Take the 2-minute tour ×

I am trying to build one simple web site where users can write articles but admin needs to approve them before they show up on the web site. Also, after user creates article, article is not immediately sent to admin. User first needs to click on button "Send" on article properties.

I have this model:

create_table "articles", force: true do |t|
    t.string   "title"
    t.text     "content"
    t.datetime "created_at"
    t.datetime "updated_at"
    t.boolean  "published",   default: false
    t.boolean  "sent",        default: false

After user creates article, published and sent are false. In article properties user has "Send" button. After he clicks that button, published is still false but sent is now true. Now in admin control panel, admin sees new article and when he clicks button "Publish", both published and sent are now true. User who uploaded article can remove article and set published to false.

All actions I am doing for example like this:

<%= link_to 'Undo sent', article_path(article, :article => {:sent => false}), :method => :put %>

The problem is I don't know how to limit access. Regular user can change column sent to true and false but column published he can only change to false. Only admin can change column published to true and false.

How can I accomplish that inside my controller so it could be secure? All users have role column which I can access. Thank you.

share|improve this question
Use CanCan for the permissions ;) –  MrYoshiji Feb 24 at 21:28
@MrYoshiji, I already have everything set up. I don't need CanCan :) This is probably only one small problem. –  user3339562 Feb 24 at 21:31

1 Answer 1

You'll need to use something like a state machine:

Class Article < ActiveRecord::Base
    state_machine :initial => :pending do

    state :draft
    state :pending do
        validates :title, :body,
            presence: { message: "Needs A Value!" }
    state :queued
    state :sent
    state :error

    event :publish do
        transition :draft => :pending, :if => :valid_user

    event :queue do
        transition :pending => :queued, :if => :valid_user

    event :sent do 
        transition :queued => :sent, :if => :valid_user

    event :error do
        transition all => :error, :if => :valid_user

You can then use this for the permissions (used example code):

def valid_user
  if User.current_user.has_role?(xyz)
    do baa
share|improve this answer

Your Answer


