问设计和安全:3个管理角色与布尔人。这100%安全吗？

EN

class ClientsController < ApplicationController

before_action :set_client, only: [:show, :edit, :update, :destroy]

before_action :authenticate_admin!


# GET /clients
# GET /clients.json
def index
  @clients = Client.all
end

# GET /clients/1
# GET /clients/1.json

def show
end

# GET /clients/new

def new
  @client = Client.new
end

# GET /clients/1/edit

def edit
end

# POST /clients
# POST /clients.json

def create
@client = Client.new(client_params)

respond_to do |format|
  if @client.save
    format.html { redirect_to @client, notice: 'Client was successfully created.' }
    format.json { render :show, status: :created, location: @client }
  else
    format.html { render :new }
    format.json { render json: @client.errors, status: :unprocessable_entity }
  end
  end
  end

# PATCH/PUT /clients/1
# PATCH/PUT /clients/1.json
def update
  respond_to do |format|
    if @client.update(client_params)
      format.html { redirect_to @client, notice: 'Client was successfully updated.' }
    format.json { render :show, status: :ok, location: @client }
  else
    format.html { render :edit }
    format.json { render json: @client.errors, status: :unprocessable_entity }
  end
end
end

# DELETE /clients/1
# DELETE /clients/1.json
def destroy
  @client.destroy
    respond_to do |format|
    format.html { redirect_to clients_url, notice: 'Client was successfully destroyed.' }
    format.json { head :no_content }
  end
end

private
  # Use callbacks to share common setup or constraints between actions.
  def set_client
    @client = Client.find(params[:id])
  end

  # Never trust parameters from the scary internet, only allow the white list through.
  def client_params
    params.require(:client).permit(:name, :description)
  end
  end

ActiveRecord::Schema.define(version: 20160825190018) do

  create_table "admins", force: :cascade do |t|
    t.string   "email",                  default: "", null: false
    t.string   "encrypted_password",     default: "", null: false
    t.string   "reset_password_token"
    t.datetime "reset_password_sent_at"
    t.datetime "remember_created_at"
    t.integer  "sign_in_count",          default: 0,  null: false
    t.datetime "current_sign_in_at"
    t.datetime "last_sign_in_at"
    t.string   "current_sign_in_ip"
    t.string   "last_sign_in_ip"
    t.boolean  "god_mode"
    t.boolean  "normal_mode"
    t.boolean  "guest_mode"
    t.datetime "created_at",                          null: false
    t.datetime "updated_at",                          null: false
    t.index ["email"], name: "index_admins_on_email", unique: true
    t.index ["reset_password_token"], name: "index_admins_on_reset_password_token", unique: true
  end

  create_table "clients", force: :cascade do |t|
    t.string   "name"
    t.text     "description"
    t.datetime "created_at",  null: false
    t.datetime "updated_at",  null: false
  end

end