acl9
A concise DSL for role-based authorization in Rails applications, focused on clarity and testability.
What is acl9?
Acl9 is a role-based authorization gem for Ruby on Rails applications. It provides a concise DSL for defining access control rules directly in controllers, helping developers secure their apps with clear, testable permissions. It solves the problem of complex, hard-to-verify authorization logic by making rules visible and straightforward.
Rails developers building applications that require granular, role-based permissions, such as multi-tenant systems, admin panels, or educational platforms.
Developers choose Acl9 for its emphasis on clarity and testability—its DSL keeps permissions obvious in controllers, and its design makes it easy to ensure authorization is correct, reducing security risks.
Overview
Yet another role-based authorization system for Rails
Use Cases
Best For
- Adding role-based access control to Rails admin interfaces
- Securing multi-tenant applications where users have roles per resource (e.g., school admins)
- Implementing granular permissions for controller actions in Rails APIs
- Projects needing testable authorization logic to avoid security gaps
- Rails apps transitioning from simple authentication to structured role management
- Teams prioritizing readable, maintainable access control code
Not Ideal For
- Projects not using Ruby on Rails, as Acl9 is tightly integrated with the Rails framework and its DSL
- Teams preferring policy-based authorization (e.g., with Pundit) over controller-centric logic for better separation of concerns
- Applications with only simple, static role checks (e.g., admin/user binaries) where lighter gems like CanCanCan might suffice
- Systems requiring dynamic, runtime-configurable permissions, since Acl9's rules are defined statically in controllers
Pros & Cons
Pros
Access control is defined directly in controllers using declarative `access_control` blocks, making permissions visible and easy to review without hunting through models or policies.
Supports roles assigned to specific objects (like a school) or globally, enabling fine-grained, multi-tenant permissions as shown in the roles examples.
Built with an emphasis on readability and testability, helping developers verify authorization rules are correct and reduce security oversights, as stated in the philosophy.
Offers settings like role normalization and global role protection, adaptable through configuration files, allowing customization for different application needs.
Cons
Full role management requires additional migrations and models via generators, adding overhead compared to simpler boolean methods, though optional.
Major version updates introduce breaking defaults, such as flipped `:protect_global_roles` and role name normalization, requiring manual data migration and careful review, as noted in upgrade notes.
Authorization logic is embedded in controllers, which can clutter code and conflict with architectures that prefer policies or services for better separation of concerns.
Frequently Asked Questions
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.