Question

I’m using Devise. I added a admin boolean column to my users table:

class AddAdminToUsers < ActiveRecord::Migration
  def self.up
    add_column :users, :admin, :boolean, :default => false
  end

  def self.down
    remove_column :users, :admin
  end
end

I want only allow admins to destroy users.
Devise’s before_filter :authenticate_user! works by only enabling signed in users to perform an action. Is there a way of adding something to :authenticate_user so that only users with :admin => true can perform an action (en.g. destroy action)?

Answer 1

before_filter :authenticate_user!
before_filter :is_admin?

def is_admin?
  if current_user.admin?
    true
  else
    render :text => 'Who are you to doing this? :)'
  end
end