Question

Im trying to add devise authorization to my rails 3 app.
Its all going well except Im also trying to follow this tutorial to dynamically set attr_accessible for role_ids only for admin users (I dont want regular users changing their role, but an admin should be able to do so)… the problem is, the railscast tutorial approach assumes I have access to change the controller behavior when in fact devise is handling all that under the hood.

Please Help

Answer 1

You can subclass the Devise controllers, you just have to generate the views and move them to the correct place. Check out “Configuring views” and “Configuring controllers” in the Devise readme.

I ended up adding role_ids to attr_accessible, then subclassing the RegistrationsController and adding a before_filter to remove that param for non-admins.

class Users::RegistrationsController < Devise::RegistrationsController
  before_filter :remove_admin_params, :only => [:create, :update]

protected
  # disable setting the role_ids value unless an admin is doing the edit.
  def remove_admin_params
    params[:user].delete(:role_ids) unless current_user.try(:admin?)
  end
end

Just make sure to add the registration views to /app/views/users/registrations/.