Performance implications of authorization
As with any abstraction, we also need to take performance into account. Sometimes, abstractions providing great developer experience may do so at the price of poor performance. That’s especially critical for authorization since, as we learned, it permeates the whole application.
Let’s discuss a couple of the most common performance implications related to authorization.
The N+1 authorization problem in the representation layer
Let’s imagine a typical table-like interface showing many records along with the possible actions the current user can trigger for each one. For example, that could be a list of blog posts, and the possible actions could be publish, delete, and edit.
The corresponding view template could look like this:
<%= posts.each do |post| %> <div> <%= link_to post.title, post %> <% if allowed_to?(:publish?, post) ...
