title: Rails authorization architecture using before_action
body: <p>I'm new to Ruby and Rails, so I'm trying to do something that might be easy on other languages but I can't deal with it in Rails:</p>
  
  <p>I have designed a couple tables in the database that match each controller and action name. That way, if I wand to administer special permissions for a user, I just ad the proper action to the proper controller in the database, and with the method <code>check_permissions</code>, I know if the user can execute the action or is redirected to a standard "forbidden" page.</p>
  
  <p>So for example, here's my code for the users CRUD:</p>
  
  <p>First I created a <code>check_permissions</code> method in application controller, which grabs the current action, user and controller, and checks authorization rights against the DB:</p>
  
  <pre><code>class ApplicationController &lt; ActionController::Base
    protect_from_forgery with: :exception
  
    include SessionsHelper
  
    def self.check_permissions 
      remember_token = User.digest(cookies[:remember_token]) # encripto el token para poder buscarlo en la DB, ya que ahi se guarda encriptado.
      @current_user ||= User.find_by(remember_token: remember_token)
  
      redirect_to signin_path if (@current_user == nil) or (User.find_by_sql("select * from view_userpermissions where user_id = #{@current_user.id} and pagecontroller='#{self.controller_name}' and accion='#{self.action}' ").count &lt; 1)
    end
    ...
    ...
  </code></pre>
  
  <p>Then in each controller, I use the <code>before_action :check_permissions</code> filter to redirect the user in case is not authorized to access the required content:</p>
  
  <pre><code>class UsersController &lt; ApplicationController
    before_action :set_user, only: [:show, :edit, :update, :destroy]
    before_action self.comprobar_permisos 
  
    def index
      @users = User.paginate(page: params[:page])
    end
    ...
    ...
  </code></pre>
  
  <p>The code flow seems to work very well, but the problem is rails cookies hash is not recognized when before_action filter is called.</p>
  
  <p>I also tried using session, but happens exactly the same.</p>
  
  <p>The first thing that comes to my mind is that in Rails architecture, neither session or cookies hashes are instanced by the moment the filter is executed, and then when the application controller tries to access them, an error is displayed:</p>
  
  <pre>
  Routing Error
  
  undefined local variable or method `cookies' for UsersController:Class
  
  Rails.root: C:/Users/daniel.tenzi/proyectos/MicroEstudio
  
  Application Trace | Framework Trace | Full Trace 
      app/controllers/application_controller.rb:11:in `check_permissions'
      app/controllers/users_controller.rb:3:in `'
      app/controllers/users_controller.rb:1:in `'
  
  Routes 
  
  Routes match in priority from top to bottom 
  
  
  Helper
  
  HTTP Verb
  
  Path
  
  Controller#Action
  
  
  Path / Url 
  
  pagecontrollers_path  GET  /pagecontrollers(.:format)  pagecontrollers#index  
   POST  /pagecontrollers(.:format)  pagecontrollers#create  
  new_pagecontroller_path  GET  /pagecontrollers/new(.:format)  pagecontrollers#new  
  edit_pagecontroller_path  GET  /pagecontrollers/:id/edit(.:format)  pagecontrollers#edit  
  pagecontroller_path  GET  /pagecontrollers/:id(.:format)  pagecontrollers#show  
   PATCH  /pagecontrollers/:id(.:format)  pagecontrollers#update  
   PUT  /pagecontrollers/:id(.:format)  pagecontrollers#update  
   DELETE  /pagecontrollers/:id(.:format)  pagecontrollers#destroy  
  permissions_path  GET  /permissions(.:format)  permissions#index  
   POST  /permissions(.:format)  permissions#create  
  new_permission_path  GET  /permissions/new(.:format)  permissions#new  
  edit_permission_path  GET  /permissions/:id/edit(.:format)  permissions#edit  
  permission_path  GET  /permissions/:id(.:format)  permissions#show  
   PATCH  /permissions/:id(.:format)  permissions#update  
   PUT  /permissions/:id(.:format)  permissions#update  
   DELETE  /permissions/:id(.:format)  permissions#destroy  
  groups_path  GET  /groups(.:format)  groups#index  
   POST  /groups(.:format)  groups#create  
  new_group_path  GET  /groups/new(.:format)  groups#new  
  edit_group_path  GET  /groups/:id/edit(.:format)  groups#edit  
  group_path  GET  /groups/:id(.:format)  groups#show  
   PATCH  /groups/:id(.:format)  groups#update  
   PUT  /groups/:id(.:format)  groups#update  
   DELETE  /groups/:id(.:format)  groups#destroy  
  users_path  GET  /users(.:format)  users#index  
   POST  /users(.:format)  users#create  
  new_user_path  GET  /users/new(.:format)  users#new  
  edit_user_path  GET  /users/:id/edit(.:format)  users#edit  
  user_path  GET  /users/:id(.:format)  users#show  
   PATCH  /users/:id(.:format)  users#update  
   PUT  /users/:id(.:format)  users#update  
   DELETE  /users/:id(.:format)  users#destroy  
  empresas_path  GET  /empresas(.:format)  empresas#index  
   POST  /empresas(.:format)  empresas#create  
  new_empresa_path  GET  /empresas/new(.:format)  empresas#new  
  edit_empresa_path  GET  /empresas/:id/edit(.:format)  empresas#edit  
  empresa_path  GET  /empresas/:id(.:format)  empresas#show  
   PATCH  /empresas/:id(.:format)  empresas#update  
   PUT  /empresas/:id(.:format)  empresas#update  
   DELETE  /empresas/:id(.:format)  empresas#destroy  
  sessions_path  POST  /sessions(.:format)  sessions#create  
  new_session_path  GET  /sessions/new(.:format)  sessions#new  
  session_path  DELETE  /sessions/:id(.:format)  sessions#destroy  
  root_path  GET  /  users#index  
  signup_path  GET  /signup(.:format)  users#new  
  signin_path  GET  /signin(.:format)  sessions#new  
  signout_path  DELETE  /signout(.:format)  sessions#destroy  
  </pre>
  
  <p>But if my guess is true, why would Rails says <code>routing error</code>?</p>
  
  <p>I've been stuck here at least a week trying to find anything that helps me move forward but no luck yet.</p>
  
  <p>What am I doing wrong? Any help will be highly appreciated!</p>
  
  <p>PS: I've seen auth frameworks like Cancan, but don't want to use any of that, this should be easier and more flexible.</p>
  
  <p>Thank you!</p>