Question

I’m using rolify to manage user roles and when I try to update the roles via a user form I receive this:

can't mass-assign protected attributes: role_ids

This is comforting, but it has me wondering, how do I then allow admin to update user roles via mass-assign yet not allow normal users to?

Answer 1

You can use a different attr_accessible list inside your User model:

attr_accessible :name
attr_accessible :name, :role_ids, :as => :admin

And then inside the create and update actions for your admin controller:

User.create(params[:user], :as => :admin)

user.update_attributes(params[:user], :as => :admin)