I've been going through the railscast on using the cancan gem but am stuck on how to only allow a user to visit their own show page. My code looks like this: Ability model class Ability include...

I'm developing a Rails 3 app using Devise and CanCan. The app allows anonymous (not registered) users to access some of the app, and registered users to access other parts. One aspect of the app (a...

I need to check :read? on an object in the console, how can I do this?

What exactly is happening when I do: @patient.course_enrollments.accessible_by(current_ability) What seems to happen is I get course_enrollments where course.client_id = user.client.id, I just d...

According to all documentation, the :read action is aliased to both :index and :show: alias_action :index, show, :to => :read However, consider the following scenario with nested resources: ...

I'm changing some of my custom CanCan actions in the Ability class to use blocks instead of just a hash but now they've stopped actually restricting access. The odd thing is that the built in actio...

I am having difficulty getting a rspec test for a controller to pass. I would like to test that the POST create action works. I am using rails (3.0.3), cancan (1.4.1), devise (1.1.5), rspec (2.3.0)...

I have Projects resource which is nested in Users resource. My Cancan Ability class is: class Ability include CanCan::Ability def initialize(user) #everyone can :read, Project if user.blank...

On my rails app I have implemented AuthLogic and CanCan. However when trying to figure out if the user can manage an article (checks if he is owner through the article.user_id) with CanCan I am run...

In the documentation of CanCan it shows how to fetch all accessible records in this way: @articles = Article.accessible_by(current_ability) but what is current_ability? I've tried passing the cu...

You can get the current_user's permissions from a view or controller using can? in this fashion: <% if can? :update, @article %> <%= link_to "Edit", edit_article_path(@article) %> &...