Rails 3 & cancan: User should not be allowed to edit record but is able to?

Question

I am trying to implement specific object (row) authorisation using cancan, I want it to work in a way that a user can only make a change(update/edit) to a Record if he/she has the role for that specific Record. after consulting the cancan docs I tried doing the following:

class Ability
  include CanCan::Ability
  def initialize(user)
     can :manage, Record do |record|
        user.can_edit(record)
     end
  end
end


class User
  has_many :assignments
  has_many :roles_as_editor, :through => :assignments, :class_name => "Role", :source => :role, :conditions => {:edit => true}
  def rec_as_editor
    self.roles_as_editor.collect{ |x| Record.where(:cp_secondary_id => x.record_id) }.flatten.uniq
  end

  def can_edit(rec)
    rec_as_editor.include?(rec)
  end
end

The can_edit method takes in a Record object and ensures that a User has the role necessary to make a change to it by returning true or false. this method is tested and works correctly so the problem seems to be with the CanCan code because when i try editing a Record that the user dosent hold the role for it still allows me to make changes to the Record, anyone know why this wont work?

If you require any further information please let me know through a comment.

Thank You

Answer 1

Are you authorizing the resource in the controller?

you should have load_and_authorize_resource in your controller

or

def edit
    @critical_process = CriticalProcess.find(params[:id])
    #this here is what you use
    authorize! :edit, @critical_process
  end 

in your edit method inside the critical process controller.