Selleo Labs spółka z o.o.

I am an agile Team Leader, Project Manager, and testing advocate supporting other developers. Having optimization and scalability in mind, I have led software teams for over 11 years in the end-to-end project development lifecycle, e.g., architecture design, code, and documentation review. I specialize in creating eHealthcare solutions that meet HIPPA requirements. 

Szymon Kieloch

[TOC]

## RAILS ADMIN VS. MULTITENANCY

Recently I started changing our single-tenant app into a multi-tenant one. Everything was going well until I stuck upon [Rails Admin](https://github.com/sferik/rails_admin). As we all know, Rails Admin is a great tool to administer your data, among other gems like [Administrate](https://github.com/thoughtbot/administrate) or [Active Admin](https://activeadmin.info/).

The challenge with Rails Admin I had was about scoping down the data so that given user sees data only from his tenant. I saw [an issue on Github](https://github.com/sferik/rails_admin/issues/2572) and unfortunately Rails Admin by default does not have an ability to add scopes with parameters. For instance, right now it is impossible to create an ActiveRecord scope to which we pass current user: **That gave me an idea that maybe instead of adjusting the gem to handle the additional argument, I could create my logic for authorization. As I thought about it, I started walking through the CanCan authorization logic.** Fortunately. The authorization logic was quite easy to understand and had some comments. I took an inspiration from the code and based on this, I created my own authorization, which is used for multi-tenancy.

## IMPLEMENTATION OF MULTI-TENANT AUTHORIZATION

Here are the steps to set up Rails Admin with multi-tenancy:

- CREATE A MODULE WITH CLASS AUTHORIZATIONADAPTER, WHICH CONTAINS LOGIC FOR AUTHORIZATION:  
    In my particular case, I had to limit the data scope by checking if given model is in user tenant.
- ADD A MULTITENANT EXTENSION TO RAILS ADMIN
- USE THE AUTHORIZATION IN RAILS ADMIN CONFIG  
    EXPLORING RAILS ADMIN CODE

I walked through the code and I was even adjusting the dashboard and index action so it can pass the current user argument to the scope, but after rethinking the problem, I took a different approach.

While reading the code, I saw that Rails Admin supports two kinds of authorization systems: CanCan and Pundit.  
  

That gave me an idea that maybe instead of adjusting the gem to handle the additional argument, I could create my logic for authorization. As I thought about it, I started walking through the CanCan authorization logic.

Fortunately. The authorization logic was quite easy to understand and had some comments. I took an inspiration from the code and based on this, I created my own authorization, which is used for multi-tenancy.

Recently I started changing our single-tenant app into a multi-tenant one. Everything was going well until I stuck upon Rails Admin.

Rails Admin And Multitenancy

[TOC]

## USING CHECKSUMS FOR FILE VERIFICATION

You might have had an opportunity to verify if a file you downloaded is valid and authentic compared to the original one the process is called [file verification](https://en.wikipedia.org/wiki/File_verification). It is based on the fact that we can take the file content, process it with an algorithm, and generate a unique checksum based on the algorithm. We can then take such a[checksum](https://en.wikipedia.org/wiki/Checksum) and verify it against our file. When we generate a different checksum, it means the downloaded file is invalid. It might have been corrupted while being transmitted over the internet or by third parties corrupting the original file. A common usage for checksum is, for instance, in the OpenSource world. Software creators usually want to make sure that people get the original file without any modifications to its content. On the other hand, it is often used for films that you can download from the web. All in all, checksums work fairly well – we do not have to compare files bit by bit in order to ensure a file matches the original one.

## CHECKSUM VERIFICATION FOR WEB APPS

File [checksums](https://en.wikipedia.org/wiki/Checksum) verification can be used to ensure that original files arrive without any modifications to their content. In 2015, a similar idea was introduced into web applications. Since we usually load a lot of JS code into web pages, there is a possibility that some files will be modified by attackers, who may attempt to execute their own code. Such a case is sometimes very dangerous for web app users, for instance, those using apps for banking and money transfers. There has been an incident in which one person lost about 40.000 pln due to an ill-intentioned [page modification](https://niebezpiecznik.pl/post/to-nie-wina-mbanku-ze-jego-klient-stracil-40-000-pln/). By ensuring that loaded scripts match original files one can help prevent such incidents.

## SUBRESOURCE INTEGRITY

The W3C organization considered the file checksums and decided to add the concept to their web specifications as [Subresource Integrity](https://www.w3.org/TR/SRI/). The latter works in the same way as verifying checksums and the process has the following steps:

* the author adds an integrity attribute to the script or link tag with the value of SHA384 or SHA512 for the file
* the browser verifies the checksum for the file
* the browser runs the file only when it matches the checksum

That is a pretty simple idea and it works well.

## SUBRESOURCE INTEGRITY IN RAILS

In the Rails world the procedure is much more simple that the steps in the list presented above. The only element we need to think about is to add the **integrity: true** argument into the **javascript_include_tag**method. For instance:

```
javascript_include_tag :application, integrity: true# => "<script src="https://betaselleo-wpengine.netdna-ssl.com/assets/application.js" integrity="sha256-zvaSLpJVYt5L57/LrUWzxoJHVYv3YdLmQACdIgTTGWc="></script>"
```

Subresource Integrity is enabled from [version 3.x](https://github.com/rails/sprockets-rails#sri-support) in Rails Sprockets.

It is thus a great idea to use the 3.x version or at least upgrade the gem to this version. It will ensure that the files loaded in your app match exactly the files sent by the server or CDN. Thanks to [Wojtek](https://ryrych.pl/) for feedback!

You might have had an opportunity to verify if a file you downloaded is valid and authentic compared to the original one the process is called file verification.

Do you want

Read Our Blog.
Make better products with us.

Read our articles on Selleo Blog

Business

Technology

Rails Admin And Multitenancy

Rails And Subresource Integrity

Tell us about your project

Company

Our Services

Blog

Other Services

Countries

Awards & Certificates

Do you want

Read Our Blog. Make better products with us.

Read our articles on Selleo Blog

Business

Technology

Rails Admin And Multitenancy

Rails And Subresource Integrity

Tell us about your project

Company

Our Services

Blog

Other Services

Countries

Awards & Certificates

Read Our Blog.
Make better products with us.