is going to look the exact same as when their boss logs in(show all reservations, all guests, all emails, etc), the employee will just be restricted from certain areas.

The same current_user on multiple models in devise is mostly workarounds and hacks. https://leanpub.com/multi-tenancy-rails seemed kind of in the right direction, but it's a bit too much for what I need. There must be a specific design pattern for this situation, but I can't seem to find it or even get Googling in the right direction.

Basically, how do Rails apps give their users the ability to create sub-users, and let those sub-users view the user's data with restrictions?

Any help getting my thoughts straightened out is much appreciated.

Answer 1

Is there anything wrong with a simple override of the current_user method?

class ApplicationController
  def current_user
    super || current_employee&.user # safe operator for ruby 2.3+, otherwise `current_employee.try(:user)`
  end
end