title: Rails 3 ActiveRecord validation based on user permissions
body: <p>I'm shifting code from an application built in a non-standard custom PHP framework into Ruby on Rails (version 3).  In the PHP version all the controllers are really fat, with thin models, which I've always disagreed with, so I'm enjoying the way Rails does validation at the model level, which is probably 90% of what's happening in these fat controllers currently.</p>
  
  <p>One problem I'm facing, and unsure how to resolve however, is that of differing validation rules based on who's making the change to the model.  For example, an administrator, or the original creator of the record should be able to do things like flag a record as deleted (soft delete) whereas everybody else should not.</p>
  
  <pre><code>class Something &lt; ActiveRecord::Base
    ...
    validates :deleted, :owned_by_active_user =&gt; true
    ...
  end
  
  class OwnedByActiveUserValidator &lt; ActiveModel::EachValidator
    validate_each(record, attr_name, attr_value)
      # Bad idea to have the model know about things such as sessions?
      unless active_user.admin? || active_user.own?(record)
        record.errors.add :base, "You do not have permission to delete this record"
      end
    end
  end
  </code></pre>
  
  <p>Since the model itself is (in theory) unaware of the user who is making the change, what's the "rails way" to do this sort of thing?  Should I set the active user as a virtual attribute on the record (not actually saved to DB), or should I just perform these checks in the controller?  I have to admit, it does feel strange to have the model checking permissions on the active user, and it adds complexity when it comes to testing the model.</p>
  
  <p>One reason I'm keen to keep as much of this as possible in the model, is because I want to provide both an API (accessed over OAuth) and a web site, without duplicating too much code, such as these types of permissions checks.</p>