Boris Staal

Boris Staal

About me

I'm Boris Staal, the enterpreneur geek ಠ_ಠ. I do open-source and make ppl smile ^_^.

Projects I'm part of:

Joosy

Rails-flavored browser applications framework

Roundbank

Open-source internet banking platform

Smartkiosk

Open-source kiosk platform

Rove.io

Service that allows you to pregenerate typical Vagrant builds

Protector

Comfortable white-list security restrictions for ORMs on a field level

WashOut

Rails 3 SOAP server library

Codo

CoffeeScript API documentation generator
twitter Last tweet was supposed to be here but Twitter blocked anonymous API requests ;(

Heimdallr: ORM field-level security

We are currently migrating most of our products to browser-side application. One of the worst issues it raises is proper permissions handling. There are no comfortable ways to implement context-based protection of models (and their fields) within ActiveRecord (Egor, say hi ;). attr_acessible is too weak. CanCan is too abstract (doesn’t go down to fields).

We’ve figured out something awesome to solve this issue. Meet Heimdallr and it’s extension Heimdallr::Resource. They will bring you a peace and security.

Heimdallr

Let’s start from the deeper problem investigation though. Large part of Rails projects equates security to a REST restriction. The bigger projects sometimes fall down to a model to keep code DRY. And to keep your controllers/actions number from getting wild you may fall down to fields.

Read more →
Comments

  • Rails + REST: views nightmare

    Rails is rapidly getting more and more popular as a comfortable platform for REST services. And it really is. We do Rails in this way for quite a long time already. There is however a real problem: JSON views are unmanageable!

    At first it may look like everything’s just fine. All you need is love .to_json or RABL is some particular cases. But then things go wild. And you start switching JSON Builders one after another.

    The problem

    Let’s say you have a banking service. That’s like 30 models. Each has extended CRUD endpoint (extensions are maybe 3 or 4 methods per endpoint). Each model has like 10 or 12 fields which are quite common to be large strings. And off course all that stuff is insanely linked up to like 4 or 5 levels of belongs_to.

    The another thing to remember is that in real life your JSON entities are not just dumps of your ActiveRecord attributes. Two very common things are conditions (whether an attribute should appear) and custom methods.

    The problem is that consumer often wants unique set of fields for EVERY method among EVERY endpoint. Set of relations’ fields can differ too!

    Read more →
    Comments
Newer entries right_arrow
Powered by Octopress; Hosted at Github; Stay tuned :)