Question

I’ve got a User controller with a few of the regular methods. My ability.rb is set up but I need non-logged in users to not have to deal with this one action. I’ve tried all of the following in my ability.rb for non-logged in users but it hasn’t made a difference.. I’m still getting an unauthorized error.

can :create, User
can :update, User
can :edit, User
can :modify, User

Next I tried creating an entry in my ability.rb

can :do_this_action, User

And put this in the Users Controller

authorize!(:can_do_this_action, User.new || @user)

Still no luck..

Lastly, I tried to just skip the action. I did it with this in my Users Controller:

skip_authorization_check :only => [:create, :new, :custom_method ]
authorize_resource

That still gives my custom method an unauthorized error. Anyone have any idea where I’m going wrong? Thanks in advance.

Answer 1

Try using this helper just like a :before_filter:

load_and_authorize_resource :only => [:index, :show] #or use :except