use cancan and devise in my application

Question

I want to use cancan in order to limit the users that want to view some pages in my application.

so I try to do it by this tutorial: http://www.roberthuberdeau.com/articles/9-Blog-tutorial-part-3

I have two roles: Admin and Worker, and I have two controllers: Tasksadmins and Workers.

I want to define the next thing:

1) Workers can manage and see all the things of the Workerscontroller.

2) Admins can manage and see all the things of the Tasksadminscontroller.

I'm not sure if I defined it correctly:

class Ability
    include CanCan::Ability

    def initialize(user)
      user ||= User.new # guest user

      if user.role? :Admin
        can :manage, :tasksadmins
      elsif user.role? :Worker
        can :manage, :workers
      end
   end
end

the next thing that I think I don't need to implement is: "the def initialize user bit is for guest users." I force the users to sign_in with: before_filter :authenticate_user

the next thing is: start restricting access to the blog application based on user role:

I don't know what and where I should write.

in the example, he wrote:

authorize! :edit, @article

so I tried to write the next followings in the tasksadmins controller:

authorize! :edit, @tasksadmins
authorize! :new, @tasksadmins
authorize! :index, @tasksadmins
authorize! :create, @tasksadmins
authorize! :show, @tasksadmins
authorize! :destroy, @tasksadmins

but I got an error: undefined method 'authorize!' for TasksadminsController:Class

please help me, I'm in the end of the definition of cancan.

I'm really surprised that each role would only be able to access one controller. Do your "Taskadmins" actually administer "Taskadmin" model objects? — willglynn
yes.. my application is: TODO list. in the tasksadmins controller, the admins can let tasks for workers. in 'Workers' controller, the worker can see the tasks and edit only the done button (if the task was done or not). — Alon Shmiel

Jay Truluck Jay Truluck · Accepted Answer · 2012-12-31T20:42:50

This article is pretty dated, I would suggest looking at the CanCan docs on the github page, particularly this one. This looks like what you want to do but as shown in the doc, you do not have to authorize every action individually. Also, this should help with your second issue with devise. If you are specifying the version for devise like as shown in the article I would highly recommend upgrading your gems if possible. Good luck!

use cancan and devise in my application

1 Answers