Finally finished with devise and cancan

Gemfile

@@ -1,14 +1,14 @@
 source 'https://rubygems.org'
 
 gem 'rails', '3.2.8'
-gem 'bcrypt-ruby', '~> 3.0.0'
+gem 'devise'
+gem 'cancan'
 
 gem 'jquery-rails'
 gem 'faker'
 gem 'bootstrap-sass'
 gem 'will_paginate', '~> 3.0'
 gem 'bootstrap-will_paginate'
-gem 'cancan'
 
 group :development, :test do
   gem 'rspec-rails', '~> 2.0'

Gemfile.lock

@@ -54,6 +54,11 @@ GEM
       coffee-script-source
       execjs
     coffee-script-source (1.3.3)
+    devise (2.1.2)
+      bcrypt-ruby (~> 3.0)
+      orm_adapter (~> 0.1)
+      railties (~> 3.1)
+      warden (~> 1.2.1)
     diff-lcs (1.1.3)
     erubis (2.7.0)
     execjs (1.4.0)
@@ -82,6 +87,7 @@ GEM
     mime-types (1.19)
     multi_json (1.3.6)
     nokogiri (1.5.5)
+    orm_adapter (0.4.0)
     polyglot (0.3.3)
     rack (1.4.1)
     rack-cache (1.2)
@@ -149,6 +155,8 @@ GEM
     uglifier (1.3.0)
       execjs (>= 0.3.0)
       multi_json (~> 1.0, >= 1.0.2)
+    warden (1.2.1)
+      rack (>= 1.0)
     will_paginate (3.0.3)
     xpath (0.1.4)
       nokogiri (~> 1.3)
@@ -158,12 +166,12 @@ PLATFORMS
 
 DEPENDENCIES
   annotate (~> 2.5)
-  bcrypt-ruby (~> 3.0.0)
   bootstrap-sass
   bootstrap-will_paginate
   cancan
   capybara (~> 1.1.2)
   coffee-rails (~> 3.2.1)
+  devise
   factory_girl_rails
   faker
   jquery-rails

app/controllers/ads_controller.rb

@@ -1,9 +1,14 @@
 class AdsController < ApplicationController
-  before_filter :signed_in_user
-  before_filter :correct_user, only: [ :edit, :update, :destroy ]
+  load_and_authorize_resource
+
+  def index
+    @ads = Ad.paginate(page: params[:page])
+  end
+
+  def show
+  end
 
   def new
-    @ad = current_user.ads.build
   end
 
   def edit
@@ -21,6 +26,7 @@ def create
   end
 
   def update
+    @ad = Ad.find(params[:id])
     if @ad.update_attributes(params[:ad])
       flash[:success] = "Ad updated!"
       redirect_to current_user
@@ -32,15 +38,7 @@ def update
 
   def destroy
     @ad.destroy
+    flash[:notice] = "Successfuly destroyed article."
     redirect_to current_user
   end
-
-  private
-
-  def correct_user
-    @ad = current_user.ads.find(params[:id])
-  rescue
-    render(file: File.join(Rails.root, 'public/422.html'), status: 403,
-                                                           layout: false)
-  end
 end

app/controllers/application_controller.rb

@@ -1,8 +1,7 @@
 class ApplicationController < ActionController::Base
   protect_from_forgery
-  include SessionsHelper
-
-  def current_ability
-    @current_ability ||= Ability.new(current_user)
+  rescue_from CanCan::AccessDenied do |exception|
+    flash[:error] = "Access denied."
+    redirect_to root_url
   end
 end

app/controllers/users_controller.rb

@@ -1,63 +1,17 @@
 class UsersController < ApplicationController
-  before_filter :signed_in_user, only: [:index, :edit, :update]
-  before_filter :correct_user, only: [:edit, :update]
+  load_and_authorize_resource
 
   def index
     @users = User.paginate(page: params[:page])
   end
 
   def show
-    @user = User.find(params[:id])
     @ads = @user.ads.paginate(page: params[:page])
   end
 
-  def new
-    @user = User.new
-  end
-
-  def create
-    @user = User.new(params[:user])
-    if @user.save
-      sign_in @user
-      flash[:success] = "Welcome to the ADS project"
-      redirect_to @user
-    else
-      render 'new'
-    end
-  end
-
-  def edit
-    @user = User.find(params[:id])
-  end
-
-  def update
-    @user = User.find(params[:id])
-    if @user.update_attributes(params[:user])
-      flash[:success] = "Profile updated!"
-      sign_in @user
-      redirect_to @user
-    else
-      render 'edit'
-    end
-  end
-
   def destroy
     User.find(params[:id]).destroy
     flash[:success] = "User destroyed!"
     redirect_to users_path
   end
-
-  private
-
-    def signed_in_user
-      unless signed_in?
-        store_location
-        redirect_to signin_path, notice: "Please sign in."
-      end
-    end
-
-    def correct_user
-      @user = User.find(params[:id])
-      redirect_to(root_path) unless current_user?(@user)
-    end
 end

app/helpers/application_helper.rb

@@ -1,2 +1,17 @@
 module ApplicationHelper
+
+  def alert_type(type)
+    case type
+      when :alert
+        "alert-error"
+      when :error
+        "alert-error"
+      when :notice
+        "alert-success"
+      when :success
+        "alert-success"
+      else
+        type.to_s
+    end
+  end
 end

app/models/ability.rb

@@ -4,10 +4,20 @@ class Ability
   def initialize(user)
 
     user ||= User.new # guest user (not logged in)
-    if user.admin?
+    if user.role == 'admin'
       can :manage, :all
     else
       can :read, :all
+
+      if user.role == 'user'
+        can :create, Ad
+        can :update, Ad do |ad|
+          ad.try(:user) == user
+        end
+        can :destroy, Ad do |ad|
+          ad.try(:user) == user
+        end
+      end
     end