RealityForge.org

Posted by Peter Donald Sat, 12 Nov 2005 13:49:00 GMT

I did not realize that my blog was subscribed over at JavaBlogs.com so when I wrote my recent entry on AAA in rails I was surprised to get a comment like this one and despite the tone he did have a point. I should not have it subscribed at java blogs. The version of Typo I am using did not seem to support category based rss feeds. So I did a quick google for answers and found that others had added support this and it had even landed on the issue tracker . So I had a quick browse and decided it was easier to write myself and added a route and a quick hack to app/controllers/xml_controller.rb from

 def rss
    @articles = Article.find(:all, :conditions => 'published=1', 
 :order => 'created_at DESC', 
                             :limit => config[:limit_rss_display])
  end

to

 def rss
    joins = nil
    conditions = 'published=1'
    if params[:category]
    conditions = ['published = 1 AND categories.name = ? AND 
                    articles_categories.article_id = articles.id AND 
                     articles_categories.category_id = categories.id', 
                    params[:category] ]
      joins = ', categories, articles_categories'
    end
    @articles = Article.find(:all, 
                             :select => 'articles.*',
                             :conditions => conditions, 
                             :joins => joins, 
               :order => 'created_at DESC', 
                             :limit => config[:limit_rss_display])
  end

And it took me less than 15 minutes which includes time to go and make a coffee. Now that is why I have come to like rails. I may have been able to do the same in another framework but chances are I would have had to guess the table names, file locations, foreign keys etc. With rails I don’t really have to think if the app follows the conventions.

Posted by Peter Donald Fri, 11 Nov 2005 20:23:00 GMT

It is interesting to watch how the “login” discussion on the Rails Mailing List evolves. There is an abundance of choice for developers who want to integrate login functionality into a rails application. A sample selection;

• LoginGenerator
• SaltedHashLoginGenerator
• Auth Generator
• Model Security
• LoginEngine
• ActiveRBAC
• LoginGeneratorACLSystem
• AccessControlList
• Extensible Authorization for Rails

My current project requires “login” functionality so I thought I would have a look at some of these projects to see what they offered and to see how easy it would be to integrate one of the existing software products. To my dismay I found that all of them seemed to try and do too much of one thing or not enough of another. Now I think I am begining to understand why rails does not consider these components worthy of core or not evil but distracting .

All of the systems seem to mix different concerns in the one system. What I would like to see is the ability to separate out authentication from authorization. In the software I am currently developing users do not register for an account but must be explicitly added and passwords must not be stored in clear text. Next month I will be helping to develop a system where each user authentication attempt is delegated to an external system, if the user authenticates then a user account is created if it does not exist. If all goes well I will be developing another system about March next year that uses HTTP authentication.

However in each of these applications there will need to be a very similar concept of authorization. Each application will have a fixed set of parameterizable permissions, roles/groups that are granted these permissions and linkage between users and roles/groups. All of the solutions that I looked at seem to lump too much functionality together. If only they had separated out the pieces into smaller reusable chunks then I would be jumping at the chance to reuse them. As it stands it looks like I am going to end up reinventing the wheel as it is just less work.