title: How to limit who can call a method in ruby
body: <p>I'm looking for a good ruby way to limit who can call a method. The example occurs within a rails environment but its not specific to rails.</p>
  
  <p>I have a Model called Document that handles finding documents within folders. Folders are permissioned so I have a class that handles Permissions. In heavily simplified form Permissions exposes the interface to retrieve Documents:</p>
  
  <pre><code>class Permissions
      def documents(folder_list)
          #strip folders from folder_list user doesn't have permissions for
          Document.where("folder.name in (?)", permissioned_folder_list)
      end
  end
  </code></pre>
  
  <p>Functionally this works fine but rspec testing is a nightmare when the querying is much more complex than this simplified example. We end up with lots of expectations that are to do with the mechanics of how Documents are stored. Really I want to have something more like this:</p>
  
  <pre><code>class Permissions
      def documents(folder_list)
          #strip folders from folder_list user doesn't have permissions for
          Document.documents(permissioned_folder_list)
      end
  end
  
  class Document
      self.documents(folder_list)
          Document.where("folder.name in (?)", folder_list)
      end
  end
  </code></pre>
  
  <p>Which would be nicely factored and easy to test. The trouble is this now provides an interface on Document which looks like a nice domain-level interface but completely bypasses permissions. Its very easy for someone to come along and use this and get reasonable-looking results which are wholly incorrect.</p>
  
  <p>What I'd like to do is prevent the Document::documents method from being called by anything other than an instance of Permissions. Its not foolproof as you can still call all or where and bypass permissions but then you have to recreate all the complex query logic when there is a method that clearly handles all that for you, but you can't call it unless you go through Permissions.</p>
  
  <p>Whats the idiomatic ruby way of doing something like this? BTW, because permissions are stored in the user's sesion session, calling Document and having it call Permissions rather than calling Permissions and having it call Document is pretty messy.</p>