Question

I have a simple setup with Cancan and Devise.

I wanna show the edit button only to “Admins” and Users which owns the “location”:

So in the show.html.erb I have

<% if can? :manage, location, :user_id == current_user.id %>
    <%= link_to 'Edit', edit_location_path %>
<% end %>

My ability.rb looks like this

if user.roles.include?('User')
  can [:show, :index, :create], Location
  can :manage, Location, :user_id => user.id
end

The locationController contains this on the very top:

load_and_authorize_resource

User Id is referenced in Location.user_id

But it does not show up the EDIT Button…

Did I miss something?

PS: user.id does not work in the view. and current_user.id does not work in the ability.rb

PPS: My roles are stored in an array eg: Roles [“User”, “Admin”] and works well.

Answer 1

I’ve got it working with

can :manage, Location, :user_id => user.id.to_s

I hope it helps someone!