Question

I was following the tutorial at http://www.logansbailey.com/ and modified it to enable an unregistered person to be able to register with a username, email and password.
I already enabled a logged in user to modify his/her email and password but not the username.

What I want to add is:

1) to enable a logged in user to be able to see/reach his/her username and email,
2) to enable a user with admin_flag set (I handled this in the sql table and created the user) to be able to see/modify all user records.

I modifyed the app/cotrollers/user_controller.rb like this:

class UsersController < ApplicationController

  before_filter :is_user, :only => [:index, :show, :edit, :update, :destroy]

  def index
    @users = User.all

    respond_to do |format|
      format.html # index.html.erb
      format.xml { render :xml => @users }
    end
  end

  def show
    @user = User.find(params[:id])

    respond_to do |format|
      format.html # show.html.erb
      format.xml { render :xml => @user }
    end
  end

  def new
    @user = User.new

    respond_to do |format|
      format.html # new.html.erb
      format.xml { render :xml => @user }
    end
  end

  def edit
  end

  def create
    @user = User.new(params[:user])

    respond_to do |format|
      if @user.save
        flash[:notice] = 'Registration successful.'
        format.html { redirect_to(:controller => 'home', :action => 'tutorial') }
        format.xml { render :xml => @user, :status => :created, :location => @user }
      else
        format.html { render :action => "new" }
        format.xml { render :xml => @user.errors, :status => :unprocessable_entity }
      end
    end
  end

  def update

    respond_to do |format|
      if @user.update_attributes(params[:user])
        flash[:notice] = 'Your profile was successfully updated.'
        format.html { redirect_to(:controller => 'home', :action => 'index') }
        format.xml { head :ok }
      else
        format.html { render :action => "edit" }
        format.xml { render :xml => @user.errors, :status => :unprocessable_entity }
      end
    end
  end

  def destroy
    @user = User.find(params[:id])
    @user.destroy

    respond_to do |format|
      format.html { redirect_to(users_url) }
      format.xml { head :ok }
    end
  end

  def is_user
    if User.exists?(params[:id])
      @user = User.find(params[:id]);
      if current_user.admin_flag == true
        flash[:notice] = 'Welcome Admin'
      end
      if !current_user || current_user.id != @user.id
        flash[:notice] = 'You do not have access to that page'
        redirect_to(:controller => 'home', :action => 'index')
      end
    else
      flash[:notice] = 'You do not have access to that page'
      redirect_to(:controller => 'home', :action => 'index')
    end
  end
end

The file app/models/user.rb is:

class User < ActiveRecord::Base
  acts_as_authentic
end

And I can confirm that the admin_flag set user is get correctly since the file app/views/layouts/application.html.erb containing:

  <div id="admin">
    <% if current_user %>
      <% if current_user.admin_flag == true %> |
      <%= link_to "Users", users_path %>
      <% end %>
    <% end %>
  </div>

correctly displays the ‘Users’ link when I log in as the admin.

Now the problem is that I can’t get the show all users, edit other users etc.. functionality. As the admin, I can show and modify the admin user just like all the other ordinary users, meaning I can’t modify the username, too.

What may be wrong here?

Answer 1

When you added a boolean attribute admin to user in the right way, the Rails should add question-mark method admin? in User model. It’s not important but for convenience.
On every method you want to protect from unwanted actions use before_filter:

class UsersController < ApplicationController

  before_filter :admin_user,   :only => :destroy
  before_filter :correct_user, :only => [:edit, :update]

  def destroy
  end

  ...

  private

  def admin_user
    redirect_to(root_path) unless current_user.admin?
  end

  def correct_user
    @user = User.find(params[:id])
    redirect_to(root_path) unless current_user?(@user) || current_user.admin?
  end
end

In views more convenient to use current_user.admin?

<div id="admin">
  <% if current_user.admin? %>
    <%= link_to "Users", users_path %>
  <% end %>
</div>