Question

I’m working on a polling app and use Devise and Cancan for authentication and authorization. I have a User model generated by Devise and a Poll model. A poll belongs to a user. My problem is that I have a custom action in my Polls controller and I can’t get Cancan to work with that custom action. This is what I tried to do in my code:

config/routes.rb:

match 'users/:user_id/polls' => 'polls#show_user'

Ability.rb:

def initialize(user)
  user ||= User.new

  if user.is? :admin
    can :manage, :all
  else # default
    can :read, :all
    can :manage, Poll, :user_id => user.id
    can :show_user, Poll, :user_id => user.id
  end # if else admin
end

polls_controller.rb:

class PollsController < ApplicationController
  before_filter :authenticate_user!
  load_and_authorize_resource :except => :show_user

  def show_user
    authorize! :show_user, user
    @polls = Poll.find_all_by_user_id(params[:user_id])
    render "index"
  end
  <...>
end

The idea is that a user’s polls can be viewed only when the owner of the poll is signed in. However, with this code, when a poll’s owner is signed in, that user gets kicked out of that page with a message that says authorization failed. If I remove the line authorize! :show_user, user, then a user who’s signed in can view all other user’s polls (the authorization doesn’t work at all).

Can anyone see what I might be missing? Thanks in advance!

Answer 1

In abiltity.rb, you’re verb/noun combination is :show_user and Poll, but in your controller you’re using :show_user and user–you would need to use a Poll instead.

If, instead you want to allow the user to view all their own Polls, you might go with something like:

ability.rb:

can :show_polls_for, User, :id => user.id

polls_controller.rb:

def show_user
  authorize! :show_polls_for, user
  ...
end