[ Creating an Rails based API. A bit lost what to do after object is saved ]

I'm creating an Rails based API to manage sms subscriptions. There's a subscriptions controller that respond_to :html, :json, :xml and a Subscription model. Both are working fine.

When a subscription is made, the user still needs to confirm his subscription by entering a PIN on the page sent to his phone, so I'm thinking of a confirms controller to manage that.

I have a few questions regarding how to implement this.

(1) What would be the right approach or best practice after the subscription is made. Show the subscription object created (html, json or xml depending how it was created) and manage the confirms controller as a separated action or should I redirect to confirmation controller instead?

I guess that since the API responds to json and XML, Is not a good idea to redirect to any other page/controller and would be better to show the object created?

(2) If this is the case, I'm using CanCan to manage role abilities. Since subscriptions belong to a User owner (the developer) that doesn't need to authenticated to do the POST (I know who's User owner is associated because of the combination of the keyword/shortcode given) and subscriptions can be made by any surfer (no need for authenticating before creating) how could I restrict the created object to just that surfer?

I guess if the User is logged in it becomes easy to show the object to him because is the owner but how about regular surfers that created the object and do not need to authenticate?

I'm not having any way to connect the surfer to the object to restrict ability to it.

(3) Is a good idea to show the object after is created to a regular surfer? I may think that may not be relevant as it is when a developer is doing it through json from the api itself?

The subscription model is very simple, it works something like this

$ curl http://mysite.com/subscriptions \
-d shortcode=7889 \
-d keyword=KEYWORD \
-d phone=6895874587 \
-d country=us \

Answer 1

Let me try to attack it one by one:)

1. After record is created its generally a good practice to return the object if its supported by the status code, ie if the record is created you should return the object along with 200 status code. Keep in mind that some status codes dont allow the body, ie 201. Generally most modern http clients suport redirects however i would still keep it in 2 separate actions

2. In generally it would still be a good idea to authenticate the user since you want to prevent one user posting on behalf of another user. Regardless if you can determine who the user is by analyzing parameters you can tie the subscription to it ex:

   @user=User.find_by_phone(params[:phone]) @subscribtion = @user.subscribtions.build(params)

3. Yes,its generally a good idea to return what has been saved.