Problem with rails + json

my controller admin

  def index_all_for_question_id

      @answers      = Question.find(params[:id]).answers


    respond_to do |format|
      format.ext_json { rend开发者_高级运维er :json => @answers.to_ext_json(:class => Answer, :include => [:respondent]) }
    end
  end

my dataStore in extJS

 var answers_datastore = new Ext.data.Store({
    autoLoad: true,
    proxy: new Ext.data.HttpProxy({
       url: '/answers/index_all_for_question_id/<%= @questions.first.id %>?format=ext_json',
        method: 'GET'}),
        reader: answers_reader
        });

My question is: When i trying to enter localhost:3000/answers/index_all_for_question_id/551?format=ext_json for example,

I get :

{"results":2,"answers":[{"answer":{"scale":1,"inquiry_id":277,"created_at":"2011-05-30T07:10:22Z","updated_at":"2011-05-30T07:10:22Z","text":"dfgfdghfdhfdh","id":275,"respondent":{"created_at":"2011-05-16T06:47:08Z","updated_at":"2011-05-16T06:47:08Z","id":109,"user_id":6,"email":"xxx@xxx"}}},{"answer":{"scale":1,"inquiry_id":278,"created_at":"2011-05-31T12:33:36Z","updated_at":"2011-05-31T12:33:36Z","text":"lolololol","id":290,"respondent":{"created_at":"2011-05-25T11:22:55Z","updated_at":"2011-05-25T11:22:55Z","id":110,"user_id":6,"email":"xxx@xxx"}}}]}

SO i dont what it! Every user can enter this line i get answers (if he not an admin). How i can solve this problem? Only admins can see this, for others should be redirect on some page or appears text "Sorry!".

Thank you

---

Hi I think that the simplest solution is to write custom before_filter where you can check if user has admin role and redirect to some page if no also you can use CanCan for authorization purposes

---

I'd use HTTP authentication. Redirect is a bit tricky to implement, here's an example (using sessions):

class AdminController < ApplicationController
  before_filter :authenticate

  USER_NAME = "admin"
  PASSWORD = "xyz" # PS: you should use hashed passwords

  def admins_only
    render :text => "TOP SECRET STUFF!"
  end

  protected

  def authenticate
    if authenticate_with_http_basic { |u,p| u == USER_NAME && p == PASSWORD }    
      true
    else
      if session[:http_auth_requested]
        session[:http_auth_requested] = nil
        redirect_to '/sorry_page' and return false
      end

      session[:http_auth_requested] = 1
      request_http_basic_authentication
    end
  end
end