akshatpradhan/spoutlets — pull request #64 by akshatpradhan (2013-03-17 18:20:34+00:00)
Title: remove ability for everybody to see /users

This is what allows us to stop people from viewing `/users`.

However, this solution appears to be interesting and useful for restricting everybody except admin from viewing `/users`. It's done by adding a method `authenticate_admin!` to the `application_controller.rb`:

```ruby
def authenticate_admin!
unless current_user && current_user.admin?
redirect_to root_url, :alert => 'You cannot access that page.'
end
end
```
With the code above, you'd have to define a `admin?` method on User (I'm not sure how your role system works, but it should be straightforward). You'd then add `before_filter :authenticate_admin!, only: [:index]` to your `UsersController`.

Sorry, not much experience with `cancan`, but hopefully this is helpful.