Directory-based authentication in Rails

I think it’s safe to assume any Rails developer is familiar with something like before_filter :login_required at the top of any controller that, well, requires a login. One can’t complain about how tremendously easy that is. But I recently did something terribly stupid that has provoked me to take it a step further.

Don’t be Stupid

As you may know, I cleaned up my site for 2008. Well, in doing so I stripped out the inline admin interface in favor of a more organized (and RESTful) approach by adding an admin namespace. I love namespaces. But anyway, with the addition of these new namespace’d controllers, I forgot to add the one-liner: before_filter :login_required. And to top it off, I just realized this 2 nights ago. So all of my admin functionality was open to the public since December 31. Way. To. Go.

Putting a Directory on Lock-down

Granted that was completely my fault, I wanted to remove that worry, as well as the need for the login_required method to be called per controller. With namespaces, you get a nested directory within your controllers directory. In my case, I have: app/controllers/admin. That’s where all of my (you guessed it) admin functionality goes. It’d be much easier for me to just restrict access to that directory, so that any controller that finds its way in there automatically requires a login. Apparently, I just can’t trust myself anymore.

Now, this is the first run-through and I haven’t had the “go back the next day and clean it up” moment yet, but here’s essentially what I’m doing…

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

# controllers/application.rb
class ApplicationController < ActionController::Base    
  include Authentication
  before_filter :should_authenticate?
  # ...
end

# lib/authentication.rb
module Authentication
  RESTRICTED_NAMESPACES = %w(admin)

  protected

  def authenticate
    # choose your flavor...
    # (I'm using HTTP basic authentication)
  end

  def should_authenticate?
    RESTRICTED_NAMESPACES.each do |directory|
      if controller_path.match(/(^.+)\//)
        authenticate if directory.downcase == $1.downcase #&&controller_exists?($1)
      end
    end
  end

  #def controller_exists?(dir)
  #  controllers = []
  #  Dir.glob("#{RAILS_ROOT}/app/controllers/#{dir}/*_controller.rb").each do |f|
  #    controllers << $1.downcase if f.match(/^.+\/(.+)_controller.rb$/) 
  #  end
  #  controllers.include?(controller_name.downcase)
  #end
end

Note: I’m not sure if adding a :path_prefix in the route declarations will screw with the controller_path (I’m pretty sure it doesn’t), but that may be something to keep in mind.

Conclusion

I’m currently using this on my new portfolio, and so far it seems to work very well. It’s nice to just generate an admin::whatever controller and know that it’s automatically protected. I’ll probably modify this a bit for a plugin and start using it in other applications, so feel free to chime in if you see any obvious flaws that I may have missed.