How to: Room's permissions and roles

Two things are be explained in this guide:

• How to control who can join a meeting
• How to control who can create a meeting

Permission to join and role in the conference

To control who can join a room, override the method bigbluebutton_role(room) in your application_controller.rb. The default implementation can be seen in controller_methods.rb and is very simple, so you really should implement your own method.

In this method, it can be useful to use owner_type and owner_id to check who is the owner of the room and private to check if the room is private or public. By default, a room has no owner (both owner_type and owner_id are nil) and is public (private is set to false).

Here's an example for an application where rooms can belong to users, showing the 4 possible return values of the method:

def bigbluebutton_role(room)
  unless bigbluebutton_user.nil?           # there's a logged user
    if room.owner_type == "User"           # the room belongs to a user
      if room.owner.id == current_user.id  # the current_user owns this room
        :moderator                         # join as moderator!
      else                                 # the current user is not the owner
        if room.private
          :password                        # ask for a password if the room is private
        else
          :attendee                        # join as attendee if the room is public
        end
      end
    end
  else                                     # no user logged = anonymous access
    nil                                    # forbid access!
  end
end

Note that this only allows you to control if the current user can join a room or not. If you need to control the access to controller actions (show, edit, destroy, etc.) you should check How to: Inherit controllers.

Permission to create

To control who can create a meeting in a given room, override the method bigbluebutton_can_create?(room, role) in your application_controller.rb. The default implementation can be seen in controller_methods.rb.

See below an example were rooms can belong to users and only the owner of the room can create meetings in it. In this method, room is the target BigbluebuttonRoom object and role is the role given to the user by bigbluebutton_role.

def bigbluebutton_can_create?(room, role)
  unless bigbluebutton_user.nil?           # there's a logged user
    if room.owner_type == "User"           # the room belongs to a user
      if room.owner.id == current_user.id  # the current_user owns this room
        true                               # allow him to create a meeting!
      else                                 # the current user is not the owner
        false                              # can't create
      end
    end
  else                                     # no user logged = anonymous access
    false                                  # can't create
  end
end

Be aware that, depending on your implementation of bigbluebutton_role, role can be :moderator for a user that entered the moderator password when asked for a password (even if it's an anonymous user). So the default implementation of bigbluebutton_can_create?, that allows every user that is a moderator to create a room, might not be correct for you. The implementation in the example above, though, would solve this issue.