CanCan Auth issue

Question

Good Afternoon All,

I am trying to sort out my user authentication and causing myself headaches.

I have a :role_type defined in User and my user has two roles, Employer or Developer, now I my user is currently developer and should be able to see jobs#index but it cannot and I get the default cancan message of unauthorized:

class JobsController < ApplicationController
  load_and_authorize_resource
  before_filter :authenticate_user!
  before_action :set_job, only: [:show, :edit, :update, :destroy]

and here is the Ability.rb

class Ability
  include CanCan::Ability

def initialize(user)
    user ||= User.new # guest user (not logged in)

    can :create, :delete, :update, Job if user.role_type == "Employer"
    can :read, Job if user.role_type == "Developer"
end
end

Thanks for the help.

Answer 1

As written in the comments: Make sure that you are not having a typo like "Employer" instead of "employer" :-)

Answer 2

I'm assuming the error occurs when the user.role_type == 'Employer'

Looking at your code it looks like the Employer is missing the :read action. If Employer can manage all jobs (basic crud actions) you might want to consider giving him the :manage ability

Example:

can :manage, Job if user.role_type == "Employer"
can :read, Job if user.role_type == "Developer"

The :manage ability gives the user access to every action within the JobsController. See the following doc for clarification on the :manage ability: https://github.com/ryanb/cancan/wiki/defining-abilities#the-can-method

Otherwise you would need to add the :read action to Employer, as they are not a Developer and will not get the :read action