Action Policy VS CanCanCan

Use Action Policy or Pundit, and write tests for your policies. Authz is worth testing with near complete coverage.

You may ask what's makes Active Entry better or different from other gems like Pundit, Action Policy (especially), or CanCanCan.

Would you do : 1. a roles table with the name of the role and 64 booleans? 2. A roles table with one JSON field? (using rails json data type) 3. A roles table and a permissions table, similar do what is suggested in the cancancan developpers guide:

Expressing authorization rules can be a bit challenging with the use of other authorization gems, such as pundit or cancancan. The resource_policy gem provides a more concise and expressive policy definition that uses a simple block-based syntax that makes it easy to understand and write authorization rules for each attribute.

https://github.com/CanCanCommunity/cancancan (Ruby on Rails ABAC) Same like casl.js, but for Ruby on Rails! Casl.js was actually inspired and modeled by cancancan.

In production code you would most likely use a library for access control, such as CanCanCan

PS If you do mobile / web work (or something else with "detached" UI), I find that declarative access control rules are far superior to imperative ones, because they can be serialized and shipped over the wire. For example, backend running cancancan can be easily send the same rules to casl on the frontend, while if you used something like pundit to secure your backend, you either end up re-implementing it in the frontend, or sending ton of "canEdit" flags with every record.

You can use a gem like cancancan (https://github.com/CanCanCommunity/cancancan )to manage authorization, and its helpers to show stuff based on what a user can do

It fails deadly -- forgetting to pass an instance grants unintended access, and this problem is so bad they have a document explaining how to avoid it. If you use a permission in an unintended way, it should not grant access.

CanCanCan: CanCanCan is another authorization library for Ruby and Ruby on Rails. It is an alternative to CanCan and is currently being maintained. With 4.9k stars on GitHub, it is the least popular, but it works pretty well and is well maintained.

I have worked on Ruby On Rails for 10 years now, and I also became the maintainer of one of the most historical gems, CanCanCan. Ruby On Rails was my bet ten years ago, when I quit my previous job, to switch from Java to Ruby, and to move from Italy to Switzerland at the same time.