Add default filters / scopes

[konung]

As discussed on slack with @marctich , this is a security feature + performance boost + productivity boost

1. As a security feature, one could scope ALL requests to current user/account, so that you CAN'T expose other customer data, to somebody else. Even if you mess up policies.
2. As a performance boost, this could be used to limit common lookups, and control and tune them from one place.
3. As a productivity boost, this similar to dispised default_scope in ActiveRecord. Sometimes this COULD be actually useful. This is possibly a separate feature from the first two?

[marcfil]

@konung do i get it right?
https://github.com/activerecord-hackery/ransack#authorization-whitelistingblacklisting
https://github.com/activerecord-hackery/ransack#using-scopesclass-methods

That's basically what you want with this right?

[konung]

Yes. Pretty much.

The important thing here from a security perspective is to be able to limit access to user. So that you can set something like user_id = current_user.id by default. And only override it for admin. ( Or something similar) . You want to make sure you won't expose on customer's data to another customer, even if you do something stupid :)