0

I have a Rails 4.2 app that uses rails_admin to manage CRUD actions for its models. It requires current_user.admin? == true for access.

I have just added A/B testing using the Split gem. I want to use the same authorization to allow admin only to view the split dashboard and thought the easiest way might be to create the route within the admin panel such that the dashboard would be available at example.com/admin/split.

I can mount the Split::Dashboard at 'admin/split' but that simply bypasses the admin authorization altogether.

Instead, I want to add a button/link with the rails_admin dashboard that redirects to admin/split where the dashboard is mounted within rails_admin.

Help appreciated.

user2799827
  • 1,077
  • 3
  • 18
  • 54

1 Answers1

0

split's webinterface is a sinatra app. It will not know anything about the rails_admin engine just by mounting it into the same url path. Check out the doc for the split interface https://github.com/splitrb/split#web-interface. and https://steve.dynedge.co.uk/2011/12/09/controlling-access-to-routes-and-rack-apps-in-rails-3-with-devise-and-warden/

Rack::Auth::Basic will obviously not work for you, since it's basic http auth. So you have to use the second method by sticking you custom request middleware. The current_user will not be available there, since it's added by typical auth gems into the rails controllers. However if your lib is using warden for authentication ( like devise does), the info will be in request.env['warden']. Otherwise you will have to get the session id out the request.env["rack.session"]

dre-hh
  • 7,840
  • 2
  • 33
  • 44
  • thanks dre-hh. `match` would not work in the routes. however the following basically works to limit access to admin users via devise: ```mount Split::Dashboard, :at => 'split', :constraints => lambda { |request| request.env['warden'].authenticated? # are we authenticated? request.env['warden'].authenticate! # authenticate if not already # or even check any other condition request.env['warden'].user.admin? }``` The remainder is to gracefully handle the case of non-admin users. In that case it currently throws the error, 'no route matches get /split'. Anyway thanks much! – user2799827 Feb 22 '16 at 18:37