ryanb/cancan — Issue #537: Basic newbie issue
Author: vince
Created: 2011-12-28 05:35:17+00:00
State: open

I've got a very basic problem trying to protect a custom action where, no matter what I try, I keep getting "You are not authorized to access this page."

messages_controller.rb

def sent
@page_title = "Message Center"
@company = Company.find(params[:company_id])
@messages = @company.sent_messages
authorize!(:view_sent_messages, current_user)
end

ability.rb

def initialize(user)
user ||= User.new

if user.has_role? :admin
can :manage, :all
else

can :view_sent_messages, Message do |message|
message.sender_company_id == user.company_id
end
end

I've also tried without success

can :view_sent_messages, Message
can :view_sent_messages, Message, sender_company_id: user.company_id
can :view_sent_messages, Message do |message|
true
end

From console:

ruby-1.9.2-p290 :004 > Message.accessible_by(ability)
=> []

or sometimes I get an error: CanCan::Error: The accessible_by call cannot be used with a block 'can' definition. Basically I'm at the wall at must be doing something really stupid since this isn't that complicated of a use case. Any help would be greatly appreciated!