Question

I am using devise with CanCan. I am using my user model.
My user index page is localhost:3000/users (It is enabled just for :administrator role).

The problem is that CanCan (or Devise) is not checking for authorization on this route. All other routes (i.e. localhost:3000/tasks) are being checked. i.e. If I logout of the system and type the users index page it displays its content. If I type the tasks route it redirects me to the login screen (correct behaviour).

I think that this is happening because of Devise’s routes.
My simplified User model is:

class User < ActiveRecord::Base
   has_and_belongs_to_many :roles

   # Include default devise modules. Others available are:
   # :token_authenticatable, :encryptable, :confirmable, :lockable, :timeoutable and           :omniauthable
   devise :database_authenticatable,
      :recoverable, :rememberable, :trackable, :validatable

    # Setup accessible (or protected) attributes for your model
    attr_accessible :name, :role_ids, :role, :email, :password, :password_confirmation, :remember_me

    def role?(role_check)
      self.roles.each do |role|
        return true if (role.name.eql? role_check.to_s.humanize )
      end    

      return false
    end


     def role=(role_id)
        self.roles.clear
        self.roles << Role.find(role_id)
     end

     def role
         self.roles.first unless self.roles.length == 0
     end

   end

My Routes are the following:

devise_for :users
resources :users
devise_for :users,  :controllers => { :registrations => "users/registrations" }

My ability.rb is the following (I haven´t defined yet, it is allowing all):

class Ability
  include CanCan::Ability

  def initialize(user)
   user ||= User.new # guest user

   if user.role? :administrator
       can :manage, :all

   elsif user.role? :department_header
      can :manage, :all
   elsif user.role? :staff
      can :manage, :all
   end
 end
end

How can I fix this?
Thanks!

Answer 1

My problem was on the following line:

load_and_authorize_resource :only => [:show,:new,:destroy,:edit,:update]

I have to include :index