ryanb/cancan — Issue #551: Index action ... is that the way it should be written ?
Author: erwin
Created: 2012-01-20 13:59:15+00:00
State: open

I defined an ability for admin users to avoid display of superadmin info :
( the superadmin record doesn't belongs to any area ... so area_id => nil )

class BackofficeAbility
include CanCan::Ability
def initialize(user)
user ||= Admin.new
if user.is? :admin
cannot :index, Admin, :area_id => nil

It seems I have to define the :index action like that : ( as described in the wiki pages , Admin.accessible_by(ability).paginate ..)
def index
ability = BackofficeAbility.new(current_admin)
@order = ["created_at desc", "name asc"]
@page_number = params[:page].nil? ? 1 : params[:page].to_i
@admins = Admin.accessible_by(ability).paginate(:page => @page_number, :per_page => Admin.per_page)
@total_pages = @admins.count / Admin.per_page + (@admins.count % Admin.per_page > 0 ? 1 : 0 )
end

it running fine .... I tested without the ability check in the :index action and it's not fine , superadmin record is displayed ..
I thought the ability would have been already checked by the load_and_authorize_resource , isn't ???

thanks for clarifying it ...