Question

I’m using Devise and a user can either be an admin or not (true, false).

Can someone help me figure out how to protect a controller action such as:

  def new
    @post = Post.new
  end

I know Devise lets you call administrators by using in views but can this be used in controllers?:

if current_user.admin?

Thanks in advance.

Answer 1

You can simply add a filter, this way:

class YourController < ApplicationController
  before_filter :check_access, :only => :new

  ...

  def new
    @post = Post.new
  end

  protected
  def check_access
    redirect_to <whatever> and return unless current_user.admin?
  end
end

or use CanCan or something like that, to hold restrictions nicely