title: How to use backend permissions in frontend
body: <p>I have a web application using Rails as backend and AngularJS as frontend and it has a rather complicated permission system that must hide/show buttons in the frontend accordingly.  </p>
  
  <p>For example, imagine something like ebay, if I created a product, I can edit, delete, etc.. but somebody can share a product with me and I can also edit, but not delete. So the permission is calculated by resource, and not using roles.    </p>
  
  <p>I thought adding a "permissions" attribute to each json object, something like:  </p>
  
  <pre><code>[{
      id: 1,
      name: "product 1",
      permissions: {
          canEdit: true,
          canDelete: false
      }
  },
  {
      id: 2,
      name: "product 2",
      permissions: {
          canEdit: true,
          canDelete: true
      }
  }]
  </code></pre>
  
  <p>Is there any best practice to send each resource permissions to the frontend? </p>
  
  <p>Just to be clear, this permissions are only used to <strong>show/hide</strong> buttons, the backend still blocks this resources even if the person changes the values in the frontend</p>