Implement authorization for ActiveRecord methods - mysql

Question

I've been trying to implement an authorization layer on top of ActiveRecord. Let me explain how that is supposed to work.
Databases
Consider a database table Invoices with the following fields
InvoiceId
CustomerId
... other fields
There will be an auxiliary table InvoicePrivileges with the fields
ObjectId (referring to an invoice id)
SubjectId (referring to a customer id in this case)
Subject type (to handle multiple kinds of users - customer, admin, operator, etc)
Read (boolean)
Write (boolean)
Authorization checks
To be able to read an invoice, the entity attempting to read the row or set of rows must have a set of entries in the InvoicePrivileges table (where InvoicePrivileges.object_id refers to an InvoiceId) with InvoicePrivileges.read = true.
Example, a query to fetch a bunch of invoices from the DB
SELECT invoice.*
FROM Invoices invoice
LEFT JOIN InvoicePrivileges privilege
ON invoice.invoice_id = privilege.object_id
AND privilege.subject_id = <user_id>
AND privilege.subject_type = <user_type>
WHERE privilege.read = TRUE;
The same condition applies when trying to update an invoice, except the last WHERE condition becomes WHERE privilege.write = true.
Implementation
I can use the Arel library to create these constraints with ease. However, where do I implement these methods in such a way that all ActiveRecord save and update actions include these constraints?
I don't mind writing a bit of code to enable this. I'm looking for pointers as to how best to go about it.

Answer 1

Create a gem and require it after ActiveRecord gem. In your gem open up ActiveRecord classes and override the interested methods.
module ActiveRecord
class Base
def save(*)
if(authorised?)
super
else
raise NotAuthorisedError.new("Your meaningful message!")
end
end
end
end
The original code from Rails source is in Persistence class. All persistence methods usually use create_or_update method internally. So, you might consider overriding that method instead. But, you need to look through the code and see if that's a good idea.