Route constraints in Ruby on Rails - Mini Project: Build & Apply

Using Route Constraints in Rails

📖 Scenario: You are building a simple Rails web app that serves different pages based on user roles. You want to restrict access to certain routes so only users with specific roles can visit them.

🎯 Goal: Learn how to use route constraints in Rails to control access to routes based on user roles.

📋 What You'll Learn

Create a custom route constraint class

Add a configuration variable for allowed roles

Use the constraint in the routes file to restrict access

Complete the routes setup with the constraint applied

💡 Why This Matters

🌍 Real World

Route constraints help control access to parts of a web app based on user roles or other conditions, improving security and user experience.

💼 Career

Understanding route constraints is important for Rails developers to implement role-based access control and customize routing behavior.

1

Create a custom route constraint class

Create a Ruby class called UserRoleConstraint with a method matches? that takes a request parameter and returns true if the user role is 'admin'.

Ruby on Rails

# Your code here

Hint

Define a class with a matches? method that checks if request.params[:role] equals 'admin'.

2

Add a configuration variable for allowed roles

Create a variable called allowed_roles and set it to an array containing the string 'admin' and 'manager'.

Ruby on Rails

class UserRoleConstraint
  def matches?(request)
    request.params[:role] == 'admin'
  end
end

# Your code here

Hint

Use an array allowed_roles and check if request.params[:role] is included in it.

3

Use the constraint in the routes file

In the config/routes.rb file, add a route get '/dashboard' that routes to dashboard#index and uses the constraint UserRoleConstraint.new.

Ruby on Rails

class UserRoleConstraint
  def matches?(request)
    allowed_roles = ['admin', 'manager']
    allowed_roles.include?(request.params[:role])
  end
end

Rails.application.routes.draw do
  # Your code here
end

Hint

Use get '/dashboard', to: 'dashboard#index', constraints: UserRoleConstraint.new inside the routes.draw block.

4

Complete the routes setup with the constraint applied

Add a root route root to: 'home#index' without constraints below the constrained route in config/routes.rb.

Ruby on Rails

class UserRoleConstraint
  def matches?(request)
    allowed_roles = ['admin', 'manager']
    allowed_roles.include?(request.params[:role])
  end
end

Rails.application.routes.draw do
  get '/dashboard', to: 'dashboard#index', constraints: UserRoleConstraint.new
  # Your code here
end

Hint

Add root to: 'home#index' inside the routes.draw block after the constrained route.

Practice

1. What is the main purpose of using route constraints in a Rails application?

easy

A. To style the HTML output of views

B. To speed up database queries automatically

C. To manage user sessions and cookies

D. To limit which URLs match routes based on specific patterns or conditions

Solution

1. Step 1: Understand what route constraints do

   Route constraints restrict which URLs can match a route by applying conditions like regex or subdomain checks.

2. Step 2: Compare options to the purpose of constraints

   Only To limit which URLs match routes based on specific patterns or conditions describes limiting URL matches based on patterns or conditions, which is the core use of route constraints.

3. Final Answer:

   To limit which URLs match routes based on specific patterns or conditions -> Option D

4. Quick Check:

   Route constraints = limit URL matches [OK]

Hint: Route constraints control which URLs reach your routes [OK]

Common Mistakes:

• Confusing route constraints with database or view logic
• Thinking constraints manage sessions or cookies
• Assuming constraints style HTML output

2. Which of the following is the correct syntax to add a regex constraint for a route parameter :id that only allows digits?

easy

A. get '/items/:id', to: 'items#show', constraints: { id: /\d+/ }

B. get '/items/:id', to: 'items#show', constraints: { id: '[a-z]+' }

C. get '/items/:id', to: 'items#show', constraints: { id: /[a-z]+/ }

D. get '/items/:id', to: 'items#show', constraints: { id: /\w+/ }

Solution

1. Step 1: Identify regex for digits only

   The regex /\d+/ matches one or more digits, which fits the requirement.

2. Step 2: Check syntax for constraints hash

   The syntax constraints: { id: /\d+/ } correctly applies the regex constraint to the :id parameter.

3. Final Answer:

   get '/items/:id', to: 'items#show', constraints: { id: /\d+/ } -> Option A

4. Quick Check:

   Regex for digits = /\d+/ [OK]

Hint: Use /\d+/ regex for digit-only route params [OK]

Common Mistakes:

• Using string instead of regex for constraints
• Using wrong regex like /[a-z]+/ for digits
• Missing double backslash escape in regex

3. Given the route definition below, what URL will match the route?

get '/profile/:username', to: 'users#show', constraints: { username: /[a-z]{3,}/ }

medium

A. /profile/alex

B. /profile/Jo

C. /profile/123

D. /profile/Alice

Solution

1. Step 1: Understand the regex constraint

   The regex /[a-z]{3,}/ means the username must be at least 3 lowercase letters.

2. Step 2: Check each URL against the regex

   "/profile/Jo" fails because "Jo" has uppercase and only 2 letters.
   "/profile/alex" matches because "alex" is lowercase and 4 letters.
   "/profile/123" fails because digits are not allowed.
   "/profile/Alice" fails because of uppercase 'A'.

3. Final Answer:

   /profile/alex -> Option A

4. Quick Check:

   Regex requires lowercase 3+ letters = /profile/alex/ [OK]

Hint: Match regex carefully: lowercase letters only, length matters [OK]

Common Mistakes:

• Ignoring case sensitivity in regex
• Assuming digits match letter regex
• Not counting minimum length in regex

4. Identify the error in this route constraint code snippet:

get '/orders/:order_id', to: 'orders#show', constraints: { order_id: '\\d+' }

medium

A. The route path is missing a leading slash

B. The controller action is incorrect

C. The regex is a string, it should be a Regexp object

D. The constraints hash key should be a symbol, not a string

Solution

1. Step 1: Check the constraints value type

   The value '\\d+' is a string, but Rails expects a Regexp object for regex constraints.

2. Step 2: Confirm correct regex syntax

   It should be /\d+/ (a Regexp literal), not a string '\\d+'.

3. Final Answer:

   The regex is a string, it should be a Regexp object -> Option C

4. Quick Check:

   Regex constraints need Regexp objects, not strings [OK]

Hint: Use /regex/ not 'string' for route constraints [OK]

Common Mistakes:

• Using string instead of Regexp for constraints
• Confusing route path syntax
• Misnaming controller or action

5. You want to restrict a route to only respond when the subdomain is 'admin'. Which of the following route definitions correctly applies this constraint?

hard

A. get '/dashboard', to: 'admin#dashboard', constraints: { subdomain: 'admin' }

B. get '/dashboard', to: 'admin#dashboard', constraints: lambda { |req| req.subdomain == 'admin' }

C. get '/dashboard', to: 'admin#dashboard', constraints: { domain: 'admin' }

D. get '/dashboard', to: 'admin#dashboard', constraints: { subdomain: /admin/ }

Solution

1. Step 1: Understand subdomain constraints options

   Rails allows constraints as regex, hash, or custom objects like lambdas for complex logic.

2. Step 2: Evaluate each option

   get '/dashboard', to: 'admin#dashboard', constraints: { subdomain: 'admin' } uses a string for subdomain, which is not valid.
   get '/dashboard', to: 'admin#dashboard', constraints: { subdomain: /admin/ } uses regex /admin/, which matches subdomain 'admin' but may match partials.
   get '/dashboard', to: 'admin#dashboard', constraints: lambda { |req| req.subdomain == 'admin' } uses a lambda checking if request subdomain equals 'admin', which is precise and recommended.
   get '/dashboard', to: 'admin#dashboard', constraints: { domain: 'admin' } uses 'domain' key, which is incorrect for subdomain constraints.

3. Final Answer:

   get '/dashboard', to: 'admin#dashboard', constraints: lambda { |req| req.subdomain == 'admin' } -> Option B

4. Quick Check:

   Use lambda for precise subdomain check [OK]

Hint: Use lambda for exact subdomain constraints [OK]

Common Mistakes:

• Using string instead of lambda or regex for subdomain
• Confusing domain with subdomain key
• Using regex that matches partial subdomains unintentionally