Question

I am using Devise and Cancan gems on a Rails 3.1 app.

I added several additional columns to User.

I managed to define the abilities and they work fine, I can see that it works but I haven’t figured out how do I unauthorize actions (such as :update) since I don’t have access to Devise or users controller?

How do that work?

Answer 1

Or, try using the following in ability.rb

 if user.role? :admin
  can [:create, :read], [Model1, Model2]
 end

 if user.role? :user
  can [:read], Model1, :id => user.id
 end

That will allow admins to create or read but not update. And allow users to read Model1 if it belongs to them. If you create custom actions, like “copy_model”, you could add the same to ability.rb

 ...
 can [:copy_model, :read], Model1, :id => user.id
 ...