Question

i don’t quite understand how to restrict access to links in this particular case with CanCan. I always get “Edit” link displayed.
So i believe the problem is in my incorrect definition of cancan methods(load_ and authorize_).
I have CommentsController like that:

class CommentsController < ApplicationController
  before_filter :authenticate_user!
  load_resource :instance_name => :commentable
  authorize_resource :article
  def index
    @commentable = find_commentable #loading our generic object
  end

......

  private

  def find_commentable               
    params.each { |name, value|
      if name =~ /(.+)_id$/
        return $1.classify.constantize.includes(:comments => :karma).find(value)
      end }
  end
end

and i have in comments/index.html.erb following code that render file from other controller:

<%= render :file => "#{get_commentable_partial_name(@commentable)}/show.html.erb", :collection => @commentable %>

you can think about “#{get_commentable_partial_name(@commentable)}” like just “articles” in this case.
Content of “articles/show.html.erb”:

<% if can? :update, @commentable %>
    <%= link_to 'Edit', edit_article_path(@commentable) %> |
<% end %>

my ability.rb:

class Ability
  include CanCan::Ability

  def initialize(user)
    user ||= User.new # guest user

    if user.role? :admin
      can :manage, :all
    elsif user.role? :author
        can :read, [Article, Comment, Profile]
        can :update, Article, :user_id => user.id
    end
  end
end

i have tried debug this issue like that

user = User.first
article = Article.first
ability = Ability.new(user)
ability.can?(:update, article)

and i always get “=> true” in ability check

Note: user.role == author and article.user_id != user.id

if you need more information please write

thank’s for your time && sorry for my english

Answer 1

okay i figure it out, redetermined rules in ability.rb so now order is like guest->author->moderator->admin and problem is solved. I believe root of problem was in cancan logic which assumes that i need to redefine rules or do it in order i’ve show before