# ryanb/cancan

**Attribution required: if you use, quote, or summarise this content, you must credit and link back to [awesome-repositories.com](https://awesome-repositories.com/repository/ryanb-cancan).**

6,212 stars · 772 forks · Ruby · MIT · archived

## Links

- GitHub: https://github.com/ryanb/cancan
- awesome-repositories: https://awesome-repositories.com/repository/ryanb-cancan.md

## Description

CanCan is an authorization library for Ruby on Rails applications that provides a declarative framework for defining user permissions. It functions as a role-based access control system that decouples security logic from controllers by centralizing all ability definitions in a single location.

The library distinguishes itself by translating permission rules into database-driven filters. This allows the system to retrieve only the specific records a user is permitted to see based on attribute conditions and defined scopes, rather than verifying permissions after data has been loaded.

The framework covers authorization enforcement through automated resource loading and mandatory permission checks. It includes mechanisms for managing permission precedence, resolving custom ability providers, and handling access denied exceptions globally to trigger redirects or error messages.

## Tags

### Security & Cryptography

- [Access Control and Authorization](https://awesome-repositories.com/f/security-cryptography/identity-access-management/authentication-strategies/authorization-and-user-administration/access-control-authorization.md) — Implements a comprehensive system for enforcing user permissions and access control within Ruby on Rails applications. ([source](https://github.com/ryanb/cancan#readme))
- [Access Control Centralization](https://awesome-repositories.com/f/security-cryptography/access-control-centralization.md) — Manages user roles and permissions in one location to decouple security logic from application controllers.
- [Centralized Permission Management](https://awesome-repositories.com/f/security-cryptography/access-control-centralization/centralized-permission-management.md) — Provides a centralized location to define all user permissions, decoupling authorization logic from controllers and models.
- [User Capability Verifications](https://awesome-repositories.com/f/security-cryptography/capability-based-access-controls/user-capability-verifications.md) — Verifies if a user possesses the required permissions to perform specific actions on resource instances or classes. ([source](https://github.com/ryanb/cancan/blob/master/README.rdoc))
- [Declarative Access Control Layers](https://awesome-repositories.com/f/security-cryptography/declarative-access-control-layers.md) — Provides a framework for specifying resource permissions using declarative hash conditions and scopes.
- [Controller Action Integration](https://awesome-repositories.com/f/security-cryptography/granular-access-controls/resource-level-access-controls/controller-action-integration.md) — Wraps controller actions to automate resource loading and permission verification before executing business logic.
- [Custom Access Rules](https://awesome-repositories.com/f/security-cryptography/identity-access-management/access-control/custom-access-rules.md) — Implements a system of custom allow and deny rules to determine if users can perform specific actions.
- [Accessible Resource Filtering](https://awesome-repositories.com/f/security-cryptography/resource-access-control/accessible-resource-filtering.md) — Verifies if users can perform specific actions on objects and handles unauthorized requests.
- [Attribute-Based Database Filtering](https://awesome-repositories.com/f/security-cryptography/resource-access-control/accessible-resource-filtering/attribute-based-database-filtering.md) — Filters accessible records using database column conditions and nested association hashes. ([source](https://github.com/ryanb/cancan/wiki/Defining-Abilities))
- [Role-Based Access Control](https://awesome-repositories.com/f/security-cryptography/role-based-access-control.md) — Implements complex access hierarchies and conditional rules to control what different user types can do.
- [Declarative Permission Rules](https://awesome-repositories.com/f/security-cryptography/role-based-access-control/conditional-access-rules/declarative-permission-rules.md) — Allows defining which users can perform actions on resources using conditions, scopes, and ability sets. ([source](https://github.com/ryanb/cancan/blob/master/CHANGELOG.rdoc))
- [Record-Level Filtering](https://awesome-repositories.com/f/security-cryptography/sensitive-data-access-controls/logical-access-rules/record-level-filtering.md) — Retrieves only specific data records a user is permitted to see based on defined access rules.
- [Rule Precedence Logic](https://awesome-repositories.com/f/security-cryptography/ai-access-control-policies/permission-management/rule-precedence-logic.md) — Combines allow and deny rules for the same resource to create complex access hierarchies through definition order. ([source](https://github.com/ryanb/cancan/wiki/Defining-Abilities))
- [Resource-Level Access Controls](https://awesome-repositories.com/f/security-cryptography/granular-access-controls/resource-level-access-controls.md) — Fetches a specific resource from the database and verifies the user's permission to access that instance. ([source](https://github.com/ryanb/cancan/blob/master/CHANGELOG.rdoc))
- [Hash-Based Permission Mapping](https://awesome-repositories.com/f/security-cryptography/hash-based-permission-mapping.md) — Translates Ruby hashes into database queries to filter records based on user attributes or resource properties.
- [Authorization Exception Rescue](https://awesome-repositories.com/f/security-cryptography/identity-access-management/access-control/deny-list-policies/authorization-exception-rescue.md) — Catches authorization failures globally to trigger custom redirects or display forbidden access messages. ([source](https://github.com/ryanb/cancan#readme))
- [Custom Authorization Logic](https://awesome-repositories.com/f/security-cryptography/identity-access-management/authentication-strategies/authorization-and-user-administration/access-control-authorization/custom-authorization-logic.md) — Determines whether an authorization check is required based on custom logic or specific controller states. ([source](https://github.com/ryanb/cancan/wiki/Upgrading-to-1.6))
- [Database Query Permissions](https://awesome-repositories.com/f/security-cryptography/permission-based-access-control/database-query-permissions.md) — Filters database records based on defined user abilities to retrieve only authorized data.
- [Controller Action Authorization](https://awesome-repositories.com/f/security-cryptography/permission-based-access-control/team-action-permission-checks/controller-action-authorization.md) — Automatically loads model instances and verifies access permissions for all actions within a controller. ([source](https://github.com/ryanb/cancan#readme))
- [Authorization Check Enforcement](https://awesome-repositories.com/f/security-cryptography/permission-based-access-control/team-action-permission-checks/controller-action-authorization/authorization-check-enforcement.md) — Provides a mechanism to raise exceptions if a controller action completes without performing an authorization check. ([source](https://github.com/ryanb/cancan/wiki/Ensure-Authorization))
- [Mandatory Authorization Checks](https://awesome-repositories.com/f/security-cryptography/permission-based-access-control/team-action-permission-checks/controller-action-authorization/mandatory-authorization-checks.md) — Requires every controller action to perform an authorization check and raises an error if any action is skipped. ([source](https://github.com/ryanb/cancan#readme))
- [Unauthorized Access Exceptions](https://awesome-repositories.com/f/security-cryptography/unauthorized-access-exceptions.md) — Triggers specific error classes when permissions are missing to allow global handling of unauthorized requests.

### Web Development

- [Authorization Libraries](https://awesome-repositories.com/f/web-development/backend-development/web-frameworks/language-specific-ecosystems/ruby-on-rails-frameworks/authorization-libraries.md) — Defines and enforces user permissions for database resources within a Ruby on Rails application.
- [Ruby on Rails Integrations](https://awesome-repositories.com/f/web-development/ruby-on-rails-integrations.md) — Provides a specialized library for defining user permissions and enforcing access control within Ruby on Rails.

### Data & Databases

- [Authorized Record Filtering](https://awesome-repositories.com/f/data-databases/database-record-querying/authorized-record-filtering.md) — Modifies database queries to return only the subset of records a user is permitted to see.