Rails应用用户层级（Bronze/Silver/Gold）功能权限管理方案咨询

Great question—this is a super common scenario for SaaS Rails apps, and the key is to build a flexible, dynamic system so you don’t have to rewrite code every time you add a new feature or adjust tier permissions. Let’s walk through the best approach step by step.

First, we’ll set up models to represent tiers, features, and their relationships—this is the foundation for dynamic configuration.

• Tier Model: Represents your Bronze/Silver/Gold levels. Add fields like name (string), description (text), and any tier-specific metadata (e.g., price).
• Feature Model: Represents individual app features (e.g., search, advanced filters, exports). Critical fields:
  • name: Human-readable name (e.g., "Advanced Search")
  • code_identifier: Unique, machine-friendly string (e.g., search, advanced_filter—this is what we’ll reference in code)
  • description: Details for the admin panel
• TierFeature Join Model: Acts as a bridge between tiers and features. It only needs tier_id and feature_id (add indexes for performance!).

Associate the models in your Rails code:

# app/models/tier.rb
class Tier < ApplicationRecord
  has_many :tier_features, dependent: :destroy
  has_many :features, through: :tier_features
  has_many :users # Assuming each user belongs to one tier
end

# app/models/feature.rb
class Feature < ApplicationRecord
  has_many :tier_features, dependent: :destroy
  has_many :tiers, through: :tier_features
  validates :code_identifier, presence: true, uniqueness: true # Prevent duplicate feature keys
end

# app/models/user.rb
class User < ApplicationRecord
  belongs_to :tier # Add a `tier_id` foreign key to users table
  # Optional: Set a default tier for new users
  after_initialize :set_default_tier, if: :new_record?
  private
  def set_default_tier
    self.tier ||= Tier.find_by(name: "Bronze")
  end
end

Now, add a reusable way to check if a user has access to a feature—no hardcoded tier checks!

Add a helper method to your ApplicationController (or a concern for reusability):

# app/controllers/application_controller.rb
class ApplicationController < ActionController::Base
  protected
  def has_feature_access?(feature_code)
    # Cache allowed features to avoid repeated DB queries (expire after 1 hour)
    @allowed_features ||= Rails.cache.fetch("user_#{current_user.id}_allowed_features", expires_in: 1.hour) do
      current_user.tier.features.pluck(:code_identifier).to_set
    end
    @allowed_features.include?(feature_code)
  end
  helper_method :has_feature_access? # Make this available in views
end

Use this method in controllers to restrict access:

# Example in a SearchController
class SearchController < ApplicationController
  before_action :check_search_access, only: [:index]

  def index
    # Your search logic here
  end

  private
  def check_search_access
    unless has_feature_access?('search')
      redirect_to root_path, alert: "You don't have access to this feature."
    end
  end
end

And in views to show/hide UI elements:

<%# Example in a navigation partial %>
<nav>
  <ul>
    <% if has_feature_access?('search') %>
      <li><%= link_to "Search", search_path %></li>
    <% end %>
    <% if has_feature_access?('advanced_filter') %>
      <li><%= link_to "Advanced Filters", advanced_filters_path %></li>
    <% end %>
  </ul>
</nav>

Build an admin interface to let you manage tiers, features, and their associations without touching code.

• Tier Management: Let admins create/edit/delete tiers (e.g., add a Platinum tier later).
• Feature Management: Let admins add new features by entering a name and unique code_identifier.
• Feature-Tier Association: On the tier edit page, add a checkbox list of all features—admins can select which features belong to the tier.

Using SimpleForm (a popular gem) simplifies the checkbox list:

<%# app/views/admin/tiers/_form.html.erb %>
<%= simple_form_for @tier, url: admin_tier_path(@tier) do |f| %>
  <%= f.input :name %>
  <%= f.input :description %>
  <%# Multi-select checkboxes for features %>
  <%= f.input :feature_ids, as: :check_boxes, collection: Feature.all.order(:name), label: "Allowed Features" %>
  <%= f.button :submit %>
<% end %>

Make sure your Tier model allows mass assignment of feature_ids:

# app/models/tier.rb
class Tier < ApplicationRecord
  # ... existing code ...
  accepts_nested_attributes_for :tier_features, allow_destroy: true
  # Or simply permit feature_ids in your admin controller
end

• Cache Invalidation: When you update a tier’s features, clear the cache for all users in that tier to ensure they see the changes immediately.
• Fallback for Missing Tiers: Ensure users always have a tier (use the after_initialize hook in the User model as shown earlier).
• Audit Logs: Optional but useful—add a TierFeatureHistory model to track when features are added/removed from tiers for accountability.

内容的提问来源于stack exchange，提问作者Faisal Choura