Enforcing restrict on current user by default

Question

We're looking at the protector gem for attribute level security. I'd like to auto restrict all models to the current user by default so you have to explicitly unrestrict it instead of the other way around. So..

Article.find(3) # Is actually eq to Article.restrict!(current_user).find(3)

But finding it a little challenging to implement it without wrapping/proxying the model. Was wondering if anyone has done this or has an idea of how to implement that type of functionality.

Answer 1

From the protector documentation:

Protector is aware of associations. All the associations retrieved from restricted instance will automatically be restricted to the same context. Therefore you don't have to do anything special – it will respect proper scopes out of the box

You need just to restrict the current User itself.