A scope-based authorization library for Ruby on Rails that controls access by describing sets of accessible things.
Consul is a Ruby on Rails gem that provides scope-based authorization for web applications. It solves the problem of controlling what users can see or edit by allowing developers to define "powers"—sets of accessible resources like database records, screens, or assignable values. Unlike simple role-based systems, Consul focuses on describing accessible things directly, offering fine-grained and context-aware permissions.
Ruby on Rails developers building applications with complex authorization needs, such as multi-tenant systems, content management platforms, or any app requiring detailed access control beyond basic roles.
Developers choose Consul for its flexibility in handling diverse authorization scenarios, seamless Rails integration, and ability to define permissions as scopes or boolean checks. Its unique selling point is the "power" abstraction, which simplifies expressing access rules in a natural, Ruby-like way while supporting everything from simple CRUD restrictions to intricate business logic.
Scope-based authorization for Ruby on Rails.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Allows defining powers as ActiveRecord scopes or boolean checks, enabling precise access control from simple role-based scenarios to complex, context-dependent rules, as demonstrated with notes and users.
Integrates directly with Rails controllers via current_power and power directives, making it easy to protect actions and map powers to RESTful endpoints without boilerplate code.
Supports querying powers dynamically by name, model, or record, facilitating generic helper methods and flexible logic, as detailed in the dynamic power access section with examples like include_record?.
Leverages the assignable_values gem to restrict attribute assignments based on user context, adding an optional authorization layer to models for fields like states or associations.
Lacks native role-based permission support, requiring developers to manually implement role logic in the Power class, which can lead to verbose and error-prone code for complex hierarchies.
Scope-based record checks default to fetching all IDs, which may not scale for large datasets without manual optimization, as admitted in the README's 'Optimizing record checks' section.
Setting up power mappings for nested controllers with context and map options can become verbose and confusing, increasing the risk of misconfiguration in multi-resource scenarios.