ruby on rails - RoR help protecting my CRUD links in the views -

i have 4 models:

class country < activerecord::base   has_many :postcards end  class postcard < activerecord::base   belongs_to :country   has_many :photos   has_many :tips end  class photos < activerecord::base   belongs_to :postcard end  class tips < activerecord::base   belongs_to :postcard end 

the routes nested this:

rails.application.routes.draw     resources :countrys     resources :postcards        resources :photos, :tips     end   end end 

i followed crud architecture , working fine, controllers working. used private / country_params create , update controllers method. but....

now realise if deploy app, can click links in views create/edit/destroy database.

what "good practice" solution limit access?

1. building user model me , take admin-right ?
2. creating new set of view without crud access ?(is possible?)
3. using admin gem (railsadmin or activeadmin) ?

to limit content on application accessed you, must implement simple authentication (who can see what) , authorization (what can see).

follow steps in tutorial implement simple authentication user model. when creating user model want add role field.

https://gist.github.com/thebucknerlife/10090014

this role field should validated such can role array of role types. include array of roles in user model , validate role of user in array.

roles = [['admin', :admin], ['guest',:guest]]   validates :role, inclusion: { in: %w[admin guest] }   

once have authentication in place (with login/sign views), can work on implementing authorization. use cancancan gem.

https://github.com/cancancommunity/cancancan

you want give access "admin" users, can define "abilities" of each user role type using gem. example:

class ability   include cancan::ability    def initialize(user)     user ||= user.new # guest user (not logged in)     if user.admin?       can :manage, :all  # can action on objects     else       can :read, :all  # can read things can't edit them     end   end end 

this give admin users rights in app, guest users read information. see cancancan docs more ways define abilities.

now, because have set abilities different roles, in controller can limit access functionality. can limit users sees.

<% if can? :update, @item %>   <%= link_to "edit", edit_article_path(@article) %>  <% end %>   

this code show "edit" button if user allowed edit item based on abilities have defined.