CanCan - Access denied - Way to make CanCan Specify in the LOG Why?

Question

I'm working to implement CanCan. For some reason CanCan keeps giving me Access Denied when I try to get specific about model permissions. And I can't figure out why.

Is there a way to get CanCan to be specific, perhaps in the logs or in development about Why Access is denied? something like, No Read Ability to XXX Model.

That would be helpful for debugging.

Thanks

Answer 1

You can add a rescue_from block in ApplicationController to handle CanCan exceptions and set your custom error message there. See the CanCan docs for a detailed explanation.

Answer 2

You can add some output in your Ability model and check after what can or cannot your ability failed.

Or you can add a debugger session in start of you ability class.

Answer 3

You can do:

# in ApplicationController
rescue_from CanCan::AccessDenied do |exception|
  Rails.logger.debug "Access denied on #{exception.action} #{exception.subject.inspect}"
  # ...
end

More info on the project's homepage: https://github.com/ryanb/cancan/wiki/Debugging-Abilities