Rails, Right way to use a controller for the given use case

In my app I have a Projects Model which has_many Permissions (user_id, project_id).

When an admin is viewing a project, I want to build a link to "Add Members" which would then show a dialog box allowing the admin to add new users to the project.

My question, is for that Add Members dialog, which controller & method should I be using to populate the dialo开发者_StackOverflow中文版g box?

---

I think membership is a better name than permission. Then you have a 'Membership' resource. You can use the standard REST way to operate the resource. 'Add member' is to create a resource. So it happens in MembershipController.create method via a POST request.

---

I would do it in the Update of your Projects Controller, as you are updating the content for a project resource.

---

Use .erb (embedded Ruby) files for your views. This way you can have a section of the view that is only shown/accessible by an admin.

Example:

... some html code ...

<% if an_admin_is_logged_in %>
  ... your admin-specific dialog box and code ...
  ... if this section includes links to actions that should only be accessible by admins
  ... make sure you're using a 'before_filter' in the associated controller to limit access
<% end %>

Then you write an action in app/controllers/application_controller.rb similar to ...

helper_method :an_admin_is_logged_in

private
  def an_admin_is_logged_in
     ... code that checks that the current user logged in user is an admin
  end

Placing the 'an_admin_is_logged_in' action in the application controller makes, this action is available in all views in your project.

Additionally, some authentication plugins/gems such as authlogic include these types of things, and may be of some help. There's also a great Railscast that explains its use.

---

If this is an edit to the Project (i.e. you're editing the permissions on a project), then you could use the 'edit' action to populate the dialog, and a PUT to the 'update' action to save the changes.

You could also write an admin-specific action called "edit_permissions", which populates the dialog box, then PUT the changes to the 'update' action.