authorization with cancancan

app/controllers/admin/callforpapers_controller.rb

@@ -1,5 +1,7 @@
-class Admin::CallforpapersController < ApplicationController
-  before_filter :verify_organizer
+module Admin
+  class CallforpapersController < ApplicationController
+    load_and_authorize_resource :conference, find_by: :short_title
+#     load_and_authorize_resource :call_for_paper, class: 'CallForPapers', through: :conference
 
     def show
       @cfp = @conference.call_for_papers
@@ -50,3 +52,4 @@ class Admin::CallforpapersController < ApplicationController
       end
     end
   end
+end

app/controllers/admin/campaigns_controller.rb

@@ -1,6 +1,7 @@
 module Admin
   class CampaignsController < ApplicationController
-    before_filter :verify_organizer
+    load_and_authorize_resource :conference, find_by: :short_title
+    load_and_authorize_resource :campaign, through: :conference
 
     def index
       @conference = Conference.find_by(short_title: params[:conference_id])

app/controllers/admin/conference_controller.rb

@@ -1,5 +1,6 @@
-class Admin::ConferenceController < ApplicationController
-  before_filter :verify_organizer
+module Admin
+  class ConferenceController < ApplicationController
+    load_and_authorize_resource :conference, find_by: :short_title
 
     def index
       # Redirect to new form if there is no conference
@@ -62,8 +63,11 @@ class Admin::ConferenceController < ApplicationController
 
     def create
       @conference = Conference.new(params[:conference])
+
       if @conference.valid?
         @conference.save
+        # user that creates the conference becomes organizer of that conference
+        current_user.add_role :organizer, @conference
         redirect_to(admin_conference_path(id: @conference.short_title),
                     notice: 'Conference was successfully created.')
       else
@@ -72,7 +76,6 @@ class Admin::ConferenceController < ApplicationController
     end
 
     def update
-    @conference = Conference.find_by(short_title: params[:id])
       short_title = @conference.short_title
       @conference.assign_attributes(params[:conference])
       if @conference.start_date_changed? || @conference.end_date_changed?
@@ -89,7 +92,6 @@ class Admin::ConferenceController < ApplicationController
         @conference.email_settings.updated_conference_registration_dates_template
           Mailbot.conference_registration_date_update_mail(@conference).deliver
         end
-    end
 
         if @conference.update_attributes(params[:conference])
           redirect_to(edit_admin_conference_path(id: @conference.short_title),
@@ -100,6 +102,7 @@ class Admin::ConferenceController < ApplicationController
                       "#{@conference.errors.full_messages.join('. ')}.")
         end
       end
+    end
 
     def show
       @conference = Conference.find_by(short_title: params[:id])
@@ -177,3 +180,4 @@ class Admin::ConferenceController < ApplicationController
       end
     end
   end
+end

app/controllers/admin/dietchoices_controller.rb

@@ -1,5 +1,7 @@
-class Admin::DietchoicesController < ApplicationController
-  before_filter :verify_organizer
+module Admin
+  class DietchoicesController < ApplicationController
+    load_and_authorize_resource :conference, find_by: :short_title
+    load_and_authorize_resource :dietary_choice, through: :conference
 
     def show
       render :diets_list
@@ -14,3 +16,4 @@ class Admin::DietchoicesController < ApplicationController
       end
     end
   end
+end

app/controllers/admin/difficulty_levels_controller.rb

@@ -1,5 +1,7 @@
-class Admin::DifficultyLevelsController < ApplicationController
-  before_filter :verify_organizer
+module Admin
+  class DifficultyLevelsController < ApplicationController
+    load_and_authorize_resource :conference, find_by: :short_title
+    authorize_resource :difficulty_level, through: :conference
 
     def index
       @conference = Conference.find_by(short_title: params[:conference_id])
@@ -27,3 +29,4 @@ class Admin::DifficultyLevelsController < ApplicationController
       end
     end
   end
+end

app/controllers/admin/emails_controller.rb

@@ -1,5 +1,7 @@
-class Admin::EmailsController < ApplicationController
-  before_filter :verify_organizer
+module Admin
+  class EmailsController < ApplicationController
+    load_and_authorize_resource :conference, find_by: :short_title
+    load_and_authorize_resource :emails, class: EmailSettings
 
     def update
       @conference.email_settings.update_attributes(params[:email_settings])
@@ -12,3 +14,4 @@ class Admin::EmailsController < ApplicationController
       @settings = @conference.email_settings
     end
   end
+end

app/controllers/admin/event_types_controller.rb

@@ -1,7 +1,7 @@
 module Admin
-  class EventTypesController < Admin::BaseController
-    authorize_resource
+  class EventTypesController < ApplicationController
     load_and_authorize_resource :conference, find_by: :short_title
+    authorize_resource :event_type, through: :conference
 
     def show
       render :eventtypes

app/controllers/admin/events_controller.rb

@@ -1,6 +1,7 @@
 module Admin
   class EventsController < ApplicationController
-    before_filter :verify_organizer
+    load_and_authorize_resource :conference, find_by: :short_title
+    load_and_authorize_resource :event, through: :conference
 
     before_action :get_event, except: [:index, :create]
 
@@ -13,6 +14,7 @@ module Admin
     end
 
     def index
+      @conference = Conference.find_by(short_title: params[:conference_id])
       @events = @conference.events
       @tracks = @conference.tracks
       @machine_states = @events.state_machine.states.map

app/controllers/admin/lodgings_controller.rb

@@ -1,6 +1,7 @@
 module Admin
   class LodgingsController < ApplicationController
-    before_filter :verify_organizer
+    load_and_authorize_resource :conference, find_by: :short_title
+    authorize_resource :lodging, through: :conference
 
     def index
       @venue = @conference.venue

app/controllers/admin/questions_controller.rb

@@ -1,20 +1,19 @@
-class Admin::QuestionsController < ApplicationController
-  before_filter :verify_organizer
+module Admin
+  class QuestionsController < ApplicationController
+    load_and_authorize_resource :conference, find_by: :short_title
+    authorize_resource :question, through: :conference
 
     def index
-    @conference = Conference.find_by(short_title: params[:conference_id])
       @questions = Question.where(global: true).all | Question.where(conference_id: @conference.id)
       @questions_conference = @conference.questions
       @new_question = @conference.questions.new
     end
 
     def new
-    @conference = Conference.find_by(short_title: params[:conference_id])
       @new_question = @conference.questions.new
     end
 
     def create
-    @conference = Conference.find_by(short_title: params[:conference_id])
       @question = @conference.questions.new(params[:question])
       @question.conference_id = @conference.id
 
@@ -30,31 +29,18 @@ class Admin::QuestionsController < ApplicationController
 
     # GET questions/1/edit
     def edit
-    @conference = Conference.find_by(short_title: params[:conference_id])
+
       @question = Question.find(params[:id])
 
-    if @question.global == true && !has_role?(current_user, "Admin")
+      if @question.global == true && !(current_user.has_role? :organizer, @conference)
         redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), alert: "Sorry, you cannot edit global questions. Create a new one.")
       end
     end
 
     # PUT questions/1
     def update
-       
-    @conference = Conference.find_by(short_title: params[:conference_id])
       @question = Question.find(params[:id])
 
-    if @question.update_attributes(params[:question])
-      redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), notice: "Question '#{@question.title}' for #{@conference.short_title} successfully updated.")
-    else
-      redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), notice: "Update of questions for #{@conference.short_title} failed.")
-    end
-  end
-
-  # Update questions used for the conference
-  def update_conference
-    @conference = Conference.find_by(short_title: params[:conference_id])
-
       if @conference.update_attributes(params[:conference])
         redirect_to(admin_conference_questions_path(conference_id: @conference.short_title), notice: "Questions for #{@conference.short_title} successfully updated.")
       else
@@ -62,10 +48,18 @@ class Admin::QuestionsController < ApplicationController
       end
     end
 
+    # Update questions used for the conference
+    def update_conference
+      if @conference.update_attributes(params[:conference])
+        redirect_to(admin_conference_questions_path(:conference_id => @conference.short_title), :notice => "Questions for #{@conference.short_title} successfully updated.")
+      else
+        redirect_to(admin_conference_questions_path(:conference_id => @conference.short_title), :notice => "Update of questions for #{@conference.short_title} failed.")
+      end
+    end
+
     # DELETE questions/1
     def destroy
-    if has_role?(current_user, "Admin")
-      @question = Question.find(params[:id])
+      if can? :destroy, @question
 
         # Do not delete global questions
         if @question.global == false

app/controllers/admin/registrations_controller.rb

@@ -1,6 +1,7 @@
 module Admin
   class RegistrationsController < ApplicationController
-    before_filter :verify_organizer
+    load_and_authorize_resource :conference, find_by: :short_title
+    load_and_authorize_resource through: :conference
 
     def index
       session[:return_to] ||= request.referer
@@ -12,7 +13,6 @@ module Admin
     end
 
     def change_field
-      @registration = Registration.find(params[:id])
       field = params[:view_field]
       if @registration.send(field.to_sym)
         @registration.update_attribute(:"#{field}", 0)
@@ -26,12 +26,10 @@ module Admin
     end
 
     def edit
-      @registration = @conference.registrations.where('id = ?', params[:id]).first
       @user = User.where('id = ?', @registration.user_id).first
     end
 
     def update
-      @registration = @conference.registrations.where('id = ?', params[:id]).first
       @user = User.where('id = ?', @registration.user_id).first
       begin
         @user.update_attributes!(params[:registration][:user_attributes])
@@ -55,6 +53,7 @@ module Admin
     def new
       @user = User.new
       @registration = @user.registrations.new
+      @registration.conference_id = @conference.id
       @supporter_registration = @conference.supporter_registrations.new
     end
 
@@ -97,7 +96,7 @@ module Admin
     end
 
     def destroy
-      if has_role?(current_user, 'Admin')
+      if can? :destroy, @registration
         registration = @conference.registrations.where(id: params[:id]).first
         user = User.where('id = ?', registration.user_id).first
 

app/controllers/admin/rooms_controller.rb

@@ -1,5 +1,7 @@
-class Admin::RoomsController < ApplicationController
-  before_filter :verify_organizer
+module Admin
+  class RoomsController < ApplicationController
+    load_and_authorize_resource :conference, find_by: :short_title
+    authorize_resource :room, through: :conference
 
     def show
       render :rooms_list
@@ -17,3 +19,4 @@ class Admin::RoomsController < ApplicationController
       end
     end
   end
+end

app/controllers/admin/schedules_controller.rb

@@ -1,6 +1,10 @@
 module Admin
   class SchedulesController < ApplicationController
-    before_filter :verify_organizer
+    # By authorizing 'conference' resource, we can ensure there will be no unauthorized access to
+    # the schedule of a conference, which should not be accessed in the first place
+    load_and_authorize_resource :conference, find_by: :short_title
+    authorize_resource class: false
+
     skip_before_filter :verify_authenticity_token, only: [:update]
     layout 'schedule'
 

app/controllers/admin/social_events_controller.rb

@@ -1,5 +1,7 @@
-class Admin::SocialEventsController < ApplicationController
-  before_filter :verify_organizer
+module Admin
+  class SocialEventsController < ApplicationController
+    load_and_authorize_resource :conference, find_by: :short_title
+    authorize_resource :social_event, through: :conference
 
     def show
       render :social_events_list
@@ -13,3 +15,4 @@ class Admin::SocialEventsController < ApplicationController
       end
     end
   end
+end

app/controllers/admin/speakers_controller.rb

@@ -1,6 +1,8 @@
 module Admin
   class SpeakersController < ApplicationController
-    before_filter :verify_organizer
+    load_and_authorize_resource :conference, find_by: :short_title
+    load_and_authorize_resource :speaker, through: :conference
+
     respond_to :js, :html
 
     def edit

app/controllers/admin/sponsors_controller.rb

@@ -1,6 +1,7 @@
 module Admin
   class SponsorsController < ApplicationController
-    before_filter :verify_organizer
+    load_and_authorize_resource :conference, find_by: :short_title
+    authorize_resource :sponsor, through: :conference
 
     def update
       if @conference.update_attributes(params[:conference])

app/controllers/admin/sponsorship_levels_controller.rb

@@ -1,6 +1,7 @@
 module Admin
   class SponsorshipLevelsController < ApplicationController
-    before_filter :verify_organizer
+    load_and_authorize_resource :conference, find_by: :short_title
+    authorize_resource :sponsorship_level, through: :conference
 
     def update
       if @conference.update_attributes(params[:conference])

app/controllers/admin/stats_controller.rb

@@ -1,6 +1,7 @@
 module Admin
   class StatsController < ApplicationController
-    before_filter :verify_organizer
+    load_and_authorize_resource
+    load_and_authorize_resource :conference, find_by: :short_title
 
     def index
       @registrations = @conference.registrations.includes(:user)

app/controllers/admin/supporter_levels_controller.rb

@@ -1,12 +1,13 @@
+module Admin
   class Admin::SupporterLevelsController < ApplicationController
-  before_filter :verify_organizer
+    load_and_authorize_resource :conference, find_by: :short_title
+    authorize_resource :supporter_level, through: :conference
 
     def show
       render :supporter_levels
     end
 
     def update
-    begin
       @conference.update_attributes!(params[:conference])
       redirect_to(admin_conference_supporter_levels_path(conference_id: @conference.short_title), notice: 'Supporter levels were successfully updated.')
     rescue => e

app/controllers/admin/supporters_controller.rb

@@ -1,16 +1,21 @@
+module Admin
   class Admin::SupportersController < ApplicationController
-  before_filter :verify_organizer
+    load_and_authorize_resource :conference, find_by: :short_title
+    load_and_authorize_resource :supporter, through: :conference
 
     def index
       respond_to do |format|
         format.html
-      format.json { render json: DatatableSupporters.new(@conference.supporter_registrations, view_context) }
+        format.json { render json: DatatableSupporters.
+                      new(@conference.supporter_registrations, view_context) }
       end
     end
 
     def create
       params[:supporter_registration][:conference_id] = @conference.id
-    SupporterRegistration.create!(params[:supporter_registration])
-    redirect_to(admin_conference_supporters_path(conference_id: @conference.short_title), notice: "Supporter added")
+      supporter = SupporterRegistration.create!(params[:supporter_registration])
+      redirect_to(admin_conference_supporters_path(conference_id: @conference.short_title),
+                  notice: 'Supporter added')
+    end
   end
 end

app/controllers/admin/targets_controller.rb

@@ -1,6 +1,7 @@
 module Admin
   class TargetsController < ApplicationController
-    before_filter :verify_organizer
+    load_and_authorize_resource :conference, find_by: :short_title
+    authorize_resource :target, through: :conference
 
     def index
     end

app/controllers/admin/tracks_controller.rb

@@ -1,5 +1,7 @@
-class Admin::TracksController < ApplicationController
-  before_filter :verify_organizer
+module Admin
+  class TracksController < ApplicationController
+    load_and_authorize_resource :conference, find_by: :short_title
+    authorize_resource through: :conference
 
     def show
       respond_to do |format|
@@ -20,3 +22,4 @@ class Admin::TracksController < ApplicationController
       end
     end
   end
+end

app/controllers/admin/users_controller.rb

@@ -1,14 +1,12 @@
 module Admin
   class UsersController < ApplicationController
-    before_filter :verify_admin
+    load_and_authorize_resource :user
 
     def index
       @users = User.all
     end
 
     def show
-      @user = User.find(params[:id])
-
       # Variable @show_attributes holds the attributes that are visible for the 'show' action
       # If you want to change the attributes that are shown in the 'show' action of users
       # add/remove the attributes in the following string array
@@ -18,23 +16,16 @@ module Admin
     end
 
     def update
-      user = User.find(params[:id])
-      user.update_attributes!(params[:user])
-      redirect_to admin_users_path, notice: "Updated #{user.email}"
+      @user.update_attributes!(params[:user])
+      redirect_to admin_users_path, notice: "Updated #{@user.email}"
     end
 
     def edit
-      @user = User.find(params[:id])
-    end
-
-    def delete
-      @user = User.find(params[:id])
     end
 
     def destroy
-      @user = User.find(params[:id])
       @user.destroy
-      redirect_to admin_users_path, notice: 'User got deleted'
+      redirect_to admin_users_path, notice: "User #{@user.name} (#{@user.email})got deleted"
     end
   end
 end

app/controllers/admin/venue_controller.rb

@@ -1,5 +1,7 @@
-class Admin::VenueController < ApplicationController
-  before_filter :verify_organizer
+module Admin
+  class VenueController < ApplicationController
+    load_and_authorize_resource :conference, find_by: :short_title
+    load_and_authorize_resource :venue, through: :conference, singleton: true
 
     def index
     end
@@ -32,3 +34,4 @@ class Admin::VenueController < ApplicationController
       render :venue_info
     end
   end
+end

app/controllers/admin/volunteers_controller.rb

@@ -1,11 +1,13 @@
-class Admin::VolunteersController < ApplicationController
+module Admin
+  class VolunteersController < ApplicationController
+    load_and_authorize_resource :conference, find_by: :short_title
+    authorize_resource class: false, through: :conference
+
     def index
-    @conference = Conference.find_by(short_title: params[:conference_id])
       render :index
     end
 
     def show
-    @conference = Conference.find_by(short_title: params[:conference_id])
       if @conference.use_vpositions
         @volunteers = @conference.registrations.joins(:vchoices).uniq
       else
@@ -23,3 +25,4 @@ class Admin::VolunteersController < ApplicationController
       end
     end
   end
+end

app/controllers/application_controller.rb

@@ -4,13 +4,15 @@ class ApplicationController < ActionController::Base
   before_filter :get_conferences
   before_filter :store_location
   helper_method :date_string
+  # Ensure every controller authorizes resource or skips authorization (skip_authorization_check)
+  check_authorization unless: :devise_controller?
 
   def store_location
     session[:return_to] = request.fullpath if request.get? and controller_name != "user_sessions" and controller_name != "sessions"
   end
 
   def after_sign_in_path_for(resource)
-    if organizer_or_admin? &&
+    if can? :view, Conference &&
       (!session[:return_to] ||
       session[:return_to] &&
       session[:return_to] == root_path)
@@ -39,36 +41,21 @@ class ApplicationController < ActionController::Base
       return false
     end
 
-    @conference = Conference.find_by(short_title: params[:conference_id])
     true
   end
 
-  def organizer_or_admin?
-    has_role?(current_user, 'admin') || has_role?(current_user, 'organizer')
+  def current_ability
+    if self.class.to_s.split('::').first == 'Admin'
+      @current_ability ||= AdminAbility.new(current_user)
+    else
+      @current_ability ||= Ability.new(current_user)
     end
-
-  def verify_organizer
-    if !verify_user
-      return
-    end
-
-    ## Todo simplify this
-    redirect_to root_path unless has_role?(current_user, 'admin') || has_role?(current_user, 'organizer')
-  end
-
-  def verify_admin
-    if !verify_user
-      return
-    end
-
-    redirect_to root_path unless has_role?(current_user, 'admin')
   end
 
   rescue_from CanCan::AccessDenied do |exception|
     Rails.logger.debug("Access denied!")
     redirect_to root_path, alert: exception.message
   end
-  helper_method :organizer_or_admin?
 
   def not_found
     raise ActionController::RoutingError.new('Not Found')

app/controllers/conference_controller.rb

@@ -1,11 +1,12 @@
 class ConferenceController < ApplicationController
+  load_and_authorize_resource find_by: :short_title
+
   def show
-    @conference = Conference.find_by_short_title(params[:id])
     not_found unless @conference.make_conference_public?
   end
 
   def gallery_photos
-    @photos = Conference.find_by_short_title(params[:id]).photos
+    @photos = @conference.photos
     render "photos", formats: [:js]
   end
 end

app/controllers/event_attachments_controller.rb

@@ -1,9 +1,11 @@
 class EventAttachmentsController < ApplicationController
+  load_and_authorize_resource :conference, find_by: :short_title
+  load_and_authorize_resource :proposal, class: Event
+  load_and_authorize_resource :upload, class: EventAttachment, through: :proposal
   before_filter :verify_user
   skip_before_filter :verify_user, only: [:show]
 
   def index
-    @proposal = Event.find(params[:proposal_id])
     @uploads = @proposal.event_attachments
     @uploads = @uploads.map{|upload| upload.to_jq_upload }
 
@@ -14,9 +16,9 @@ class EventAttachmentsController < ApplicationController
   end
 
   def show
-    upload = EventAttachment.find(params[:id])
-    if upload.public?
-      send_file upload.attachment.path
+
+    if @upload.public?
+      send_file @upload.attachment.path
       return
     end
 
@@ -26,7 +28,7 @@ class EventAttachmentsController < ApplicationController
     end
 
     if organizer_or_admin? || current_user == upload.event.submitter
-      send_file upload.attachment.path
+      send_file @upload.attachment.path
     else
       raise ActionController::RoutingError.new('Not Found')
     end
@@ -42,7 +44,6 @@ class EventAttachmentsController < ApplicationController
   end
 
   def edit
-    @upload = EventAttachment.find(params[:id])
   end
 
   def create
@@ -50,7 +51,7 @@ class EventAttachmentsController < ApplicationController
     params[:event_attachment][:public] = false
     params[:event_attachment][:event_id] = params[:proposal_id]
 
-    if !organizer_or_admin?
+    if cannot? :create, EventAttachment
       begin
         current_user.events.find(params[:proposal_id])
       rescue
@@ -83,8 +84,6 @@ class EventAttachmentsController < ApplicationController
   end
 
   def update
-    @proposal = current_user.events.find(params[:proposal_id])
-    @upload = @proposal.event_attachments.find(params[:proposal_id])
 
     respond_to do |format|
       if @upload.update_attributes(params[:upload])
@@ -98,9 +97,8 @@ class EventAttachmentsController < ApplicationController
   end
 
   def destroy
-    @proposal = Event.find(params[:proposal_id])
 
-    if organizer_or_admin? || current_user == @proposal.submitter
+    if can? :destroy, @proposal
       @upload = @proposal.event_attachments.find(params[:id])
     end
 

app/controllers/home_controller.rb

@@ -1,5 +1,6 @@
 class HomeController < ApplicationController
   before_filter :respond_to_options
+  skip_authorization_check
 
   def index
     @today = Date.current

app/controllers/proposal_controller.rb

@@ -1,32 +1,35 @@
 class ProposalController < ApplicationController
+  load_and_authorize_resource :conference, find_by: :short_title
+  load_and_authorize_resource :event, parent: false
   before_filter :verify_user, except: [:show]
-  before_action :set_conference, only: [:show]
-  before_action :set_event, only: [:show, :edit, :update, :destroy, :confirm, :restart]
+  before_filter :setup
+
+  def setup
+    @user = current_user if current_user
+    @url = conference_proposal_index_path(@conference.short_title)
+    @event_types = @conference.event_types
+  end
 
   def index
     @events = current_user.proposals(@conference)
   end
 
   def show
-    authorize! :show, @event
     # FIXME: We should show more than the first speaker
     @speaker = @event.speakers.first || @event.submitter
   end
 
   def new
-    authorize! :new, Event
     @url = conference_proposal_index_path(@conference.short_title)
     @event = Event.new
   end
 
   def edit
-    authorize! :edit, @event
     @url = conference_proposal_path(@conference.short_title, params[:id])
     @attachments = @event.event_attachments
   end
 
   def create
-    authorize! :create, Event
     @url = conference_proposal_index_path(@conference.short_title)
 
     params[:event].delete :user
@@ -63,7 +66,6 @@ class ProposalController < ApplicationController
   end
 
   def update
-    authorize! :update, @event
     @url = conference_proposal_path(@conference.short_title, params[:id])
 
     # First, update the submitter's info, if they've changed anything
@@ -129,12 +131,12 @@ class ProposalController < ApplicationController
   end
 
   def restart
-    authorize! :update, @event
     @url = conference_proposal_path(@conference.short_title, params[:id])
 
     begin
       @event.restart
     rescue Transitions::InvalidTransition
+
       redirect_to(conference_proposal_index_path(conference_id: @conference.short_title),
                   error: "The proposal can't be re-submitted.")
       return
@@ -149,14 +151,4 @@ class ProposalController < ApplicationController
     redirect_to(conference_proposal_index_path(conference_id: @conference.short_title),
                 notice: "The proposal was re-submitted. The #{@conference.short_title} organizers will review it again.")
   end
-
-  private
-
-  def set_conference
-    @conference = Conference.find_by(short_title: params[:conference_id])
-  end
-
-  def set_event
-    @event = Event.find(params[:id])
-  end
 end

app/controllers/schedule_controller.rb

@@ -1,4 +1,5 @@
 class ScheduleController < ApplicationController
+  authorize_resource class: false
   layout "application"
 
   def index

app/controllers/users/omniauth_callbacks_controller.rb

@@ -1,6 +1,7 @@
 module Users
   class OmniauthCallbacksController < Devise::OmniauthCallbacksController
     skip_before_filter :verify_authenticity_token
+    skip_authorization_check
 
     User.omniauth_providers.each do |provider|
       define_method(provider) { handle(provider) }

app/models/ability.rb

@@ -2,16 +2,27 @@ class Ability
   include CanCan::Ability
 
   def initialize(user)
-    # guest user (not logged in)
-    user ||= User.new
-    if user.admin? || user.organizer?
-      # An admin can manage everything
-      can :manage, :all
-    else
-      can [:update, :destroy], Event do |event|
-        event.users.include?(user)
-      end
-      can [:create, :read], Event
-    end
+    # Define abilities for the passed in user here. For example:
+    #
+    user ||= User.new # guest user (not logged in)
+    #   if user.admin?
+    #     can :manage, :all
+    #   else
+    #     can :read, :all
+    #   end
+    #
+    # The first argument to `can` is the action you are giving the user permission to do.
+    # If you pass :manage it will apply to every action. Other common actions here are
+    # :read, :create, :update and :destroy.
+    #
+    # The second argument is the resource the user can perform the action on. If you pass
+    # :all it will apply to every resource. Otherwise pass a Ruby class of the resource.
+    #
+    # The third argument is an optional hash of conditions to further filter the objects.
+    # For example, here the user can only update published articles.
+    #
+    #   can :update, Article, :published => true
+    #
+    # See the wiki for details: https://github.com/ryanb/cancan/wiki/Defining-Abilities
   end
 end

app/models/admin_ability.rb

@@ -0,0 +1,11 @@
+class AdminAbility
+  include CanCan::Ability
+
+  def initialize(user)
+    user ||= User.new # for guest
+    if user.role?('Conference Admin')
+      can :manage, :all
+    end
+
+  end
+end