---
title: "Quick tip: Permit params by current user roles"
author: "Yaroslav Shmarov"
date: "2021-07-10"
canonical_url: "https://blog.superails.com/permit-params-by-current-user-roles"
markdown_url: "https://blog.superails.com/permit-params-by-current-user-roles.md"
description: "Scenario: restrict users with different roles to modifying specific data inside an Object."
tags: ["ruby","rails","ruby-on-rails","authorization","roles","params"]
license: "GNU AGPL v3. Credit Yaroslav Shmarov and link the canonical URL."
---

# Quick tip: Permit params by current user roles

Scenario: restrict users with different roles to modifying specific data inside an Object.

## Option 1 (my way):

Strong params authorization can look like this:

```ruby
# app/controllers/users_controller.rb:
  def user_params
    list_allowed_params = []
    list_allowed_params += [:name] if current_user == @user || current_user.admin?
    list_allowed_params += [:role, :salary] if current_user.admin?
    params.require(:user).permit(list_allowed_params)
  end
```

## Option 2 (alternative):

```ruby
# app/controllers/users_controller.rb:
  ADMIN_ATTRIBUTES = [:a, :b, :c, :d]
  MANAGER_ATTRIBUTES = [:a, :c, :d]
  EDITOR_ATTRIBUTES = [:b, :d]
  
  def user_params
    case current_user.role
    when :admin
      params.require(:user).permit(ADMIN_ATTRIBUTES)
    when :manager
      params.require(:user).permit(MANAGER_ATTRIBUTES)
    when :editor
      params.require(:user).permit(EDITOR_ATTRIBUTES)
    end
  end
```

More about [Rails strong params](https://api.rubyonrails.org/classes/ActionController/StrongParameters.html)