I have a site where user accounts can be created in two ways: by new users (sign up) and by admin users. Since the creation is handled differently in each case, I decided to split the logic into two separate functions. I have a working implementation but I'm pretty new to Rails so I don't know if it is robust and secure. I am looking for feedback on how to improve it.
before_action :signed_in_user, only: [:home, :edit, :update, :destroy] before_action :correct_user, only: [:edit, :update] before_action :admin_user, only: [:create_by_admin, :destroy] . . . def new if !signed_in? @user = User.new @user.confirmation_code = User.new_confirmation_code elsif signed_in? && current_user.admin? @user = User.new render 'new_by_admin' # basically a new.html.erb but with a dropdown for the admin setting else redirect_to root_url end end def create if signed_in? && !current_user.admin? redirect_to root_url elsif signed_in? && current_user.admin? create_by_admin else create_by_user end end def create_by_user @user = User.new(user_params) if @user.save UserMailer.confirmation_email(@user).deliver flash[:success] = "Great! Now check your email for activation instructions." redirect_to root_url else render 'new' end end def create_by_admin @user = User.new(admin_params) if @user.save @user.update_attributes(confirmed: true) flash[:success] = "User for " + @user.name + " created." redirect_to users_path else render 'new_by_admin' end end . . . private def user_params params.require(:user).permit(:name, :email, :password, :password_confirmation) end def admin_params params.require(:user).permit(:name, :email, :password, :password_confirmation, :admin) end
Essentially, all create requests are routed to the create action, and from there sent to the appropriate method (depending on whether the requesting user is a new user or an existing user who is an admin). The differences between the methods is that new users receive an email to activate their accounts upon signup and cannot set themselves as admin, whereas admin users create accounts that are already confirmed and can set them as admin.
Is this a silly way to do it? Should I create an
admin_controller that handles all administrative requests?