Sorry if I didn't make it clear. When I refer to 'additional logic', I mean checking that the API's response is suitable for the user making the request.
There are two scenarios in your example, generally listing and viewing user profiles and viewing and modifying your own profile. It makes sense from an API point of view and a code-organisation point of view to split these between two controllers. Requests to /users/20
and /users/~
will be routed to the same place (by every router I've worked with, at least!), because the paths match; the only difference is the parameter on the end (20
vs ~
). This means you'd need additional code to cope with the params and react accordingly.
To attempt to clarify what I mean, here's a quick example of how a single controller that's trying to perform both roles might look. Note how inside #update
and #show
, there's additional logic that makes the controller more difficult to understand because it no longer has a single responsibility.
If we split that functionality into two, we have two simple controllers; the user controller that only provides allowed actions and the profile controller that only has access to the currently logged-in user.
If you're also building a web interface on top of (or to compliment) this API, it makes even more sense, because you want to serve a different page for someone visiting their own profile vs visiting someone elses. Again, it's simpler and cleaner to do …