Allow only one user to be an admin with devise

Question

I`m creating a webpage with rails 6 , devise and cancan .

I need an admin role but i do not want to create a separate model instead i added a Boolean column to user is table , but here`s the thing ,

If any user sign up then it would be a security concern that any user would grant admin privileges only by changing the value of this column to true .

So i thought perhaps i would remove "admin" from "user_params" but then i would have to make this change from the console which is not good enough.

How i should only grant admin to specific user , my thoughts where i would only allow it for the first user only, or specific email but it feels stupid , there must be a smarter way.

How i get the application to have only one admin who can make any other user admin but only him who can do that and if any normal user signed up , no matter what he ca not manipulate this column in any way?

Best Regards

Answer 1

1. Remove admin from user_params in signup controller. You don't want users to become admin just by preparing request.
2. Introduce third column super_admin, and grant this role from the console if you have to do it only once.
3. Create views and controllers only accessible to super_admin where she can update admin for all users.