Require authorization active_admin/devise in controller :only index show edit destroy

Question

I am trying to require an authorization in my controller called purcahses_controller.rb It's just an order form model with Show Edit Destroy.. I can view it in active_admin, the url being localhost/admin/purchases. But the problem is I can also view it at localhost/purchases. It lists all of the orders and allows all functions. Id like to route_to rooturl with a simple unauthorized message if the user isn't logged in.

Answer 1

You can do the following and it will give you option to redirect to any path you see fit.

In the file

config/initializers/active_admin.rb

Make the following change

config.authentication_method = :authenticate_active_admin_user!

Then inside your application controller adding something like this:

class ApplicationController < ActionController::Base
  protect_from_forgery

  def authenticate_active_admin_user!
    authenticate_user!
    unless current_user.superadmin?
      flash[:alert] = "Unauthorized Access!"
      redirect_to "/admin/login"
    end
  end
end

In your purchases_controller add the following before_filter line:

before_filter :authenticate_active_admin_user!

Hopefully this helps! ~Kevin