ruby on rails - cancan method and devise -
this ability , limited users can read own. if go through routes can still see index of other users.
i don't want put current user in index rout because limit admin user, because have models, admin , user.
class ability include cancan::ability def initialize(user) if user.is_a?(admin) can :manage, :all elsif user.is_a?(user) can :show, profile can :read, profile |profile| profile.try(:user) == user end can :update, profile |profile| profile.try(:user) == user end can :destroy, profile |profile| profile.try(:user) == user end can :create, profile else can :show, profile cannot :destroy cannot :create end end end
refctored , added restrictions see users , profiles index pages.
class ability include cancan::ability def initialize(user) if user.is_a?(admin) can :manage, :all elsif user.is_a?(user) can [:show, :create], profile can [:read, :update, :destroy], profile, user: user cannot :index, profile cannot :index, user else can :show, profile cannot :destroy cannot :create end end end what have do, redirect user on access denied exception. take docs
Comments
Post a Comment