Proper place to propose a permissions predicate?

[mdoggydog]

Here is what I have learned/deduced:

• Guardian is indeed the thing that encapsulates “What is the user allowed to do?” (A Guardian instance has-a User instance, too.)
• Thus, the proper place for a permissions predicate is simply as a method on Guardian (lib/guardian.rb).
  • If the method is a “Can the user do Z to an Xxxx object?” then it probably belongs in one of the XxxxGuardian mixin files (lib/guardian/...).
  • Otherwise, it goes into the base Guardian definition.
• ApplicationController manages a guardian attribute reflecting the current request/client, and provides it to serializers as their scope, so the current Guardian is available when needed (except when it isn’t^[1])
• There are places where a ready-made Guardian is not available, typically in a backend task run by the system, but if you have a handle on an “acting user” (e.g., the recipient user, when generating an email notification), you can create a appropriate guardian on the fly: Guardian.new(the_user) .

---

1. Forwarding the `scope:` down a tree of serializers: just do it, or not?

   Serializers can be provided with a scope: parameter intended to provide the permissions-context for the serializer. In the Discourse code, the provided scope is a Guardian, and it looks like every serializer is intended to receive a Guardian as its scope. ApplicationController (the base class of all the controllers) maintains a Guardian and it has multiple mechanisms to try to ensure that Guardian is injected as the scope: for all serializers. However, not every scenario is not covered by the…

   ↩︎