authorization with cancancan

app/controllers/proposal_controller.rb

@@ -1,32 +1,35 @@
 class ProposalController < ApplicationController
+  load_and_authorize_resource :conference, find_by: :short_title
+  load_and_authorize_resource :event, parent: false
   before_filter :verify_user, except: [:show]
-  before_action :set_conference, only: [:show]
-  before_action :set_event, only: [:show, :edit, :update, :destroy, :confirm, :restart]
+  before_filter :setup
+
+  def setup
+    @user = current_user if current_user
+    @url = conference_proposal_index_path(@conference.short_title)
+    @event_types = @conference.event_types
+  end
 
   def index
     @events = current_user.proposals(@conference)
   end
 
   def show
-    authorize! :show, @event
     # FIXME: We should show more than the first speaker
     @speaker = @event.speakers.first || @event.submitter
   end
 
   def new
-    authorize! :new, Event
     @url = conference_proposal_index_path(@conference.short_title)
     @event = Event.new
   end
 
   def edit
-    authorize! :edit, @event
     @url = conference_proposal_path(@conference.short_title, params[:id])
     @attachments = @event.event_attachments
   end
 
   def create
-    authorize! :create, Event
     @url = conference_proposal_index_path(@conference.short_title)
 
     params[:event].delete :user
@@ -63,7 +66,6 @@ class ProposalController < ApplicationController
   end
 
   def update
-    authorize! :update, @event
     @url = conference_proposal_path(@conference.short_title, params[:id])
 
     # First, update the submitter's info, if they've changed anything
@@ -129,12 +131,12 @@ class ProposalController < ApplicationController
   end
 
   def restart
-    authorize! :update, @event
     @url = conference_proposal_path(@conference.short_title, params[:id])
-    
+
     begin
       @event.restart
     rescue Transitions::InvalidTransition
+
       redirect_to(conference_proposal_index_path(conference_id: @conference.short_title),
                   error: "The proposal can't be re-submitted.")
       return
@@ -149,14 +151,4 @@ class ProposalController < ApplicationController
     redirect_to(conference_proposal_index_path(conference_id: @conference.short_title),
                 notice: "The proposal was re-submitted. The #{@conference.short_title} organizers will review it again.")
   end
-
-  private
-
-  def set_conference
-    @conference = Conference.find_by(short_title: params[:conference_id])
-  end
-
-  def set_event
-    @event = Event.find(params[:id])
-  end
 end