Question

I am using cancan for permissions and I would like it so users cannot see other users when visiting their profile/users page. User should only be able to see themselves.

In my ability.rb file I have

class Ability
include CanCan::Ability

def initialize(user)
   user ||= User.new # guest user (not logged in)

   if user.role? :admin
     can :manage, :all
   elsif user.role? :rookie 
     can [:update, :destroy], [Album, Photo, User]
     can :read, :all
   end

  can :manage, Album, :profile => { :user_id => user.id }
  can :manage, Photo, :profile => { :user_id => user.id }
  can :manage, Video, :profile => { :user_id => user.id }
  can :manage, Comment, :blog => { :profile => { :user_id => user.id } }
  can :manage, User, :id => user.id
 end
end

In my users_controller I have

class UsersController < ApplicationController
before_filter :authenticate_user!
load_and_authorize_resource 

 def index
   @user = current_user
 end

 def show
  @user = User.find(params[:id])
 end
end

The above usually works but since user is the primary model I am not sure how I can resolve this. Rails gives me the error

undefined method `user_id'

Answer 1

It should be:

#ability.rb:
can :manage, User, :id => user.id