Authorization models

Although the act of authorization happens in the presentation layer, its roots lie much deeper—in the domain layer. To answer the question Am I allowed to…?, we usually rely on some properties of the domain objects. Thus, we rely on the domain model. The subset of the domain model responsible for authorization logic is called the authorization model. Let’s do a quick overview of common authorization models.

Domain-less authorization models

Technically, to perform authorization, we mustn’t have a dedicated model. For example, if you build an application in which a user can only work with their own data (for example, personal notes management), there is no need to introduce roles, permissions, and so on.

All you need is to verify that a target object belongs to the current user. We did this in the previous example, reproduced here:

class PostsController < ApplicationController  def destroy
    ...