How to lock actioncable chat to admins only?

Question

Hello Guys thank you for taking the time to check out my question.

So to explain a bit as the title might not do the question justice,

I would like to learn the best way i can go about setting a method that checks for role and if it's admin then go ahead to let the person into actioncable chat if not then block all connections.

So to sum it all up: as this is real time i guess i need to have some kind of start check in the js part of actioncable room/connection handler and then in the ruby side of the things.

I do not want a full run down as this would be to much to ask from you.

just a small stepping stone.

devise is used for account handling and i have made my simple roles system.
i use redis to handle the background job for creating a message.

My first simple approach to this was just check the role before create action to the message but that still leaves a connection open to the actioncable/redis/chat.

As mentioned any pointers would be greatly appreciated

Thank you in advance.

why don't add the check to the incoming websocket connection handler and reject it otherwise? — max pleaner, Feb 23 '17 at 23:35
@maxple tried to add a check in my connection.rb but it did not work the logic failed and all connections were rejected. — EVX, Feb 28 '17 at 10:37

score 1 · Accepted Answer · answered Feb 28 '17 at 11:04

The solution

def connect
  self.current_user = find_verified_user
  logger.add_tags 'ActionCable', current_user.email, current_user.access
end

protected
def find_verified_user
  if (current_user = User.find_by_id cookies.signed['user.id'])
    if(current_user.access == "mod")
      current_user
  else
    reject_unauthorized_connection
  end
end

end end end

How to lock actioncable chat to admins only?

1 Answers1