Ruby on Rails Link Sharing: Google Docs Style

Question

What would be the best way to allow users to use a personal link that allows everyone who clicks on it to view a specific page / document / item with privacy restrictions in place?

In my case:

The user creates events that are limited to certain groups of relations in the database (namely: friends, friends of friends, etc.) I have : before_filter in the event controller, which checks the validity of the current user to make sure that this user has permission to view the event. If they do not, they are loaded on the root page with an error message.

However, I want a special scenario where a user could create an event with the same privacy and IN ADDITION parameters, be able to share a special link with his friends via email, facebook, etc. users do NOT need an account (but will need to do it in order to register for the event). This is important because application_controller also has: before_filter, which ensures that the user is logged in.

I think there is something here that I could do with routing ... Now I just have a simple setup / events / 72. If each event has two different links: the regular one and the version of the "special code" that allows them to bypass these two: before_filter?

What do people think?

Answer 1

I will have a separate controller that uses a hash value to refer to the event.

Something simple, like created_at + user_id, hashed to create a unique link.

You can also just skip checking for a specific action, but I would prefer the first solution.

Answer 2

I agree with David Lio's answer (sharing this concern on another controller).

But to create a hash, I highly recommend you salt the hash with some kind of secret phrase.

require "digest" Digest::SHA512.hexdigest("#{created_at}#{user_id}.mysupersonicsecretSALT") 

Doing this without knowing the passphrase cannot calculate the hashes and test them against your system until it hits an existing one. If you process sensitive data, you should not be lazy.

Greetings

Lucas