Rails Authentication with Devise and CanCan part 2 – Restful Resources for Administrators

devise_for :users
resources :users

class UsersController < ApplicationController
  before_filter :get_user, :only => [:index,:new,:edit]
  before_filter :accessible_roles, :only => [:new, :edit, :show, :update, :create]
  load_and_authorize_resource :only => [:show,:new,:destroy,:edit,:update]
 
  # GET /users
  # GET /users.xml                                                
  # GET /users.json                                       HTML and AJAX
  #-----------------------------------------------------------------------
  def index
    @users = User.accessible_by(current_ability, :index).limit(20)
    respond_to do |format|
      format.json { render :json => @users }
      format.xml  { render :xml => @users }
      format.html
    end
  end
 
  # GET /users/new
  # GET /users/new.xml                                            
  # GET /users/new.json                                    HTML AND AJAX
  #-------------------------------------------------------------------
  def new
    respond_to do |format|
      format.json { render :json => @user }   
      format.xml  { render :xml => @user }
      format.html
    end
  end
 
  # GET /users/1
  # GET /users/1.xml                                                       
  # GET /users/1.json                                     HTML AND AJAX
  #-------------------------------------------------------------------
  def show
    respond_to do |format|
      format.json { render :json => @user }
      format.xml  { render :xml => @user }
      format.html      
    end
 
  rescue ActiveRecord::RecordNotFound
    respond_to_not_found(:json, :xml, :html)
  end
 
  # GET /users/1/edit                                                      
  # GET /users/1/edit.xml                                                      
  # GET /users/1/edit.json                                HTML AND AJAX
  #-------------------------------------------------------------------
  def edit
    respond_to do |format|
      format.json { render :json => @user }   
      format.xml  { render :xml => @user }
      format.html
    end
 
  rescue ActiveRecord::RecordNotFound
    respond_to_not_found(:json, :xml, :html)
  end
 
  # DELETE /users/1     
  # DELETE /users/1.xml
  # DELETE /users/1.json                                  HTML AND AJAX
  #-------------------------------------------------------------------
  def destroy
    @user.destroy!
 
    respond_to do |format|
      format.json { respond_to_destroy(:ajax) }
      format.xml  { head :ok }
      format.html { respond_to_destroy(:html) }      
    end
 
  rescue ActiveRecord::RecordNotFound
    respond_to_not_found(:json, :xml, :html)
  end
 
  # POST /users
  # POST /users.xml         
  # POST /users.json                                      HTML AND AJAX
  #-----------------------------------------------------------------
  def create
    @user = User.new(params[:user])
 
    if @user.save
      respond_to do |format|
        format.json { render :json => @user.to_json, :status => 200 }
        format.xml  { head :ok }
        format.html { redirect_to :action => :index }
      end
    else
      respond_to do |format|
        format.json { render :text => "Could not create user", :status => :unprocessable_entity } # placeholder
        format.xml  { head :ok }
        format.html { render :action => :new, :status => :unprocessable_entity }
      end
    end
  end
  ...
end

  # Get roles accessible by the current user
  #----------------------------------------------------
  def accessible_roles
    @accessible_roles = Role.accessible_by(current_ability,:read)
  end
 
  # Make the current user object available to views
  #----------------------------------------
  def get_user
    @current_user = current_user
  end

  # PUT /users/1
  # PUT /users/1.xml
  # PUT /users/1.json                                            HTML AND AJAX
  #----------------------------------------------------------------------------
  def update
    if params[:user][:password].blank?
      [:password,:password_confirmation,:current_password].collect{|p| params[:user].delete(p) }
    else
      @user.errors[:base] << "The password you entered is incorrect" unless @user.valid_password?(params[:user][:current_password])
    end
 
    respond_to do |format|
      if @user.errors[:base].empty? and @user.update_attributes(params[:user])
        flash[:notice] = "Your account has been updated"
        format.json { render :json => @user.to_json, :status => 200 }
        format.xml  { head :ok }
        format.html { render :action => :edit }
      else
        format.json { render :text => "Could not update user", :status => :unprocessable_entity } #placeholder
        format.xml  { render :xml => @user.errors, :status => :unprocessable_entity }
        format.html { render :action => :edit, :status => :unprocessable_entity }
      end
    end
 
  rescue ActiveRecord::RecordNotFound
    respond_to_not_found(:js, :xml, :html)
  end

<!-- table header stuff here -->
<% @users.each do |u| %>
  <tr>
    <td><%= link_to_if(can?(:read, User), "#{u.name}", user_path(u.id)) {} %></td>
    <td><%= "#{u.email}" %></td>
    <td><%= "#{u.roles.collect{|r| r.name}}" %></td>
    <td><%= link_to_if(can?(:edit, User), image_tag("/images/edit_icon.gif"), edit_user_path(u.id)) {} %></td>
    <td><%= link_to_if(can?(:delete, u), image_tag("/images/delete_icon.gif"), u, :confirm => "Are you sure?", :method => :delete) {} %></td>
  </tr>
<% end %>

<h2>Register User</h2>
 
<%= form_for(@user) do |f| %>
  <%= error_messages(@user,"Could not register user") %>
 
  <%= render :partial => 'user_fields', :locals => { :f => f } %>
 
  <p><%= f.label :password %></p>
  <p><%= f.password_field :password %></p>
 
  <p><%= f.label :password_confirmation %></p>
  <p><%= f.password_field :password_confirmation %></p>
 
  <p><%= f.submit "Register" %></p>
<% end %>

<p><%= f.label :first_name %></p>
<p><%= f.text_field :first_name %></p>
 
<p><%= f.label :last_name %></p>
<p><%= f.text_field :last_name %></p>
 
<p><%= f.label :email %></p>
<p><%= f.text_field :email %></p>
 
<% if can? :read, Role %>
	<p><%= f.label :role %></p>
	<ul class="no-pad no-bullets">
		<%= habtm_checkboxes(@user, :role_ids, @accessible_roles, :name) %>
	</ul>
<% end %>

<h3><%= @user == @current_user ? "Your Account Settings" : "Edit User" %></h3>
 
<%= form_for(@user, :html => { :method => :put }) do |f| %>
	<%= error_messages(@user,"Could not update user") %>
	<%= render :partial => 'user_fields', :locals => { :f => f } %>
 
	<p><%= f.label :password %> <i>(leave blank if you don't want to change it)</i></p>
	<p><%= f.password_field :password %></p>
 
	<p><%= f.label :password_confirmation %></p>
	<p><%= f.password_field :password_confirmation %></p>
 
	<p><%= f.label :current_password %> <i>(we need your current password to confirm your changes)</i></p>
	<p><%= f.password_field :current_password %></p>
 
  <p><%= f.submit "Update" %></p>
<% end %>
<%= link_to "Back", :back %>

<h3><%= @user.name %></h3>
 
<%= link_to_if(can?(:update,@user), "Edit", edit_user_path(@user)) %> |
<%= link_to_if(can?(:delete, @user), "Delete", user_path(@user), :confirm => "Are you sure?", :method => :delete) {} %>
 
<table class="one-column-emphasis">
	<tbody>
		<tr>
			<td class="oce-first">Email:</td>
			<td><%= @user.email %></td>
		</tr>
		<tr>
			<td class="oce-first">Role:</td>
			<td><%= @user.roles.first.name %></td>
		</tr>
	<% if can?(:see_timestamps,User) %>
		<tr>
			<td class="oce-first">Created at:</td>
			<td><%= @user.created_at %></td>
		</tr>
		<tr>
			<td class="oce-first">Last Sign In:</td>
			<td><%= @user.last_sign_in_at %></td>
		</tr>
		<tr>
			<td class="oce-first">Sign In Count:</td>
			<td><%= @user.sign_in_count %></td>
		</tr>
	<% end %>
	</tbody>
</table>

#------------------------------------------------
def initialize(user)
    user ||= User.new # guest user
 
    if user.role? :admin
      can :see_timestamps, User
    elsif user.role? :normal
      can :see_timestamps, User, :id => user.id
    end
end